Bug 963334 - (CVE-2016-0753) VUL-0: CVE-2016-0753: rubygem-activemodel, rubygem-activesupport, rubygem-activerecord: Input Validation Circumvention
(CVE-2016-0753)
VUL-0: CVE-2016-0753: rubygem-activemodel, rubygem-activesupport, rubygem-act...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Security Team bot
Security Team bot
CVSSv2:RedHat:CVE-2016-0753:4.3:(AV:N...
:
Depends on:
Blocks: 963617 963618
  Show dependency treegraph
 
Reported: 2016-01-23 22:09 UTC by Andreas Stieger
Modified: 2018-04-11 14:40 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments
5-0-validation_skip.patch (4.76 KB, patch)
2016-01-23 22:10 UTC, Andreas Stieger
Details | Diff
4-2-validation_skip.patch (3.75 KB, patch)
2016-01-23 22:10 UTC, Andreas Stieger
Details | Diff
4-1-validation_skip.patch (3.69 KB, patch)
2016-01-23 22:10 UTC, Andreas Stieger
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Andreas Stieger 2016-01-23 22:09:33 UTC
EMBARGOED via distros
CRD: 2016-01-25

Possible Input Validation Circumvention in Active Model

There is a possible input validation circumvention vulnerability in Active
Model. This vulnerability has been assigned the CVE identifier CVE-2016-0753.

Versions Affected:  4.1.0 and newer
Not affected:       4.0.13 and older
Fixed Versions:     5.0.0.beta1.1, 4.2.5.1, 4.1.14.1

Impact
------
Code that uses Active Model based models (including Active Record models) and
does not validate user input before passing it to the model can be subject to
an attack where specially crafted input will cause the model to skip
validations.

Vulnerable code will look something like this:

```ruby
SomeModel.new(unverified_user_input)
```

Rails users using Strong Parameters are generally not impacted by this issue
as they are encouraged to whitelist parameters and must specifically opt-out
of input verification using the `permit!` method to allow mass assignment.

For example, a vulnerable Rails application will have code that looks like
this:

```ruby
def create
  params.permit! # allow all parameters
  @user = User.new params[:users]
end
```

Active Model and Active Record objects are not equipped to handle arbitrary
user input.  It is up to the application to verify input before passing it to
Active Model models.  Rails users already have Strong Parameters in place to
handle white listing, but applications using Active Model and Active Record
outside of a Rails environment may be impacted.

All users running an affected release should either upgrade or use one of the
workarounds immediately.

Releases
--------
The FIXED releases are available at the normal locations.

Workarounds
-----------
There are several workarounds depending on the application.  Inside a Rails
application, stop using `permit!`.  Outside a Rails application, either use
Hash#slice to select the parameters you need, or integrate Strong Parameters
with your application.

Patches
-------
To aid users who aren't able to upgrade immediately we have provided patches for
the two supported release series. They are in git-am format and consist of a
single changeset.

* 4-1-validation_skip.patch - Patch for 4.1 series
* 4-2-validation_skip.patch - Patch for 4.2 series
* 5-0-validation_skip.patch - Patch for 5.0 series

Please note that only the 4.1.x and 4.2.x series are supported at present. Users
of earlier unsupported releases are advised to upgrade as soon as possible as we
cannot guarantee the continued availability of security fixes for unsupported
releases.

Credits
-------
Thanks to:

[John Backus](https://github.com/backus) from BlockScore for reporting this!
Comment 1 Andreas Stieger 2016-01-23 22:10:02 UTC
Created attachment 662993 [details]
5-0-validation_skip.patch
Comment 2 Andreas Stieger 2016-01-23 22:10:18 UTC
Created attachment 662994 [details]
4-2-validation_skip.patch
Comment 3 Andreas Stieger 2016-01-23 22:10:32 UTC
Created attachment 662995 [details]
4-1-validation_skip.patch
Comment 4 Swamp Workflow Management 2016-01-23 23:01:27 UTC
bugbot adjusting priority
Comment 5 Andreas Stieger 2016-01-26 07:27:22 UTC
public via http://seclists.org/oss-sec/2016/q1/207
Comment 7 Jordi Massaguer 2016-01-26 16:53:13 UTC
Portus and Studio bugs created

963617 963618
Comment 13 Bernhard Wiedemann 2016-01-27 17:00:40 UTC
This is an autogenerated message for OBS integration:
This bug (963334) was mentioned in
https://build.opensuse.org/request/show/356321 42.1 / rubygem-activesupport-4_2
https://build.opensuse.org/request/show/356327 42.1 / rubygem-activerecord-4_2
Comment 14 Bernhard Wiedemann 2016-01-28 11:00:09 UTC
This is an autogenerated message for OBS integration:
This bug (963334) was mentioned in
https://build.opensuse.org/request/show/356469 42.1 / rubygem-activemodel-4_2
Comment 15 Jordi Massaguer 2016-01-28 11:23:47 UTC
all submissions have been done. Assigning to security team.
Comment 16 Swamp Workflow Management 2016-02-07 19:18:27 UTC
openSUSE-SU-2016:0372-1: An update that fixes 6 vulnerabilities is now available.

Category: security (moderate)
Bug References: 963329,963330,963331,963332,963334,963335
CVE References: CVE-2015-7576,CVE-2015-7577,CVE-2015-7581,CVE-2016-0751,CVE-2016-0752,CVE-2016-0753
Sources used:
openSUSE Leap 42.1 (src):    rubygem-actionpack-4_2-4.2.4-6.1, rubygem-actionview-4_2-4.2.4-6.1, rubygem-activemodel-4_2-4.2.4-6.1, rubygem-activerecord-4_2-4.2.4-6.1, rubygem-activesupport-4_2-4.2.4-6.1
Comment 17 Swamp Workflow Management 2016-02-11 14:14:53 UTC
SUSE-SU-2016:0432-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 963334
CVE References: CVE-2016-0753
Sources used:
SUSE Enterprise Storage 2.1 (src):    rubygem-activemodel-4_2-4.2.2-5.1
Comment 18 Swamp Workflow Management 2016-02-11 20:13:10 UTC
SUSE-SU-2016:0435-1: An update that fixes two vulnerabilities is now available.

Category: security (moderate)
Bug References: 963329,963334
CVE References: CVE-2015-7576,CVE-2016-0753
Sources used:
SUSE Enterprise Storage 2.1 (src):    rubygem-activesupport-4_2-4.2.2-6.1
Comment 19 Swamp Workflow Management 2016-02-15 17:13:41 UTC
SUSE-SU-2016:0458-1: An update that fixes two vulnerabilities is now available.

Category: security (moderate)
Bug References: 963330,963334
CVE References: CVE-2015-7577,CVE-2016-0753
Sources used:
SUSE Enterprise Storage 2.1 (src):    rubygem-activerecord-4_2-4.2.2-5.1
Comment 20 Swamp Workflow Management 2016-02-26 18:11:30 UTC
SUSE-SU-2016:0597-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 963334
CVE References: CVE-2016-0753
Sources used:
SUSE OpenStack Cloud 5 (src):    rubygem-activemodel-4_1-4.1.9-9.1
Comment 21 Swamp Workflow Management 2016-02-26 18:12:01 UTC
SUSE-SU-2016:0598-1: An update that fixes two vulnerabilities is now available.

Category: security (moderate)
Bug References: 963330,963334
CVE References: CVE-2015-7577,CVE-2016-0753
Sources used:
SUSE OpenStack Cloud 5 (src):    rubygem-activerecord-4_1-4.1.9-9.1
Comment 22 Swamp Workflow Management 2016-02-26 18:12:52 UTC
SUSE-SU-2016:0600-1: An update that fixes two vulnerabilities is now available.

Category: security (moderate)
Bug References: 963329,963334
CVE References: CVE-2015-7576,CVE-2016-0753
Sources used:
SUSE OpenStack Cloud 5 (src):    rubygem-activesupport-4_1-4.1.9-12.1
Comment 23 Marcus Meissner 2016-03-22 15:48:08 UTC
released