Home page logo

bugtraq logo Bugtraq mailing list archives

[OpenPKG-SA-2006.040] OpenPKG Security Advisory (ruby)
From: OpenPKG GmbH <openpkg-noreply () openpkg com>
Date: Thu, 21 Dec 2006 10:44:45 +0100

Hash: SHA1


Publisher Name:          OpenPKG GmbH
Publisher Home:          http://openpkg.com/

Advisory Id (public):    OpenPKG-SA-2006.040
Advisory Type:           OpenPKG Security Advisory (SA)
Advisory Directory:      http://openpkg.com/go/OpenPKG-SA
Advisory Document:       http://openpkg.com/go/OpenPKG-SA-2006.040
Advisory Published:      2006-12-21 10:44 UTC

Issue Id (internal):     OpenPKG-SI-20061221
Issue First Created:     2006-12-21
Issue Last Modified:     2006-12-21
Issue Revision:          05

Subject Name:            Ruby
Subject Summary:         Programming Language
Subject Home:            http://www.ruby-lang.org/
Subject Versions:        * < 1.8.5-p2

Vulnerability Id:        CVE-2006-6303
Vulnerability Scope:     global (not OpenPKG specific)

Attack Feasibility:      run-time
Attack Vector:           remote network
Attack Impact:           denial of service

    As confirmed by the vendor [0], a Denial of Service (DoS)
    vulnerability exists in the programming language Ruby [1],
    versions before 1.8.5-p2. The "read_multipart" function in the
    Ruby CGI library ("cgi.rb") does not properly detect boundaries
    in MIME "multipart" content, which allows remote attackers to
    cause an infinite loop via specially crafted HTTP requests. Notice
    that this issue is not the same as CVE-2006-5467 (reported in

    [0] http://www.ruby-lang.org/en/news/2006/12/04/another-dos-vulnerability-in-cgi-library/
    [1] http://www.ruby-lang.org/

Primary Package Name:    ruby
Primary Package Home:    http://openpkg.org/go/package/ruby

Corrected Distribution:  Corrected Branch: Corrected Package:
OpenPKG Enterprise       E1.0-SOLID        ruby-1.8.5-E1.0.2
OpenPKG Community        CURRENT           ruby-1.8.5p2-20061204

For security reasons, this document was digitally signed with the
OpenPGP public key of the OpenPKG GmbH (public key id 61B7AE34)
which you can download from http://openpkg.com/openpkg.com.pgp
or retrieve from the OpenPGP keyserver at hkp://pgp.openpkg.org/.
Follow the instructions at http://openpkg.com/security/signatures/
for more details on how to verify the integrity of this document.

Comment: OpenPKG GmbH <http://openpkg.com/>


  By Date           By Thread  

Current thread:
  • [OpenPKG-SA-2006.040] OpenPKG Security Advisory (ruby) OpenPKG GmbH (Dec 21)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]