Published: 13/08/2008 Updated: 11/10/2018

CVSS v2 Base Score: 7.8 | Impact Score: 6.9 | Exploitability Score: 10

VMScore: 785

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C

Algorithmic complexity vulnerability in the WEBrick::HTTPUtils.split_header_value function in WEBrick::HTTP::DefaultFileHandler in WEBrick in Ruby 1.8.5 and previous versions, 1.8.6 up to and including 1.8.6-p286, 1.8.7 up to and including 1.8.7-p71, and 1.9 through r18423 allows context-dependent malicious users to cause a denial of service (CPU consumption) via a crafted HTTP request that is processed by a backtracking regular expression.

Vulnerable Product	Search on Vulmon	Subscribe to Product
ruby-lang ruby 1.8.1
ruby-lang ruby 1.8.2
ruby-lang ruby 1.8.3
ruby-lang ruby 1.8.4
ruby-lang ruby 1.8.5
ruby-lang ruby 1.8.6
ruby-lang ruby 1.8.7
ruby-lang ruby 1.9.0
ruby-lang ruby 1.6.8
ruby-lang ruby 1.8.0
ruby-lang ruby

Synopsis Moderate: ruby security update Type/Severity Security Advisory: Moderate Topic Updated ruby packages that fix a security issue are now available for RedHat Enterprise Linux 4 and 5This update has been rated as having moderate security impact by the RedHat Security Response Team Descripti ...

Synopsis Moderate: ruby security update Type/Severity Security Advisory: Moderate Topic Updated ruby packages that fix several security issues are now availablefor Red Hat Enterprise Linux 4 and 5This update has been rated as having moderate security impact by the RedHat Security Response Team De ...

Akira Tagoh discovered a vulnerability in Ruby which lead to an integer overflow If a user or automated system were tricked into running a malicious script, an attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program (CVE-2008-2376) ...

Several vulnerabilities have been discovered in the interpreter for the Ruby language, which may lead to denial of service and other security problems The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2008-3655 Keita Yamaguchi discovered that several safe level restrictions are insufficiently enforced ...

source: wwwsecurityfocuscom/bid/30644/info Ruby is prone to multiple vulnerabilities that can be leveraged to bypass security restrictions or cause a denial of service: - Multiple security-bypass vulnerabilities occur because of errors in the 'safe level' restriction implementation Attackers can leverage these issues to make insecure fu ...

CVE-2008-3656

Vulnerability Summary

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect