Important Security Update - Dragonfly 0.9.14 released [CVE-2013-1756]

[Mark Evans]

Hi All

Unfortunately there is a security vulnerability in Dragonfly when used with Rails which would potentially allow an attacker to run arbitrary code on a host machine using carefully crafted requests.

The vulnerability has been assigned the CVE identifier CVE-2013-1756.

Dragonfly version 0.9.14 has been released, which fixes the vulnerability.

It is recommended that you upgrade immediately.

Versions affected

-------------------------

 All versions between 0.7.0 and 0.9.12, when used with Rails.

Fix release

----------------

0.9.14

Credits

---------

Many thanks to Charlie Somerville for reporting the vulnerability

Mark Evans

[Olivier Gonzalez]

Hi, 

You say affected versions are 0.7.0 through 0.9.12, but the version that contains the fix is 0.9.14

So what about 0.9.13? 

Thanks

Olivier

[Mark Evans]

0.9.13 is also fixed, however I didn't say to upgrade to it because there is a bug where some urls containing '+' characters don't get recognised properly (fixed in 0.9.14).
However it is secure
cheers
Mark

[Olivier Gonzalez]

Thanks!

In case you wonder why I asked this: https://gemnasium.com/gems/dragonfly/versions/0.9.12

cheers,

Olivier.

[Mark Evans]

aah.. I didn't know about gemnasium - nice site!

[Ralf Kistner]

Hi,

Is there any chance this could be backported to the 0.8.x series? I'm running some Rails 2.3 apps using Dragonfly, and I can't easily upgrade to Rails 3.

Regards,

Ralf

[Semyon Perepelitsa]

Does this vulnerability affect applications using config.protect_from_dos_attacks = true in prior versions?

[Frederick Cheung]

I remember a discussion on this and I believe that the conclusion was that is doesn't - the payload is unmarshalled before the checksum is checked (before the checksum is based on the unmarshalled content)

Fred

On 18 Apr 2013, at 15:11, Semyon Perepelitsa <semaper...@gmail.com> wrote:

> Does this vulnerability affect applications using config.protect_from_dos_attacks = true in prior versions?
>

> --
> You received this message because you are subscribed to the Google Groups "Dragonfly" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to dragonfly-use...@googlegroups.com.
> For more options, visit https://groups.google.com/groups/opt_out.
>
>

[Frederick Cheung]

Sorry, i realise that that is ambiguous: config.protect_from_dos_attacks does not protect you and you are still vulnerable

Fred

[Mark Evans]

the fix has been backported to 0.8.6
cheers

[Mark Evans]

that's correct - the fix is still necessary