bugtraq - [OpenPKG-SA-2006.040] OpenPKG Security Advisory (ruby)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 21 Dec 2006 10:44:45 +0100
From: OpenPKG GmbH <openpkg-noreply@...npkg.com>
To: bugtraq@...urityfocus.com
Subject: [OpenPKG-SA-2006.040] OpenPKG Security Advisory (ruby)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

____________________________________________________________________________

Publisher Name:          OpenPKG GmbH
Publisher Home:          http://openpkg.com/

Advisory Id (public):    OpenPKG-SA-2006.040
Advisory Type:           OpenPKG Security Advisory (SA)
Advisory Directory:      http://openpkg.com/go/OpenPKG-SA
Advisory Document:       http://openpkg.com/go/OpenPKG-SA-2006.040
Advisory Published:      2006-12-21 10:44 UTC

Issue Id (internal):     OpenPKG-SI-20061221
Issue First Created:     2006-12-21
Issue Last Modified:     2006-12-21
Issue Revision:          05
____________________________________________________________________________

Subject Name:            Ruby
Subject Summary:         Programming Language
Subject Home:            http://www.ruby-lang.org/
Subject Versions:        * < 1.8.5-p2

Vulnerability Id:        CVE-2006-6303
Vulnerability Scope:     global (not OpenPKG specific)

Attack Feasibility:      run-time
Attack Vector:           remote network
Attack Impact:           denial of service

Description:
    As confirmed by the vendor [0], a Denial of Service (DoS)
    vulnerability exists in the programming language Ruby [1],
    versions before 1.8.5-p2. The "read_multipart" function in the
    Ruby CGI library ("cgi.rb") does not properly detect boundaries
    in MIME "multipart" content, which allows remote attackers to
    cause an infinite loop via specially crafted HTTP requests. Notice
    that this issue is not the same as CVE-2006-5467 (reported in
    OpenPKG-SA-2006.030).

References:
    [0] http://www.ruby-lang.org/en/news/2006/12/04/another-dos-vulnerability-in-cgi-library/
    [1] http://www.ruby-lang.org/
____________________________________________________________________________

Primary Package Name:    ruby
Primary Package Home:    http://openpkg.org/go/package/ruby

Corrected Distribution:  Corrected Branch: Corrected Package:
OpenPKG Enterprise       E1.0-SOLID        ruby-1.8.5-E1.0.2
OpenPKG Community        CURRENT           ruby-1.8.5p2-20061204
____________________________________________________________________________

For security reasons, this document was digitally signed with the
OpenPGP public key of the OpenPKG GmbH (public key id 61B7AE34)
which you can download from http://openpkg.com/openpkg.com.pgp
or retrieve from the OpenPGP keyserver at hkp://pgp.openpkg.org/.
Follow the instructions at http://openpkg.com/security/signatures/
for more details on how to verify the integrity of this document.
____________________________________________________________________________

-----BEGIN PGP SIGNATURE-----
Comment: OpenPKG GmbH <http://openpkg.com/>

iD8DBQFFileEZwQuyWG3rjQRAk38AJ9qLpm6jGFNsihGolInP3cISEUhQACgwOxc
gPjn4lFUDpWQMR+Bly+zkWI=
=dHjJ
-----END PGP SIGNATURE-----