Published: 20/04/2006 Updated: 03/10/2018

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 505

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

The HTTP/XMLRPC server in Ruby prior to 1.8.2 uses blocking sockets, which allows malicious users to cause a denial of service (blocked connections) via a large amount of data.

Vulnerable Product	Search on Vulmon	Subscribe to Product
yukihiro matsumoto ruby 1.6.1
yukihiro matsumoto ruby 1.6.2
yukihiro matsumoto ruby 1.6.3
yukihiro matsumoto ruby 1.6.4
yukihiro matsumoto ruby 1.6.5
yukihiro matsumoto ruby 1.6.6
yukihiro matsumoto ruby 1.6.7
yukihiro matsumoto ruby 1.6
yukihiro matsumoto ruby 1.8
yukihiro matsumoto ruby 1.8.1

Yukihiro Matsumoto reported that Ruby’s HTTP module uses blocking sockets By sending large amounts of data to a server application that uses this module, a remote attacker could exploit this to render this application unusable and not respond any more to other clients (Denial of Service) ...

Several vulnerabilities have been discovered in the interpreter for the Ruby language, which may lead to the bypass of security restrictions or denial of service The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2006-1931 It was discovered that the use of blocking sockets can lead to denial of service ...

source: wwwsecurityfocuscom/bid/17645/info Ruby is affected by a denial-of-service vulnerability in the WEBrick HTTP server This issue is due to the use of blocking network operations Ruby's implementation of XML/RPC is also affected, since it uses the vulnerable WEBrick server This issue allows remote attackers to cause affected webs ...

NVD-CWE-Other http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-dev/27787 ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.2-webrick-dos-1.patch https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=189540 ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.2-xmlrpc-dos-1.patch http://www.securityfocus.com/bid/17645 http://securitytracker.com/id?1015978 http://secunia.com/advisories/19772 http://secunia.com/advisories/19804 http://www.osvdb.org/24972 http://secunia.com/advisories/16904 http://www.gentoo.org/security/en/glsa/glsa-200605-11.xml http://www.redhat.com/support/errata/RHSA-2006-0427.html http://secunia.com/advisories/20024 http://secunia.com/advisories/20064 http://www.novell.com/linux/security/advisories/2006-06-02.html http://secunia.com/advisories/20457 http://www.debian.org/security/2006/dsa-1157 http://secunia.com/advisories/21657 http://www.mandriva.com/security/advisories?name=MDKSA-2006:079 https://exchange.xforce.ibmcloud.com/vulnerabilities/26102 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11100 https://usn.ubuntu.com/273-1/https://usn.ubuntu.com/273-1/https://nvd.nist.gov https://www.exploit-db.com/exploits/27723/

CVE-2006-1931

Vulnerability Summary

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect