Lumension® Endpoint Intelligence Center

Intelligence Center » Browse All Vulnerabilities » CVE-2011-4815

Overview

Vulnerability Score 7.8 7.8
CVE Id CVE-2011-4815
Last Modified 29 Jan 2013 11:44:59
Published 29 Dec 2011 08:55:01
Confidentiality Impact NONE NONE
Integrity Impact NONE NONE
Availability Impact COMPLETE COMPLETE
Access Vector NETWORK
Access Complexity LOW
Authentication NONE

CVE-2011-4815

Summary

Ruby (aka CRuby) before 1.8.7-p357 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.

Vulnerable Systems

Application

  • Ruby-lang Ruby 1.8.7-p299

  • Ruby-lang Ruby 1.8.7-p302

  • Ruby-lang Ruby 1.8.7-p330

  • Ruby-lang Ruby 1.8.7-p334

  • Ruby-lang Ruby 1.8.7-p352


References

CERT-VN - VU#903934

MISC - http://www.ocert.org/advisories/ocert-2011-003.html

MISC - http://www.nruns.com/_downloads/advisory28122011.pdf

MLIST - [ruby-talk] 20111228 [ANN] ruby 1.8.7 patchlevel 357 released

CONFIRM - http://support.apple.com/kb/HT5281

APPLE - APPLE-SA-2012-05-09-1

SECUNIA - 47822

REDHAT - RHSA-2012:0069

XF - ruby-hash-dos(72020)

SECTRACK - 1026474

CONFIRM - http://www.ruby-lang.org/en/news/2011/12/28/denial-of-service-attack-was-found-for-rubys-hash-algorithm/

SECUNIA - 47405

REDHAT - RHSA-2012:0070

BUGTRAQ - 20111228 n.runs-SA-2011.004 - web programming languages and platforms - DoS through hash table

JVNDB - JVNDB-2012-000066

JVN - JVN#90615481

Related Patches

Apple 2012-05-09 Mac OS X 10.7.4 Combo Update

Apple 2012-05-09 Mac OS X Server 10.7.4 Combo Update

Apple 2012-05-09 Mac OS X 10.7.4 Update

Apple 2012-05-09 Mac OS X Server 10.7.4 Update

Apple 2012-05-09 Security Update 2012-002 Server (Snow Leopard)

Apple 2012-05-09 Security Update 2012-002 (Snow Leopard)

Red Hat 2012:0070-01 RHSA Moderate: ruby security update for RHEL 5 x86

Red Hat 2012:0070-01 RHSA Moderate: ruby security update for RHEL 4 x86

Red Hat 2012:0070-01 RHSA Moderate: ruby security update for RHEL 4 x86_64

Red Hat 2012:0070-01 RHSA Moderate: ruby security update for RHEL 5 x86_64

Novell SUSE 2012:5716 ruby-187p357 security update for SLE 11 SP1 i586

Novell SUSE 2012:5716 ruby-187p357 security update for SLE 11 SP1 x86_64


Last Updated: 27 May 2016 11:01:44