Only seems to be working for servers not running 1.8.7. Our old app runs 1.8.7, ... | Hacker News

Hacker News new | past | comments | ask | show | jobs | submit

login

kawsper on Jan 29, 2013 | parent | context | favorite | on: Vulnerability in JSON Parser in Ruby on Rails 3.0 ...

Only seems to be working for servers not running 1.8.7.

Our old app runs 1.8.7, is there a POC out for that?

postmodern_mod3 on Jan 29, 2013 | [–]

@benmmurphy seems to be the only one who knows how to get RCE via Syck (1.8.x YAML parser). https://twitter.com/benmmurphy/status/296025302986014720

rmc on Jan 30, 2013 | [–]

Doesn't matter, upgrade.

They won't always tell you if they have an exploit.

Consider applying for YC's Spring batch! Applications are open till Feb 11.
Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact