Slashdot Mirror
Ruby On Rails SQL Injection Flaw Has Serious Real-Life Consequences
vikingpower writes "As a previous Slashdot story already reported, Ruby on Rails was recently reported to suffer from a major SQL injection flaw. This has prompted the Dutch government to take the one and only national site for citizens' digital identification offline (link in Dutch, Google translation to English). Here is the English-language placeholder page for the now-offline site. This means that 16 million Dutch citizens cannot authenticate themselves anymore with government instances, and that those same government instances can not communicate anything to those same citizens anymore."
Fixes were released, so it looks like it's on their sysadmin team now.
Should have used ASP.NET
That's just silly, since the fix can be easily applied. It really nothing compared to all the wordpress exploits out the that never get patched.
16Mileon Dutch people cant authenticate? Smoke them if you've got them.
Build a Man a Fire, and He'll Be Warm for a Day. Set a Man on Fire, and He'll Be Warm for the Rest of His Life.
This is a different security vulnerability that was brought to light a few days ago, which was given the full detail in this article. Finder method SQL Injection vulnerability Any Rails version that was build for the last 6 years is affected by this. This is a serious security flaw, it is sternly advised that you update your application immediately if your Rails version is in the bucket. You can refer to this discussion for more details.
That's even beginning to sound like... Full Life Consequences!
eh, ruby is a decent enough language. No comment on the users or RoR except to say a certain segment of idiots jumped from PHP to Ruby and are now (hopefully) jumping over to node.js.
And this, children, is why you actually need to know and understand SQL before you go off and start writing database applications, without depending on a "framework" to do it for you.
This signature intentionally left blank.
Rails is a vulnerability. Using it is like using PHP so don't count on security.
Down for upgrades? Down for an evaluation of whether upgrades are needed? Down for code fixes? Down because they need to evaluate what happened after confirming attack happened?
The actual vulnerability was not automatically present; it's easy to use Rails and not have this vulnerability affect you, because while the vulnerability is nominally in the code base, there's no paths to trigger it without specific code -- so either you'd have to use a specific third-party library, or write your own code which does the same things. So it might well be that the site is not actually vulnerable -- and they're just being cautious.
Which I don't think is overreacting.
My blog: http://www.seebs.net/log/ --- My iPhone/iPad app: http://www.seebs.net/seebsfrac/
You know, it's pretty obvious that you're trolling, but there's a real question here:
Why would we use frameworks, given that they have security bugs coming up all the time?
Answer: Because code people write themselves isn't any less buggy, and with a framework, at least you have other people looking for bugs too.
My blog: http://www.seebs.net/log/ --- My iPhone/iPad app: http://www.seebs.net/seebsfrac/
Why is a toy programming environment like Ruby on Rails used for such a critical infrastructure?
their sysadmin team now."
I laughed
1- Maybe implementing, validating, testing... the fix does take a bit of time ?
2- This sounds so much like a teenager "But Daddy, I know last time I went out I got back past curfew drunk and smelling of cigarettes... but that was LAST TIME, I'm trustworthy now... what's the hold-up ?"
The Cloud - because you don't care if your apps and data are up in the air.
This means that 16 million Dutch citizens cannot authenticate themselves anymore with government instances ON LINE, and that those same government instances can not DIGITALLY communicate anything to those same citizens anymore.
So instead, you make a phone call?
Privacy is terrorism.
seeeeeeeeeebs! Wish I had a mod point for you. :)
It is a computer system. Like *every* computer system, it has flaws and one of those flaws can be a security flaw. The real issue is how the flaw is being handled. One can deny it, one can secretly fix it or one can take responsiblity, inform its users and fix the issue. The last is the only correct way and it is the way the DigiD issue was handled. So, no 'real-life consequences', just another side effect of the digital age. It will soon be solved and live goes on. Nothing to see, move along.
It doesn't have to be like this. All we need to do is make sure we keep talking.
There's nothing wrong with Ruby. I love Ruby. For production deployments I'm also finding that jRuby fixes the bulk of Ruby's issues under load.
The problem is the dependency on Active Record without the slightest understanding of how the database behind it works, focussing on writing all of your code in ruby and not take the slightest advantage in letting your database do what it's specifically BUILT to do. If you wanted to say, get 20,000 of 500,000 records from a database in a certain order would you pull all of them into ruby just so you could use an array sort function on them or would you sort and filter them at the database level? You'd filter them at the database level. The people I'm referring to, would go the other route.
The search results page of this site used to run 2,000 queries to show 100 results. That's not hobos, that's morons.
"Don't teach a man to fish, feed yourself. He's a grown man. Fishing's not that hard." - Ron Swanson
Hint to brogrammers: /dev/random
Which will either block or give you data with no entropy unless you really know what you're doing.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
oh, because expensive proprietary frameworks (eg websphere or weblogic) or other open source ones (zend) never have such vulnerabilities?
you're ignorant