The Ruby on Rails framework and PHP language both issued security updates LAS week addressing multiple vulnerabilities.
The two security flaws fixed in PHP 5.4.4 and PHP 5.3.14 are related to each other and could potentially enable an attacker to execute arbitrary code. The primary flaw, identified as CVE-2012-2143 is a security issue with the DES (Data Encryption Standard)implementation found within the PHP “crypt()” function.
A Red Hat bugzilla report on the flaw by developer Jan Lieskovsky, notes that the flaw was found in the way DES and extended DES based crypt() password encryption function performed encryption of certain keys. The flaw is that certain keys were truncated before being DES digested, which could potentially have enabled an authentication bypass.
The second flaw identified as CVE-2012-2386, is a vulnerability within the PHP phar extension. Phar enables entire PHP applications to be placed into a PHP Archive (phar) file.
Rails 3.2.6 is now being patched for a pair of new vulnerabilities that could leave users at risk. CVE-2012-2694 details a Ruby on Rails Unsafe Query Generation Risk in Ruby on Rails risk while CVE-2012-2695 defines a Ruby on Rails SQL Injection vulnerability.
Read the full story at eSecurityPlanet:
Open Source PHP and Ruby on Rails Updated for Security
Sean Michael Kerner is a senior editor at InternetNews.com, the news service of the IT Business Edge Network, the network for technology professionals Follow him on Twitter @TechJournalist.