PT-2012-5955 · Ruby+1 · Ruby+1

Vincent Danen · Published 2012-11-28 · Updated 2017-08-29 · CVE-2012-5371

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Ruby versions 1.9 before 1.9.3-p327 Ruby versions 2.0 before r37575

Description The issue allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. This is demonstrated by a universal multicollision attack against a variant of the MurmurHash2 algorithm.

Recommendations For Ruby versions 1.9 before 1.9.3-p327, update to version 1.9.3-p327 or later. For Ruby versions 2.0 before r37575, update to version r37575 or later.

Fix

DoS

Weakness Enumeration

CWE-310

Related Identifiers

ALT-PU-2014-1334

CVE-2012-5371

DLA-263-1

RHSA-2013:0582

RHSA-2026:7305

RHSA-2026:7307

RHSA-2026:8838

Affected Products

Alt Linux

Ruby

References · 13

• http://ubuntu.com/usn/USN-1733-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-5371 · Security Note
• http://ruby-lang.org/en/news/2012/11/09/ruby19-hashdos-cve-2012-5371 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=875236 · Patch
• http://securitytracker.com/id?1027747 · Patch
• http://securityfocus.com/bid/56484 · Note
• http://ocert.org/advisories/ocert-2012-001.html · Note
• https://131002.net/data/talks/appsec12_slides.pdf · Note
• http://2012.appsec-forum.ch/conferences/#c17 · Note
• http://asfws12.files.wordpress.com/2012/11/asfws2012-jean_philippe_aumasson-martin_bosslet-hash_flooding_dos_reloaded.pdf · Note
• http://secunia.com/advisories/51253 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/79993 · Note
• http://osvdb.org/87280 · Note