Ruby multi_xml Remote Arbitrary Command Execution Vulnerability

Release date:
Updated on:

Affected Systems:
Rubygems multi_xml 0.5.1
Description:
--------------------------------------------------------------------------------
Bugtraq id: 57281
CVE (CAN) ID: CVE-2013-0175
 
Multi_xml provides an Interchangeable XML backend, using LibXML, Nokogiri, Ox, and REXML libraries.
 
Multi_xml gem 0.5.1 and other versions have the remote arbitrary command execution vulnerability in the implementation of parsing XML parameters by including the symbol and yaml types in the request, attackers can exploit this vulnerability to execute arbitrary commands in the application context.
 
<* Source: vendor

Link: https://gist.github.com/d7f6d9f4925f413621aa
Http://secunia.com/advisories/51808/
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:
 
Rubygems
--------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:
 
Https://rubygems.org/gems/multi_xml/