Published: 06/12/2006 Updated: 11/10/2017

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

The read_multipart function in cgi.rb in Ruby prior to 1.8.5-p2 does not properly detect boundaries in MIME multipart content, which allows remote malicious users to cause a denial of service (infinite loop) via crafted HTTP requests, a different issue than CVE-2006-5467.

Vulnerable Product	Search on Vulmon	Subscribe to Product
yukihiro matsumoto ruby 1.8.3
yukihiro matsumoto ruby 1.8.4
yukihiro matsumoto ruby 1.8.1
yukihiro matsumoto ruby 1.8.2
yukihiro matsumoto ruby 1.8
yukihiro matsumoto ruby 1.8.5
yukihiro matsumoto ruby 1.8.2_pre1
yukihiro matsumoto ruby 1.8.2_pre2

An error was found in Ruby’s CGI library that did not correctly quote the boundary of multipart MIME requests Using a crafted HTTP request, a remote user could cause a denial of service, where Ruby CGI applications would end up in a loop, monopolizing a CPU ...

CWE-399 http://www.ruby-lang.org/en/news/2006/12/04/another-dos-vulnerability-in-cgi-library/http://bugs.gentoo.org/show_bug.cgi?id=157048 http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=218287 http://jvn.jp/jp/JVN%2384798830/index.html http://www.ruby-lang.org/cgi-bin/cvsweb.cgi/ruby/lib/cgi.rb.diff?f=h&only_with_tag=MAIN&r1=text&tr1=1.92&r2=text&tr2=1.91 http://www.ubuntu.com/usn/usn-394-1 http://www.securityfocus.com/bid/21441 http://secunia.com/advisories/23268 http://secunia.com/advisories/23165 http://securitytracker.com/id?1017363 http://security.gentoo.org/glsa/glsa-200612-21.xml http://secunia.com/advisories/23454 http://www.novell.com/linux/security/advisories/2007_4_sr.html http://docs.info.apple.com/article.html?artnum=305530 http://lists.apple.com/archives/security-announce/2007/May/msg00004.html http://www.mandriva.com/security/advisories?name=MDKSA-2006:225 http://www.redhat.com/support/errata/RHSA-2007-0961.html http://secunia.com/advisories/25402 http://secunia.com/advisories/27576 http://secunia.com/advisories/31090 http://www.vupen.com/english/advisories/2007/1939 http://www.vupen.com/english/advisories/2006/4855 https://exchange.xforce.ibmcloud.com/vulnerabilities/30734 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10529 https://usn.ubuntu.com/394-1/https://nvd.nist.gov

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2006-6303

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect