CVE-2013-0269

Quick assessment

Copy summary Copy citation

Affected

n/a n/a

Exploitation

Public or AI PoC available; prioritize validation

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

JSON gem 1.7.7之前的1.7.x版本，1.6.8之前的1.6.x版本，以及1.5.5之前的1.5.x版本中存在漏洞。通过特制的JSON文档触发对任意Ruby符号或某内部对象的创建，比如实施针对Ruby on Rails的SQL注入攻击，远程攻击者可利用该漏洞导致拒绝服务（资源耗尽）。

CVE-2013-0269 affects n/a n/a. Public or AI PoC available; prioritize validation. JSON gem 1.7.7之前的1.7.x版本，1.6.8之前的1.6.x版本，以及1.5.5之前的1.5.x版本中存在漏洞。通过特制的JSON文档触发对任意Ruby符号或某内部对象的创建，比如实施针对Ruby on Rails的SQL注入攻击，远程攻击者可利用该漏洞导致拒绝服务（资源耗尽）。 CVE-2013-0269 vulnerability details, Shenlong CVE Platform, https://cve.imfht.com/detail/CVE-2013-0269

I. Basic Information for CVE-2013-0269

Affected Products

II. Public POCs for CVE-2013-0269

III. Intelligence Information for CVE-2013-0269

Vendor Advisories for CVE-2013-0269 (11)

• 🔗 http://www.securityfocus.com/bid/57899 vdb-entry x_refsource_BID
• 🔗 http://secunia.com/advisories/52902 third-party-advisory x_refsource_SECUNIA
• 🔗 http://www.osvdb.org/90074 vdb-entry x_refsource_OSVDB
• 🔗 http://secunia.com/advisories/52075 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/52774 third-party-advisory x_refsource_SECUNIA
• 🔗 http://www.ubuntu.com/usn/USN-1733-1 vendor-advisory x_refsource_UBUNTU
• http://rhn.redhat.com/errata/RHSA-2013-1147.html vendor-advisory x_refsource_REDHAT
• 🔗 http://rhn.redhat.com/errata/RHSA-2013-0701.html vendor-advisory x_refsource_REDHAT
• 🔗 http://rhn.redhat.com/errata/RHSA-2013-1028.html vendor-advisory x_refsource_REDHAT
• 🔗 http://rhn.redhat.com/errata/RHSA-2013-0686.html vendor-advisory x_refsource_REDHAT
• https://exchange.xforce.ibmcloud.com/vulnerabilities/82010 vdb-entry x_refsource_XF

Mailing List Discussions for CVE-2013-0269 (6)

• 🔗 http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00015.html vendor-advisory x_refsource_SUSE
• 🔗 http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00001.html vendor-advisory x_refsource_SUSE
• 🔗 http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html vendor-advisory x_refsource_APPLE
• 🔗 http://lists.opensuse.org/opensuse-updates/2013-04/msg00034.html vendor-advisory x_refsource_SUSE
• http://www.openwall.com/lists/oss-security/2013/02/11/8 mailing-list x_refsource_MLIST
• 🔗 http://www.openwall.com/lists/oss-security/2013/02/11/7 mailing-list x_refsource_MLIST

Security Blog Posts for CVE-2013-0269 (3)

• http://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed x_refsource_CONFIRM
• http://www.zweitag.de/en/blog/ruby-on-rails-vulnerable-to-mass-assignment-and-sql-injection x_refsource_MISC
• 🔗 http://weblog.rubyonrails.org/2013/2/11/SEC-ANN-Rails-3-2-12-3-1-11-and-2-3-17-have-been-released/ x_refsource_CONFIRM

Other References for CVE-2013-0269 (3)

• 🔗 https://puppet.com/security/cve/cve-2013-0269 x_refsource_CONFIRM
• 🔗 http://www.slackware.com/security/viewer.php?l=slackware-security&y=2013&m=slackware-security.426862 vendor-advisory x_refsource_SLACKWARE
• 🔗 https://groups.google.com/group/rubyonrails-security/msg/d8e0db6e08c81428?dmode=source&output=gplain mailing-list x_refsource_MLIST

• https://www.cve.org/CVERecord?id=CVE-2013-0269

Same Patch Batch · n/a · 2013-02-13 · 79 CVEs total

Showing top 20 of 79 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

V. Comments for CVE-2013-0269