PT-2006-6183 · Ruby+1 · Ruby+1

Jamis Buck + 2 · Published 2006-10-27 · Updated 2017-10-11 · CVE-2006-5467

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Ruby 1.8

Description The issue allows remote attackers to cause a denial of service, resulting in an infinite loop and CPU consumption. This is achieved through an HTTP request with a multipart MIME body containing an invalid boundary specifier. For example, using a specifier that begins with a "-" instead of "--" and contains an inconsistent ID.

Recommendations For Ruby 1.8, as a temporary workaround, consider restricting the handling of multipart MIME bodies until a patch is available. Avoid processing HTTP requests with invalid boundary specifiers to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2006-5467

DSA-1234-1

DSA-1235-1

RHSA-2006:0729

RHSA-2006_0729

Affected Products

Red Hat

Ruby

References · 29

• http://debian.org/security/2006/dsa-1235 · Vendor Advisory
• http://openpkg.org/security/advisories/OpenPKG-SA-2006.030-ruby.html · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2007/May/msg00004.html · Vendor Advisory
• http://vupen.com/english/advisories/2007/1939 · Vendor Advisory
• http://vupen.com/english/advisories/2006/4245 · Vendor Advisory
• http://secunia.com/advisories/23344 · Vendor Advisory
• http://secunia.com/advisories/23040 · Vendor Advisory
• http://novell.com/linux/security/advisories/2006_26_sr.html · Vendor Advisory
• http://securityfocus.com/bid/20777 · Patch
• http://vupen.com/english/advisories/2006/4244 · Vendor Advisory
• http://secunia.com/advisories/22932 · Vendor Advisory
• ftp://patches.sgi.com/support/free/security/advisories/20061101-01-P · Vendor Advisory
• http://secunia.com/advisories/22761 · Vendor Advisory
• http://securitytracker.com/id?1017194 · Patch
• http://secunia.com/advisories/22929 · Vendor Advisory