PT-2013-1897 · Rack+1 · Rack+1

Vincent Danen · Published 2013-02-27 · Updated 2023-02-13 · CVE-2012-6109

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Rack versions 1.1.3 and earlier Rack versions 1.2.x through 1.2.5 Rack versions 1.3.x through 1.3.6 Rack versions 1.4.x through 1.4.1

Description The issue is caused by an incorrect regular expression in lib/rack/multipart.rb, which allows remote attackers to cause a denial of service (infinite loop) via a crafted Content-Disposion header.

Recommendations For Rack version 1.1.3 and earlier, update to version 1.1.4 or later. For Rack version 1.2.x through 1.2.5, update to version 1.2.6 or later. For Rack version 1.3.x through 1.3.6, update to version 1.3.7 or later. For Rack version 1.4.x through 1.4.1, update to version 1.4.2 or later.

Exploit

Fix

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2012-6109

GHSA-H77X-M5Q8-C29H

SUSE-SU-2013_0355-1

SUSE-SU-2013_0355-2

Affected Products

Rack

Suse

References · 21

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2012-6109.yml · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-6109 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-6109 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h77x-m5q8-c29h · Vendor Advisory
• https://ubuntu.com/security/CVE-2012-6109 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-6109 · Security Note
• https://cve.org/CVERecord?id=CVE-2012-6109 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2012-6109 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0548.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0544.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2012-6109 · Vendor Advisory
• https://github.com/rack/rack · Note
• https://github.com/rack/rack/commit/c9f65df37a151821eb88ddd1dc404b83e52c52d5 · Note
• https://github.com/rack/rack/blob/master/README.rdoc · Note
• https://groups.google.com/forum/#!msg/rack-devel/1w4_fWEgTdI/XAkSNHjtdTsJ · Note