5
CVSSv2

CVE-2008-3790

Published: 27/08/2008 Updated: 03/10/2018
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
VMScore: 505
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

Vulnerability Summary

The REXML module in Ruby 1.8.6 up to and including 1.8.6-p287, 1.8.7 up to and including 1.8.7-p72, and 1.9 allows context-dependent malicious users to cause a denial of service (CPU consumption) via an XML document with recursively nested entities, aka an "XML entity explosion."

Vulnerable Product Search on Vulmon Subscribe to Product

ruby-lang ruby 1.8.6

ruby-lang ruby 1.8.7

ruby-lang ruby 1.9

Vendor Advisories

Synopsis Moderate: ruby security update Type/Severity Security Advisory: Moderate Topic Updated ruby packages that fix several security issues are now availablefor Red Hat Enterprise Linux 4 and 5This update has been rated as having moderate security impact by the RedHat Security Response Team De ...
Laurent Gaffie discovered that Ruby did not properly check for memory allocation failures If a user or automated system were tricked into running a malicious script, an attacker could cause a denial of service (CVE-2008-3443) ...
Akira Tagoh discovered a vulnerability in Ruby which lead to an integer overflow If a user or automated system were tricked into running a malicious script, an attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program (CVE-2008-2376) ...
Several vulnerabilities have been discovered in the interpreter for the Ruby language, which may lead to denial of service and other security problems The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2008-3655 Keita Yamaguchi discovered that several safe level restrictions are insufficiently enforced ...
Several vulnerabilities have been discovered in the interpreter for the Ruby language, which may lead to denial of service and other security problems The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2008-3655 Keita Yamaguchi discovered that several safe level restrictions are insufficiently enforced ...

Exploits

source: wwwsecurityfocuscom/bid/30802/info Ruby is prone to a remote denial-of-service vulnerability in its REXML module Successful exploits may allow remote attackers to cause denial-of-service conditions in applications that use the vulnerable module Versions up to and including Ruby 190-3 are vulnerable #!/usr/bin/env ruby req ...

References

CWE-20http://www.openwall.com/lists/oss-security/2008/08/25/4http://www.openwall.com/lists/oss-security/2008/08/26/1http://www.openwall.com/lists/oss-security/2008/08/26/4http://groups.google.com/group/comp.lang.ruby/browse_thread/thread/19f69e8a081fc0d1/e138e014b74352cahttp://www.ruby-lang.org/en/news/2008/08/23/dos-vulnerability-in-rexml/http://www.ruby-lang.org/security/20080823rexml/rexml-expansion-fix.rbhttp://www.securityfocus.com/bid/30802http://weblog.rubyonrails.org/2008/9/3/rails-2-0-4-maintenance-releasehttp://secunia.com/advisories/31602http://www.securitytracker.com/id?1020735http://secunia.com/advisories/32255http://secunia.com/advisories/32256http://www.debian.org/security/2008/dsa-1652http://www.debian.org/security/2008/dsa-1651http://security.gentoo.org/glsa/glsa-200812-17.xmlhttp://secunia.com/advisories/33178http://secunia.com/advisories/33185http://secunia.com/advisories/32219http://secunia.com/advisories/32165https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00299.htmlhttps://www.redhat.com/archives/fedora-package-announce/2008-October/msg00259.htmlhttp://secunia.com/advisories/32371http://www.redhat.com/support/errata/RHSA-2008-0897.htmlhttp://support.avaya.com/elmodocs2/security/ASA-2008-424.htmhttp://www.us-cert.gov/cas/techalerts/TA09-133A.htmlhttp://secunia.com/advisories/35074http://support.apple.com/kb/HT3549http://www.vupen.com/english/advisories/2009/1297http://lists.apple.com/archives/security-announce/2009/May/msg00002.htmlhttp://www.vupen.com/english/advisories/2008/2428http://www.vupen.com/english/advisories/2008/2483https://exchange.xforce.ibmcloud.com/vulnerabilities/44628https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10393https://usn.ubuntu.com/691-1/https://usn.ubuntu.com/651-1/https://access.redhat.com/errata/RHSA-2008:0897https://nvd.nist.govhttps://usn.ubuntu.com/691-1/https://www.exploit-db.com/exploits/32292/