Ruby on Rails (RoR) contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the ActiveRecord class not properly sanitizing user-supplied input to the 'where' method. This may allow an attacker to inject or manipulate SQL queries in an application built on RoR, allowing for the manipulation or disclosure of arbitrary data.

Upgrade to version 3.0.13, 3.1.5, 3.2.4 or higher, as it has been reported to fix this vulnerability. In addition, the vendor has released a patch for some older versions.

• CVE ID: 2012-2661 (see also: NVD)
• Secunia Advisory ID: 49297 49457 50160 50326 51795
• Bugtraq ID: 53753
• Vendor Specific Advisory URL: http://groups.google.com/group/rubyonrails-security/browse_thread/thread/7546a238e1962f59
  http://groups.google.com/group/rubyonrails-security/browse_thread/thread/9782f44c4540cf59
  https://groups.google.com/forum/?fromgroups#!topic/rubyonrails-security/l4L0TEVAz1k
• Mail List Post: http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00002.html
  http://seclists.org/oss-sec/2012/q2/448
  http://seclists.org/oss-sec/2012/q2/448
• Vendor Specific News/Changelog Entry: http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html
  http://lists.opensuse.org/opensuse-updates/2012-08/msg00020.html
• Vendor URL: http://rubyonrails.org/
• Other Advisory URL: https://groups.google.com/group/rubyonrails-security/msg/aee3413fb038bf56?dmode=source&output=gplain
  https://groups.google.com/group/rubyonrails-security/msg/fc2da6c627fc92df?dmode=source&output=gplain
• RedHat RHSA: RHSA-2013:0154

• Ben Murphy