Security hole uncovered in Ruby; many Rails apps likely affected
- TAGS:Ruby, Ruby on Rails
- IT TOPICS:Cybercrime & Hacking, Development, Security
The Ruby programming language's bigDecimal standard library has a denial-of-service vulnerability that would allow malicious hackers to successfully launch a DoS attack. The security hole allows an attack "by causing BigDecimal to parse an insanely large number, such as: BigDecimal("9E69999999").to_s("F")," according to a Web site maintained by the Ruby community.
The Rails framework's ActiveRecord standard model uses this Ruby library, "so most Rails applicaions are affected by this," the posting notes.
Ruby 1.8.6-p368 and all prior versions, as well as 1.8.7-p160 and all prior versions are affected. Users are advised to upgrade to 1.8.6-p369 or 1.8.7-p173. Ruby's 1.9.1 series is not affected by the security hole.
There is a suggested workaround for those unable to upgrade, according to an e-mail from Rails contributor and consultant Michael Koziarski.
Free Insider Guide