PT-2012-5956 · Rubinius · Rubinius

Jean-Philippe Aumasson · Published 2012-11-28 · Updated 2013-02-26 · CVE-2012-5372

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Rubinius (affected versions not specified)

Description The issue allows context-dependent attackers to cause a denial of service, specifically CPU consumption, by triggering hash collisions predictably in applications that maintain a hash table. This can be achieved through crafted input, as demonstrated by a universal multicollision attack against the MurmurHash3 algorithm.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2012-5372

Affected Products

Rubinius

References · 6

• 🔥 https://131002.net/data/talks/appsec12_slides.pdf · Exploit
• 🔥 http://asfws12.files.wordpress.com/2012/11/asfws2012-jean_philippe_aumasson-martin_bosslet-hash_flooding_dos_reloaded.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-5372 · Security Note
• http://securityfocus.com/bid/56670 · Note
• http://ocert.org/advisories/ocert-2012-001.html · Note
• http://2012.appsec-forum.ch/conferences/#c17 · Note