CVE-2007-5379

Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary files and read arbitrary XML files via the Hash.from_xml (Hash#from_xml) method, which uses XmlSimple (XML::Simple) unsafely, as demonstrated by reading passwords from the Pidgin (Gaim) .purple/accounts.xml file.

Link	Resource
http://dev.rubyonrails.org/ticket/8453
http://weblog.rubyonrails.org/2007/10/5/rails-1-2-4-maintenance-release
http://www.securityfocus.com/bid/26096	Patch
http://bugs.gentoo.org/show_bug.cgi?id=195315
http://security.gentoo.org/glsa/glsa-200711-17.xml
http://secunia.com/advisories/27657
http://docs.info.apple.com/article.html?artnum=307179
http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.html
http://www.us-cert.gov/cas/techalerts/TA07-352A.html	US Government Resource
http://secunia.com/advisories/28136
http://www.vupen.com/english/advisories/2007/3508
http://www.vupen.com/english/advisories/2007/4238
http://osvdb.org/40717

Configuration 1

cpe:2.3:a:david_hansson:ruby_on_rails:*:*:*:*:*:*:*:*

---

Published : 2007-10-19 11:17

Updated : 2012-10-31 02:44

---

NVD link : CVE-2007-5379

Mitre link : CVE-2007-5379

No products.

CWE-200