Although the OP talks about update_attributes, the problem is not limited to that method. The problem is with "mass assignment". So, if you are passing a hash of attributes and values to the new or create method of a model, then you are doing mass assignment, and you are exposed to this issue.

For example, if you are doing this in your controller:

  @user = User.new(params[:user])

then you are doing mass assignment.