JVNDB-2006-000753

Ruby cgi.rb Denial of Service Vulnerability

The cig.rb class in Ruby cannot handle HTTP requests with MIME multipart data set with an invalid boundry, which could trigger an infinate loop and result in consuming a large amount of CPU respurces.

Ruby

• Ruby 1.8.5 and earlier
• Ruby Development Release (1.9x) 2006/09/23 and earlier

Cybertrust Japan Co., Ltd.

• Asianux Server 3.0
• Asianux Server 3.0 (x86-64)
• Asianux Server 4.0
• Asianux Server 4.0 (x86-64)

Turbolinux, Inc.

• Turbolinux 10_f
• Turbolinux Appliance Server 2.0
• Turbolinux Desktop 10
• Turbolinux FUJI
• Turbolinux Multimedia
• Turbolinux Personal
• Turbolinux Server 10
• Turbolinux Server 10 (x64)
• Turbolinux Server 8
• Turbolinux Home

Red Hat, Inc.

• Red Hat Enterprise Linux 2.1 (as)
• Red Hat Enterprise Linux 3 (as)
• Red Hat Enterprise Linux 4 (as)
• Red Hat Enterprise Linux 2.1 (es)
• Red Hat Enterprise Linux 3 (es)
• Red Hat Enterprise Linux 4 (es)
• Red Hat Enterprise Linux 2.1 (ws)
• Red Hat Enterprise Linux 3 (ws)
• Red Hat Enterprise Linux 4 (ws)
• Red Hat Enterprise Linux Desktop 3.0
• Red Hat Enterprise Linux Desktop 4.0

An attacker could cause a Denial of Service (DoS) on the Web services using cgi.rb.

Please refer to the 'Vendor Information' section for official remediation and take appropriate action.

Ruby

• Ruby News : DoS Vulnerability in CGI Library

Cybertrust Japan Co., Ltd.

• MIRACLE LINUX Update Information : ruby (V3.0) (Japanese)
• MIRACLE LINUX Update Information : ruby (V4.0) (Japanese)

Turbolinux, Inc.

• Turbolinux Security Advisory : TLSA-2007-1

Red Hat, Inc.

• Red Hat Security Advisory : RHSA-2006:0729

1. CVE-2006-5467

1. National Vulnerability Database (NVD) : CVE-2006-5467
2. Secunia Advisory : SA13123
3. SecurityFocus : 20777
4. FrSIRT Advisories : FrSIRT/ADV-2006-4244

• [2008/05/21]
    Web page published