PT-2008-6896 · Ruby+1 · Webrick+5

Christian Neukirchen · Published 1970-01-01 · Updated 2018-10-11 · CVE-2008-3656

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Ruby versions 1.8.5 and earlier Ruby versions 1.8.6 through 1.8.6-p286 Ruby versions 1.8.7 through 1.8.7-p71 Ruby versions 1.9 through r18423 libruby1.9-dbg (affected versions not specified) libruby1.9 (affected versions not specified) ri1.9 (affected versions not specified)

Description The issue is related to multiple vulnerabilities in the Ruby package, which can lead to a denial of service (CPU consumption) via a crafted HTTP request that is processed by a backtracking regular expression in the WEBrick::HTTPUtils.split header value function. The vulnerabilities can be exploited remotely, potentially disrupting the availability of protected information.

Recommendations For Ruby versions 1.8.5 and earlier, update to a version later than 1.8.5. For Ruby versions 1.8.6 through 1.8.6-p286, update to a version later than 1.8.6-p286. For Ruby versions 1.8.7 through 1.8.7-p71, update to a version later than 1.8.7-p71. For Ruby versions 1.9 through r18423, update to a version later than r18423. For libruby1.9-dbg, libruby1.9, and ri1.9, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Weakness Enumeration

CWE-399

Related Identifiers

BDU:2015-01941

BDU:2015-01942

BDU:2015-01943

CVE-2008-3656

DSA-1651-1

DSA-1652-1

RHSA-2008:0897

RHSA-2008_0897

RHSA-2026:7305

RHSA-2026:7307

RHSA-2026:8838

Affected Products

Red Hat

Ruby

Webrick

Libruby1.9

Libruby1.9-Dbg

Ri1.9

References · 42

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/webrick_regex.rb · Exploit
• 🔥 https://exploit-db.com/exploits/32222 · Exploit
• 🔥 http://ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3790 · Security Note
• https://bdu.fstec.ru/vul/2015-01941 · Security Note
• http://debian.org/security/2008/dsa-1651 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200812-17.xml · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-October/msg00299.html · Vendor Advisory
• https://usn.ubuntu.com/651-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-01942 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3655 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2008-3656 · Security Note
• http://debian.org/security/2008/dsa-1652 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0897.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3657 · Security Note