PT-2012-5955 · Ruby+1 · Ruby+1

Vincent Danen · Publicado 2012-11-28 · Atualizado 2017-08-29 · CVE-2012-5371

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Ruby versions 1.9 before 1.9.3-p327 Ruby versions 2.0 before r37575

Description The issue allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. This is demonstrated by a universal multicollision attack against a variant of the MurmurHash2 algorithm.

Recommendations For Ruby versions 1.9 before 1.9.3-p327, update to version 1.9.3-p327 or later. For Ruby versions 2.0 before r37575, update to version r37575 or later.

Correção

DoS

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

ALT-PU-2014-1334

CVE-2012-5371

DLA-263-1

RHSA-2013:0582

RHSA-2026:7305

RHSA-2026:7307

RHSA-2026:8838

Produtos afetados

Alt Linux

Ruby

Referências · 13

• http://securityfocus.com/bid/56484 · Nota
• http://ocert.org/advisories/ocert-2012-001.html · Nota
• https://131002.net/data/talks/appsec12_slides.pdf · Nota
• http://ubuntu.com/usn/USN-1733-1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2012-5371 · Nota de Segurança
• http://2012.appsec-forum.ch/conferences/#c17 · Nota
• http://asfws12.files.wordpress.com/2012/11/asfws2012-jean_philippe_aumasson-martin_bosslet-hash_flooding_dos_reloaded.pdf · Nota
• http://ruby-lang.org/en/news/2012/11/09/ruby19-hashdos-cve-2012-5371 · Aviso do Fabricante
• http://secunia.com/advisories/51253 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=875236 · Correção
• https://exchange.xforce.ibmcloud.com/vulnerabilities/79993 · Nota
• http://osvdb.org/87280 · Nota
• http://securitytracker.com/id?1027747 · Correção