PT-2008-6896 · Ruby+1 · Webrick+5
Christian Neukirchen
·
Publicado
1970-01-01
·
Atualizado
2018-10-11
·
CVE-2008-3656
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Ruby versions 1.8.5 and earlier
Ruby versions 1.8.6 through 1.8.6-p286
Ruby versions 1.8.7 through 1.8.7-p71
Ruby versions 1.9 through r18423
libruby1.9-dbg (affected versions not specified)
libruby1.9 (affected versions not specified)
ri1.9 (affected versions not specified)
Description
The issue is related to multiple vulnerabilities in the Ruby package, which can lead to a denial of service (CPU consumption) via a crafted HTTP request that is processed by a backtracking regular expression in the
WEBrick::HTTPUtils.split header value function. The vulnerabilities can be exploited remotely, potentially disrupting the availability of protected information.Recommendations
For Ruby versions 1.8.5 and earlier, update to a version later than 1.8.5.
For Ruby versions 1.8.6 through 1.8.6-p286, update to a version later than 1.8.6-p286.
For Ruby versions 1.8.7 through 1.8.7-p71, update to a version later than 1.8.7-p71.
For Ruby versions 1.9 through r18423, update to a version later than r18423.
For libruby1.9-dbg, libruby1.9, and ri1.9, at the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
DoS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Red Hat
Ruby
Webrick
Libruby1.9
Libruby1.9-Dbg
Ri1.9