JVNDB-2012-000066

Ruby hash table implementation vulnerable to denial-of-service

The hash table implementation in Ruby contains a denial-of-service (DoS) vulnerability.

The hash table implementation in Ruby contains an issue, where it may intentionally create a series of strings whose hash values collide. As a result, a denial-of-service (DoS) attack may be conducted.

Tanaka Akira of National Institute of Advanced Industrial Science and Technology (AIST) reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Ruby

• Ruby versions prior to 1.8.7-p357
• Ruby 1.9.x versions prior to 1.9.1

When processing a series of specially crafted strings, a denial-of-service (DoS) may occur.

[Update the Software]
Update to the latest version according to the information provided by the developer.

Ruby

• Ruby : Denial of service attack was found for Ruby's Hash algorithm (CVE-2011-4815)

Apple Inc.

• Apple Security Updates : HT5281

Oracle Corporation

• SECURITY BLOG : CVE-2011-4815 Denial of Service (DoS) vulnerability in Ruby

1. Resource Management Errors(CWE-399) [IPA Evaluation]

1. CVE-2011-4815

1. JVN : JVN#90615481
2. JVN : JVNVU#692779 (Japanese only)
3. National Vulnerability Database (NVD) : CVE-2011-4815
4. IPA SECURITY ALERTS : 20120106-web (Japanese only)
5. US-CERT Vulnerability Note : VU#903934

• [2012/07/06]
    Web page was published