Ruby: Denial of Service vulnerability

1.  Gentoo Linux Security Advisory

Version Information

Related bugreports: #153497

Synopsis

The Ruby cgi.rb CGI library is vulnerable to a Denial of Service attack.

2.  Impact Information

Background

Ruby is a dynamic, open source programming language with a focus on simplicity and productivity.

Description

Zed Shaw, Jeremy Kemper, and Jamis Buck of the Mongrel project reported that the CGI library shipped with Ruby is vulnerable to a remote Denial of Service by an unauthenticated user.

Impact

The vulnerability can be exploited by sending the cgi.rb library an HTTP request with multipart MIME encoding that contains a malformed MIME boundary specifier beginning with "-" instead of "--". Successful exploitation of the vulnerability causes the library to go into an infinite loop waiting for additional non-existent input.

3.  Resolution Information

Workaround

There is no known workaround at this time.

Resolution

All Ruby users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/ruby-1.8.5-r3"

4.  References

• CVE-2006-5467