Skip to content

Commit a0bfb5b

Browse files
stomarstomar
committed
Import latest news posts (en, ja)
1 parent 5bf250e commit a0bfb5b

6 files changed

+498
-0
lines changed

‎en/news/_posts/2013-02-22-json-dos-cve-2013-0269.md

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
---
2+
layout: news_post
3+
title: "Denial of Service and Unsafe Object Creation Vulnerability in JSON (CVE-2013-0269)"
4+
author: "usa"
5+
lang: en
6+
---
7+
8+
There is a denial of service and unsafe object creation vulnerability in
9+
the json bundled with ruby. This vulnerability has been assigned the CVE
10+
identifier CVE-2013-0269. We strongly recommend to upgrade ruby.
11+
12+
## Details
13+
14+
When parsing certain JSON documents, the JSON gem (includes bundled with
15+
ruby) can be coerced in to creating Ruby symbols in a target system.
16+
Since Ruby symbols are not garbage collected, this can result in a
17+
denial of service attack.
18+
19+
The same technique can be used to create objects in a target system that
20+
act like internal objects. These \"act alike\" objects can be used to
21+
bypass certain security mechanisms and can be used as a spring board for
22+
SQL injection attacks in Ruby on Rails.
23+
24+
Impacted code looks like this:
25+
26+
JSON.parse(user_input)
27+
28+
Where the \`user\_input\` variable will have a JSON document like this:
29+
30+
{"json_class":"foo"}
31+
32+
The JSON gem will attempt to look up the constant \"foo\". Looking up
33+
this constant will create a symbol.
34+
35+
In JSON version 1.7.x, objects with arbitrary attributes can be created
36+
using JSON documents like this:
37+
38+
{"json_class":"JSON::GenericObject","foo":"bar"}
39+
40+
This document will result in an instance of JSON::GenericObject, with
41+
the attribute \"foo\" that has the value \"bar\". Instantiating these
42+
objects will result in arbitrary symbol creation and in some cases can
43+
be used to bypass security measures.
44+
45+
PLEASE NOTE: this behavior \*does not change\* when using \`JSON.load\`.
46+
\`JSON.load\` should \*never\* be given input from unknown sources. If
47+
you are processing JSON from an unknown source, \*always\* use
48+
\`JSON.parse\`.
49+
50+
All users running an affected release should either upgrade or use one
51+
of the work arounds immediately.
52+
53+
## Workarounds
54+
55+
For users that cannot upgrade ruby or JSON gem, change your code from
56+
this:
57+
58+
JSON.parse(json)
59+
60+
To this:
61+
62+
JSON.parse(json, :create_additions => false)
63+
64+
If you cannot change the usage of \`JSON.parse\` (for example you\'re
65+
using a gem which depends on \`JSON.parse\` like multi\_json), then
66+
apply this monkey patch:
67+
68+
module JSON
69+
class << self
70+
alias :old_parse :parse
71+
def parse(json, args = {})
72+
args[:create_additions] = false
73+
old_parse(json, args)
74+
end
75+
end
76+
end
77+
78+
## Affected versions
79+
80+
* All ruby 1.9 versions prior to ruby 1.9.3 patchlevel 392
81+
* All ruby 2.0 versions prior to ruby 2.0.0 patchlevel 0
82+
* prior to trunk revision 39208
83+
84+
## Credits
85+
86+
A huge thanks goes to the following people for responsibly disclosing
87+
this issue and working with the Rails team to get it fixed:
88+
89+
* Thomas Hollstegge of Zweitag (www.zweitag.de)
90+
* Ben Murphy
91+
92+
## History
93+
94+
* Originally published at 2013-02-22 12:00:00 (UTC)
95+

‎en/news/_posts/2013-02-22-rexml-dos-2013-02-22.md

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
---
2+
layout: news_post
3+
title: "Entity expansion DoS vulnerability in REXML (XML bomb)"
4+
author: "usa"
5+
lang: en
6+
---
7+
8+
Unrestricted entity expansion can lead to a DoS vulnerability in REXML.
9+
(The CVE identifier will be assigned later.) We strongly recommend to
10+
upgrade ruby.
11+
12+
## Details
13+
14+
When reading text nodes from an XML document, the REXML parser can be
15+
coerced in to allocating extremely large string objects which can
16+
consume all of the memory on a machine, causing a denial of service.
17+
18+
Impacted code will look something like this:
19+
20+
document = REXML::Document.new some_xml_doc
21+
document.root.text
22+
23+
When the \`text\` method is called, entities will be expanded. An
24+
attacker can send a relatively small XML document that, when the
25+
entities are resolved, will consume extreme amounts of memory on the
26+
target system.
27+
28+
Note that this attack is similar to, but different from the Billion
29+
Laughs attack. This is also related to CVE-2013-1664 of Python.
30+
31+
All users running an affected release should either upgrade or use one
32+
of the work arounds immediately.
33+
34+
## Workarounds
35+
36+
If you cannot upgrade Ruby, use this monkey patch as a workaround:
37+
38+
class REXML::Document
39+
@@entity_expansion_text_limit = 10_240
40+
41+
def self.entity_expansion_text_limit=( val )
42+
@@entity_expansion_text_limit = val
43+
end
44+
45+
def self.entity_expansion_text_limit
46+
@@entity_expansion_text_limit
47+
end
48+
end
49+
50+
class REXML::Text
51+
def self.unnormalize(string, doctype=nil, filter=nil, illegal=nil)
52+
sum = 0
53+
string.gsub( /\r\n?/, "\n" ).gsub( REFERENCE ) {
54+
s = self.expand($&, doctype, filter)
55+
if sum + s.bytesize > REXML::Document.entity_expansion_text_limit
56+
raise "entity expansion has grown too large"
57+
else
58+
sum += s.bytesize
59+
end
60+
s
61+
}
62+
end
63+
64+
def self.expand(ref, doctype, filter)
65+
if ref[1] == ?#
66+
if ref[2] == ?x
67+
[ref[3...-1].to_i(16)].pack('U*')
68+
else
69+
[ref[2...-1].to_i].pack('U*')
70+
end
71+
elsif ref == '&amp;'
72+
'&'
73+
elsif filter and filter.include?( ref[1...-1] )
74+
ref
75+
elsif doctype
76+
doctype.entity( ref[1...-1] ) or ref
77+
else
78+
entity_value = DocType::DEFAULT_ENTITIES[ ref[1...-1] ]
79+
entity_value ? entity_value.value : ref
80+
end
81+
end
82+
end
83+
84+
This monkey patch will limit the size of the entity substitutions to 10k
85+
per node. REXML already defaults to only allow 10000 entity
86+
substitutions per document, so the maximum amount of text that can be
87+
generated by entity substitution will be around 98 megabytes.
88+
89+
## Affected versions
90+
91+
* All ruby 1.9 versions prior to ruby 1.9.3 patchlevel 392
92+
* All ruby 2.0 versions prior to ruby 2.0.0 patchlevel 0
93+
* prior to trunk revision 39384
94+
95+
## Credits
96+
97+
Thanks to Ben Murphy for reporting this issue.
98+
99+
## History
100+
101+
* Originally published at 2013-02-22 12:00:00 (UTC)
102+

‎en/news/_posts/2013-02-22-ruby-1-9-3-p392-is-released.md

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
---
2+
layout: news_post
3+
title: "Ruby 1.9.3-p392 is released"
4+
author: "usa"
5+
lang: en
6+
---
7+
8+
Now Ruby 1.9.3-p392 is released. I apologize for updating too
9+
frequently.
10+
11+
This release includes security fixes about bundled JSON and REXML.
12+
13+
* [Denial of Service and Unsafe Object Creation Vulnerability in JSON
14+
(CVE-2013-0269)][1]
15+
* [Entity expansion DoS vulnerability in REXML (XML bomb)][2]
16+
17+
And some small bugfixes are also included.
18+
19+
See [tickets][3] and [ChangeLog][4] for details.
20+
21+
## Download
22+
23+
You can download this release from:
24+
25+
* [&lt;URL:ftp://ftp.ruby-lang.org/pub/ruby/1.9/ruby-1.9.3-p392.tar.bz2&gt;][5]
26+
27+
SIZE: 10024221 bytes
28+
MD5: a810d64e2255179d2f334eb61fb8519c
29+
SHA256: 5a7334dfdf62966879bf539b8a9f0b889df6f3b3824fb52a9303c3c3d3a58391
30+
31+
* [&lt;URL:ftp://ftp.ruby-lang.org/pub/ruby/1.9/ruby-1.9.3-p392.tar.gz&gt;][6]
32+
33+
SIZE: 12557294 bytes
34+
MD5: f689a7b61379f83cbbed3c7077d83859
35+
SHA256: 8861ddadb2cd30fb30e42122741130d12f6543c3d62d05906cd41076db70975f
36+
37+
* [&lt;URL:ftp://ftp.ruby-lang.org/pub/ruby/1.9/ruby-1.9.3-p392.zip&gt;][7]
38+
39+
SIZE: 13863402 bytes
40+
MD5: 212fb3bc41257b41d1f8bfe0725916b7
41+
SHA256: f200ce4a63ce57bea64028a507350717c2a16bdbba6d9538bc69e9e7c2177c8b
42+
43+
## Release Comment
44+
45+
Many committers, testers and users who gave bug reports helped me to
46+
make this release. Thanks for their contributions.
47+
48+
49+
50+
[1]: http://www.ruby-lang.org/en/news/2013/02/22/json-dos-cve-2013-0269/
51+
[2]: http://www.ruby-lang.org/en/news/2013/02/22/rexml-dos-2013-02-22/
52+
[3]: https://bugs.ruby-lang.org/projects/ruby-193/issues?set_filter=1&amp;status_id=5
53+
[4]: http://svn.ruby-lang.org/repos/ruby/tags/v1_9_3_392/ChangeLog
54+
[5]: ftp://ftp.ruby-lang.org/pub/ruby/1.9/ruby-1.9.3-p392.tar.bz2
55+
[6]: ftp://ftp.ruby-lang.org/pub/ruby/1.9/ruby-1.9.3-p392.tar.gz
56+
[7]: ftp://ftp.ruby-lang.org/pub/ruby/1.9/ruby-1.9.3-p392.zip

‎ja/news/_posts/2013-02-22-json-dos-cve-2013-0269.md

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
---
2+
layout: news_post
3+
title: "JSON におけるサービス不能攻撃および安全でないオブジェクトの生成について (CVE-2013-0269)"
4+
author: "usa"
5+
lang: ja
6+
---
7+
8+
ruby にバンドルされている JSON に関して、サービス不能攻撃 (DoS)
9+
および安全でないオブジェクトの生成を可能とする脆弱性が報告されました。 この脆弱性は CVE-2013-0269 として CVE
10+
に登録されています。 ユーザーの皆さんには ruby を更新することを強くお勧めします。
11+
12+
## 詳細
13+
14+
対象のシステムに JSON ドキュメントをパースさせる際に、JSON gem (ruby にバンドルされているものを含む) に対して Ruby
15+
の Symbol オブジェクトを生成させることができます。 Ruby は Symbol
16+
オブジェクトをガーベッジコレクションで回収しないので、結果としてサービス不能攻撃が成立し得ます。
17+
18+
同じテクニックを利用し、対象のシステムにオブジェクトを生成させ、内部のオブジェクトのように扱わせることができます。
19+
これらの「内部のオブジェクトのように扱われる」オブジェクトは、既存のセキュリティ機構をすり抜け、たとえば Ruby on Rails に対する
20+
SQL インジェクションの踏み台などに利用することができます。
21+
22+
影響を受けるコードは以下のようなものです:
23+
24+
JSON.parse(user_input)
25+
26+
\`user\_input\` 変数は以下のような JSON ドキュメントを指しています:
27+
28+
{"json_class":"foo"}
29+
30+
JSON gem は定数 \"foo\" を検索しようと試みます。 この検索の際に Symbol オブジェクトが生成されます。
31+
32+
さらに、JSON version 1.7.x においては、以下のような JSON
33+
ドキュメントを用いて任意の属性を持つオブジェクトを生成できます:
34+
35+
{"json_class":"JSON::GenericObject","foo":"bar"}
36+
37+
このドキュメントは JSON::GenericObject のインスタンスとなり、値が \"bar\" である属性 \"foo\" を持ちます。
38+
このようなオブジェクトのインスタンス化により任意の Symbol
39+
が生成可能であり、また特定の場合にはセキュリティ上の制限を回避するために使用できます。
40+
41+
*注意*\: \`JSON.load\` を使用する場合、この挙動は*変更されません*。 \`JSON.load\`
42+
には信頼できない入力元からのデータを*決して*与えるべきではありません。 もし信頼できない入力元からの JSON
43+
ドキュメントを処理する場合には、*常に* \`JSON.parse\` を使用してください。
44+
45+
影響を受けるバージョンの ruby を使用している全てのユーザーは、速やかに、ruby を更新するか、以下の回避策を適用して下さい。
46+
47+
## 回避策
48+
49+
もし ruby あるいは JSON gem を更新できない場合、以下のコード:
50+
51+
JSON.parse(json)
52+
53+
を、次のように変更してください:
54+
55+
JSON.parse(json, :create_additions => false)
56+
57+
もし \`JSON.parse\` 使用部分を直接変更できない場合 (例えば multi\_json のように内部で
58+
\`JSON.parse\` を実行している gem を利用している場合など)、以下のモンキーパッチを適用して下さい:
59+
60+
module JSON
61+
class << self
62+
alias :old_parse :parse
63+
def parse(json, args = {})
64+
args[:create_additions] = false
65+
old_parse(json, args)
66+
end
67+
end
68+
end
69+
70+
## 影響を受けるバージョン
71+
72+
* ruby 1.9.3 patchlevel 392 より前の全ての ruby 1.9 系列
73+
* ruby 2.0.0 patchlevel 0 より前の全ての ruby 2.0 系列
74+
* revision 39208 より前の開発版 (trunk)
75+
76+
## クレジット
77+
78+
この問題を正しく見つけ出し、Rails チームと共に解決してくれた以下の人々に多大な感謝を捧げます:
79+
80+
* Thomas Hollstegge of Zweitag (www.zweitag.de)
81+
* Ben Murphy
82+
83+
## 更新履歴
84+
85+
* 2013-02-22 21:00:00 (JST) 初版
86+
87+
Posted by usa on 22 Feb 2013
88+
{: .post-info}
89+

0 commit comments

Comments
 (0)