製品・ソフトウェアに関する情報

JVN脆弱性詳細

Ruby on Rails の Active Record コンポーネントにおける SQL インジェクションの脆弱性

Title	Ruby on Rails の Active Record コンポーネントにおける SQL インジェクションの脆弱性
Summary	Ruby on Rails の Active Record コンポーネントには、SQL インジェクションの脆弱性が存在します。
Possible impacts	第三者により、特定の find_by_ メソッドコールに想定外のデータタイプを利用可能としているアプリケーションにおいて不正な動作をするように巧妙に細工されたリクエストを介して、任意の SQL コマンドを実行される可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	Jan. 4, 2013, midnight
Registration Date	Jan. 7, 2013, 5:24 p.m.
Last Update	Feb. 10, 2016, 5:59 p.m.

CVSS2.0 : 危険
Score	7.5
Vector	AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected System

Ruby on Rails project

Rails 3.0.18 未満

Rails 3.1.9 未満の 3.1.x

Rails 3.2.10 未満の 3.2.x

Rails 3.0.18 未満

Rails 3.1.9 未満の 3.1.x

Rails 3.2.10 未満の 3.2.x

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2012-6496	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6496
2	CVE-2012-6496	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6496
National Vulnerability Database (NVD)
3	CVE-2012-6496	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-6496
4	CVE-2012-6496	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-6496

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-89	https://jvndb.jvn.jp/ja/cwe/CWE-89.html
2	CWE-89	https://jvndb.jvn.jp/ja/cwe/CWE-89.html

ベンダー情報

No	Name	URL
Google Groups
1	SQL Injection Vulnerability in Ruby on Rails (CVE-2012-5664)	http://groups.google.com/group/rubyonrails-security/msg/23daa048baf28b64?dmode=source&output=gplain
2	SQL Injection Vulnerability in Ruby on Rails (CVE-2012-5664)	http://groups.google.com/group/rubyonrails-security/msg/23daa048baf28b64?dmode=source&output=gplain
Rails weblog
3	[ANN] Rails 3.2.10, 3.1.9, and 3.0.18 have been released!	http://weblog.rubyonrails.org/2013/1/2/Rails-3-2-10--3-1-9--and-3-0-18-have-been-released/
4	[ANN] Rails 3.2.10, 3.1.9, and 3.0.18 have been released!	http://weblog.rubyonrails.org/2013/1/2/Rails-3-2-10--3-1-9--and-3-0-18-have-been-released/
Red Hat Bugzilla
5	Bug 889649	https://bugzilla.redhat.com/show_bug.cgi?id=889649
6	Bug 889649	https://bugzilla.redhat.com/show_bug.cgi?id=889649
Red Hat Security Advisory
7	RHSA-2013:0154	http://rhn.redhat.com/errata/RHSA-2013-0154.html
8	RHSA-2013:0154	http://rhn.redhat.com/errata/RHSA-2013-0154.html
9	RHSA-2013:0155	http://rhn.redhat.com/errata/RHSA-2013-0155.html
10	RHSA-2013:0155	http://rhn.redhat.com/errata/RHSA-2013-0155.html
11	RHSA-2013:0220	http://rhn.redhat.com/errata/RHSA-2013-0220.html
12	RHSA-2013:0220	http://rhn.redhat.com/errata/RHSA-2013-0220.html
13	RHSA-2013:0544	http://rhn.redhat.com/errata/RHSA-2013-0544.html
14	RHSA-2013:0544	http://rhn.redhat.com/errata/RHSA-2013-0544.html

Change Log

No	Changed Details	Date of change
0	[2013年01月07日] 掲載 [2016年02月10日] ベンダ情報：レッドハット (RHSA-2013:0154) を追加ベンダ情報：レッドハット (RHSA-2013:0155) を追加ベンダ情報：レッドハット (RHSA-2013:0220) を追加ベンダ情報：レッドハット (RHSA-2013:0544) を追加	Feb. 17, 2018, 10:37 a.m.
0	[2013年01月07日] 掲載 [2016年02月10日] ベンダ情報：レッドハット (RHSA-2013:0154) を追加ベンダ情報：レッドハット (RHSA-2013:0155) を追加ベンダ情報：レッドハット (RHSA-2013:0220) を追加ベンダ情報：レッドハット (RHSA-2013:0544) を追加	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2012-6496

Summary	SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic finders in applications that can use unexpected data types in certain find_by_ method calls.
Publication Date	Jan. 4, 2013, 1:46 p.m.
Registration Date	Jan. 28, 2021, 3:08 p.m.
Last Update	Nov. 21, 2024, 10:46 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:rubyonrails:rails:3.1.0:beta1::::::
cpe:2.3:a:rubyonrails:rails:3.1.0:rc1::::::
cpe:2.3:a:rubyonrails:rails:3.1.0:rc2::::::
cpe:2.3:a:rubyonrails:rails:3.1.0:rc3::::::
cpe:2.3:a:rubyonrails:rails:3.1.0:rc4::::::
cpe:2.3:a:rubyonrails:rails:3.1.0:rc5::::::
cpe:2.3:a:rubyonrails:rails:3.1.0:rc6::::::
cpe:2.3:a:rubyonrails:rails:3.1.0:rc7::::::
cpe:2.3:a:rubyonrails:rails:3.1.0:::::::*
cpe:2.3:a:rubyonrails:rails:3.1.0:rc8::::::
cpe:2.3:a:rubyonrails:rails:3.1.1:rc1::::::
cpe:2.3:a:rubyonrails:rails:3.1.1:rc2::::::
cpe:2.3:a:rubyonrails:rails:3.1.1:::::::*
cpe:2.3:a:rubyonrails:rails:3.1.1:rc3::::::
cpe:2.3:a:rubyonrails:rails:3.1.2:rc1::::::
cpe:2.3:a:rubyonrails:rails:3.1.2:rc2::::::
cpe:2.3:a:rubyonrails:rails:3.1.2:::::::*
cpe:2.3:a:rubyonrails:rails:3.1.4:::::::*
cpe:2.3:a:rubyonrails:rails:3.1.4:rc1::::::
cpe:2.3:a:rubyonrails:rails:3.1.5:::::::*
cpe:2.3:a:rubyonrails:rails:3.1.5:rc1::::::
cpe:2.3:a:rubyonrails:rails:3.1.3:::::::*
cpe:2.3:a:rubyonrails:rails:3.1.6:::::::*
cpe:2.3:a:rubyonrails:rails:3.1.7:::::::*
cpe:2.3:a:rubyonrails:rails:3.1.8:::::::*

Configuration2	or higher	or less	more than	less than
cpe:2.3:a:rubyonrails:ruby_on_rails::::::::		3.0.17
cpe:2.3:a:rubyonrails:ruby_on_rails:3.0.4:::::::*
cpe:2.3:a:rubyonrails:rails:3.0.0:beta::::::
cpe:2.3:a:rubyonrails:rails:3.0.0:beta2::::::
cpe:2.3:a:rubyonrails:rails:3.0.0:beta3::::::
cpe:2.3:a:rubyonrails:rails:3.0.0:beta4::::::
cpe:2.3:a:rubyonrails:rails:3.0.0:rc::::::
cpe:2.3:a:rubyonrails:rails:3.0.0:rc2::::::
cpe:2.3:a:rubyonrails:rails:3.0.1:pre::::::
cpe:2.3:a:rubyonrails:rails:3.0.2:pre::::::
cpe:2.3:a:rubyonrails:rails:3.0.0:::::::*
cpe:2.3:a:rubyonrails:rails:3.0.10:rc1::::::
cpe:2.3:a:rubyonrails:rails:3.0.10:::::::*
cpe:2.3:a:rubyonrails:rails:3.0.12:rc1::::::
cpe:2.3:a:rubyonrails:rails:3.0.12:::::::*
cpe:2.3:a:rubyonrails:rails:3.0.13:rc1::::::
cpe:2.3:a:rubyonrails:rails:3.0.13:::::::*
cpe:2.3:a:rubyonrails:rails:3.0.1:::::::*
cpe:2.3:a:rubyonrails:rails:3.0.2:::::::*
cpe:2.3:a:rubyonrails:rails:3.0.3:::::::*
cpe:2.3:a:rubyonrails:rails:3.0.11:::::::*
cpe:2.3:a:rubyonrails:rails:3.0.14:::::::*
cpe:2.3:a:rubyonrails:rails:3.0.16:::::::*
cpe:2.3:a:rubyonrails:rails:3.0.4:rc1::::::
cpe:2.3:a:rubyonrails:rails:3.0.5:::::::*
cpe:2.3:a:rubyonrails:rails:3.0.5:rc1::::::
cpe:2.3:a:rubyonrails:rails:3.0.6:rc1::::::
cpe:2.3:a:rubyonrails:rails:3.0.6:rc2::::::
cpe:2.3:a:rubyonrails:rails:3.0.6:::::::*
cpe:2.3:a:rubyonrails:rails:3.0.7:rc1::::::
cpe:2.3:a:rubyonrails:rails:3.0.7:rc2::::::
cpe:2.3:a:rubyonrails:rails:3.0.7:::::::*
cpe:2.3:a:rubyonrails:rails:3.0.8:rc1::::::
cpe:2.3:a:rubyonrails:rails:3.0.8:rc2::::::
cpe:2.3:a:rubyonrails:rails:3.0.8:rc3::::::
cpe:2.3:a:rubyonrails:rails:3.0.8:rc4::::::
cpe:2.3:a:rubyonrails:rails:3.0.8:::::::*
cpe:2.3:a:rubyonrails:rails:3.0.9:rc1::::::
cpe:2.3:a:rubyonrails:rails:3.0.9:rc2::::::
cpe:2.3:a:rubyonrails:rails:3.0.9:rc3::::::
cpe:2.3:a:rubyonrails:rails:3.0.9:rc4::::::
cpe:2.3:a:rubyonrails:rails:3.0.9:::::::*
cpe:2.3:a:rubyonrails:rails:3.0.9:rc5::::::

Configuration3	or higher	or less	more than	less than
cpe:2.3:a:rubyonrails:rails:3.2.0:rc1::::::
cpe:2.3:a:rubyonrails:rails:3.2.0:rc2::::::
cpe:2.3:a:rubyonrails:rails:3.2.0:::::::*
cpe:2.3:a:rubyonrails:rails:3.2.7:::::::*
cpe:2.3:a:rubyonrails:rails:3.2.8:::::::*
cpe:2.3:a:rubyonrails:rails:3.2.9:::::::*
cpe:2.3:a:rubyonrails:rails:3.2.1:::::::*
cpe:2.3:a:rubyonrails:rails:3.2.5:::::::*
cpe:2.3:a:rubyonrails:rails:3.2.6:::::::*
cpe:2.3:a:rubyonrails:rails:3.2.2:rc1::::::
cpe:2.3:a:rubyonrails:rails:3.2.2:::::::*
cpe:2.3:a:rubyonrails:rails:3.2.3:rc1::::::
cpe:2.3:a:rubyonrails:rails:3.2.3:::::::*
cpe:2.3:a:rubyonrails:rails:3.2.3:rc2::::::
cpe:2.3:a:rubyonrails:rails:3.2.4:::::::*
cpe:2.3:a:rubyonrails:rails:3.2.4:rc1::::::

Related information, measures and tools

No	URL	タグ
1	http://blog.phusion.nl/2013/01/03/rails-sql-injection-vulnerability-hold-your-horses-here-are-the-facts/
2	http://blog.phusion.nl/2013/01/03/rails-sql-injection-vulnerability-hold-your-horses-here-are-the-facts/
3	http://rhn.redhat.com/errata/RHSA-2013-0154.html
4	http://rhn.redhat.com/errata/RHSA-2013-0154.html
5	http://rhn.redhat.com/errata/RHSA-2013-0155.html
6	http://rhn.redhat.com/errata/RHSA-2013-0155.html
7	http://rhn.redhat.com/errata/RHSA-2013-0220.html
8	http://rhn.redhat.com/errata/RHSA-2013-0220.html
9	http://rhn.redhat.com/errata/RHSA-2013-0544.html
10	http://rhn.redhat.com/errata/RHSA-2013-0544.html
11	http://security.gentoo.org/glsa/glsa-201401-22.xml
12	http://security.gentoo.org/glsa/glsa-201401-22.xml
13	http://www.securityfocus.com/bid/57084
14	http://www.securityfocus.com/bid/57084
15	https://bugzilla.redhat.com/show_bug.cgi?id=889649	Exploit Patch
16	https://bugzilla.redhat.com/show_bug.cgi?id=889649	Exploit Patch
17	https://groups.google.com/group/rubyonrails-security/msg/23daa048baf28b64?dmode=source&output=gplain
18	https://groups.google.com/group/rubyonrails-security/msg/23daa048baf28b64?dmode=source&output=gplain

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-89	SQLインジェクション	https://cwe.mitre.org/data/definitions/89.html

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:rubyonrails:rails:3.1.0:beta1::::::
cpe:2.3:a:rubyonrails:rails:3.1.0:rc1::::::
cpe:2.3:a:rubyonrails:rails:3.1.0:rc2::::::
cpe:2.3:a:rubyonrails:rails:3.1.0:rc3::::::
cpe:2.3:a:rubyonrails:rails:3.1.0:rc4::::::
cpe:2.3:a:rubyonrails:rails:3.1.0:rc5::::::
cpe:2.3:a:rubyonrails:rails:3.1.0:rc6::::::
cpe:2.3:a:rubyonrails:rails:3.1.0:rc7::::::
cpe:2.3:a:rubyonrails:rails:3.1.0:::::::*
cpe:2.3:a:rubyonrails:rails:3.1.0:rc8::::::
cpe:2.3:a:rubyonrails:rails:3.1.1:rc1::::::
cpe:2.3:a:rubyonrails:rails:3.1.1:rc2::::::
cpe:2.3:a:rubyonrails:rails:3.1.1:::::::*
cpe:2.3:a:rubyonrails:rails:3.1.1:rc3::::::
cpe:2.3:a:rubyonrails:rails:3.1.2:rc1::::::
cpe:2.3:a:rubyonrails:rails:3.1.2:rc2::::::
cpe:2.3:a:rubyonrails:rails:3.1.2:::::::*
cpe:2.3:a:rubyonrails:rails:3.1.4:::::::*
cpe:2.3:a:rubyonrails:rails:3.1.4:rc1::::::
cpe:2.3:a:rubyonrails:rails:3.1.5:::::::*
cpe:2.3:a:rubyonrails:rails:3.1.5:rc1::::::
cpe:2.3:a:rubyonrails:rails:3.1.3:::::::*
cpe:2.3:a:rubyonrails:rails:3.1.6:::::::*
cpe:2.3:a:rubyonrails:rails:3.1.7:::::::*
cpe:2.3:a:rubyonrails:rails:3.1.8:::::::*

Configuration2	or higher	or less	more than	less than
cpe:2.3:a:rubyonrails:ruby_on_rails::::::::		3.0.17
cpe:2.3:a:rubyonrails:ruby_on_rails:3.0.4:::::::*
cpe:2.3:a:rubyonrails:rails:3.0.0:beta::::::
cpe:2.3:a:rubyonrails:rails:3.0.0:beta2::::::
cpe:2.3:a:rubyonrails:rails:3.0.0:beta3::::::
cpe:2.3:a:rubyonrails:rails:3.0.0:beta4::::::
cpe:2.3:a:rubyonrails:rails:3.0.0:rc::::::
cpe:2.3:a:rubyonrails:rails:3.0.0:rc2::::::
cpe:2.3:a:rubyonrails:rails:3.0.1:pre::::::
cpe:2.3:a:rubyonrails:rails:3.0.2:pre::::::
cpe:2.3:a:rubyonrails:rails:3.0.0:::::::*
cpe:2.3:a:rubyonrails:rails:3.0.10:rc1::::::
cpe:2.3:a:rubyonrails:rails:3.0.10:::::::*
cpe:2.3:a:rubyonrails:rails:3.0.12:rc1::::::
cpe:2.3:a:rubyonrails:rails:3.0.12:::::::*
cpe:2.3:a:rubyonrails:rails:3.0.13:rc1::::::
cpe:2.3:a:rubyonrails:rails:3.0.13:::::::*
cpe:2.3:a:rubyonrails:rails:3.0.1:::::::*
cpe:2.3:a:rubyonrails:rails:3.0.2:::::::*
cpe:2.3:a:rubyonrails:rails:3.0.3:::::::*
cpe:2.3:a:rubyonrails:rails:3.0.11:::::::*
cpe:2.3:a:rubyonrails:rails:3.0.14:::::::*
cpe:2.3:a:rubyonrails:rails:3.0.16:::::::*
cpe:2.3:a:rubyonrails:rails:3.0.4:rc1::::::
cpe:2.3:a:rubyonrails:rails:3.0.5:::::::*
cpe:2.3:a:rubyonrails:rails:3.0.5:rc1::::::
cpe:2.3:a:rubyonrails:rails:3.0.6:rc1::::::
cpe:2.3:a:rubyonrails:rails:3.0.6:rc2::::::
cpe:2.3:a:rubyonrails:rails:3.0.6:::::::*
cpe:2.3:a:rubyonrails:rails:3.0.7:rc1::::::
cpe:2.3:a:rubyonrails:rails:3.0.7:rc2::::::
cpe:2.3:a:rubyonrails:rails:3.0.7:::::::*
cpe:2.3:a:rubyonrails:rails:3.0.8:rc1::::::
cpe:2.3:a:rubyonrails:rails:3.0.8:rc2::::::
cpe:2.3:a:rubyonrails:rails:3.0.8:rc3::::::
cpe:2.3:a:rubyonrails:rails:3.0.8:rc4::::::
cpe:2.3:a:rubyonrails:rails:3.0.8:::::::*
cpe:2.3:a:rubyonrails:rails:3.0.9:rc1::::::
cpe:2.3:a:rubyonrails:rails:3.0.9:rc2::::::
cpe:2.3:a:rubyonrails:rails:3.0.9:rc3::::::
cpe:2.3:a:rubyonrails:rails:3.0.9:rc4::::::
cpe:2.3:a:rubyonrails:rails:3.0.9:::::::*
cpe:2.3:a:rubyonrails:rails:3.0.9:rc5::::::

Configuration3	or higher	or less	more than	less than
cpe:2.3:a:rubyonrails:rails:3.2.0:rc1::::::
cpe:2.3:a:rubyonrails:rails:3.2.0:rc2::::::
cpe:2.3:a:rubyonrails:rails:3.2.0:::::::*
cpe:2.3:a:rubyonrails:rails:3.2.7:::::::*
cpe:2.3:a:rubyonrails:rails:3.2.8:::::::*
cpe:2.3:a:rubyonrails:rails:3.2.9:::::::*
cpe:2.3:a:rubyonrails:rails:3.2.1:::::::*
cpe:2.3:a:rubyonrails:rails:3.2.5:::::::*
cpe:2.3:a:rubyonrails:rails:3.2.6:::::::*
cpe:2.3:a:rubyonrails:rails:3.2.2:rc1::::::
cpe:2.3:a:rubyonrails:rails:3.2.2:::::::*
cpe:2.3:a:rubyonrails:rails:3.2.3:rc1::::::
cpe:2.3:a:rubyonrails:rails:3.2.3:::::::*
cpe:2.3:a:rubyonrails:rails:3.2.3:rc2::::::
cpe:2.3:a:rubyonrails:rails:3.2.4:::::::*
cpe:2.3:a:rubyonrails:rails:3.2.4:rc1::::::