PT-2008-5567 · Ruby+1 · Webrick+1

Published 2008-12-04 · Updated 2023-02-13 · CVE-2008-4310

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: WEBrick in Ruby versions 1.8.1 and 1.8.5

Description: The issue allows remote attackers to cause a denial of service, specifically CPU consumption, via a crafted HTTP request. This problem exists due to an incomplete fix for a previous issue.

Recommendations: For WEBrick in Ruby version 1.8.1, update to a version that includes a complete fix for the issue. For WEBrick in Ruby version 1.8.5, update to a version that includes a complete fix for the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

CWE-399

Related Identifiers

CVE-2008-4310

GHSA-WFRC-R6C6-7J9R

RHSA-2008:0981

RHSA-2008_0981

Affected Products

Red Hat

Webrick

References · 15

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/webrick/CVE-2008-4310.yml · Exploit
• 🔥 https://exploit-db.com/exploits/32222 · Exploit
• http://secunia.com/advisories/33013 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-4310 · Security Note
• http://redhat.com/support/errata/RHSA-2008-0981.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wfrc-r6c6-7j9r · Vendor Advisory
• https://github.com/ruby/webrick · Note
• https://github.com/ruby/webrick/commit/b2ccd5ff7ddd67a4548299e110dcc5a4728a5534 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4310 · Note
• http://openwall.com/lists/oss-security/2008/12/04/2 · Note
• https://web.archive.org/web/20111230125610/http://secunia.com/advisories/33013 · Note
• https://access.redhat.com/security/cve/CVE-2008-4310 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10250 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=470252 · Note
• https://access.redhat.com/errata/RHSA-2008:0981 · Note