Ruby REXML Recursive Entity Expansion Bug Lets Remote Users Deny Service
|
|
SecurityTracker Alert ID: 1020735
|
|
SecurityTracker URL: http://securitytracker.com/id?1020735
|
|
CVE Reference: CVE-2008-3790
(Links to External Site)
|
Updated: Sep 17 2008
|
Original Entry Date: Aug 25 2008
|
Impact: Denial of service via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): 1.8.6-p287 and prior versions, 1.8.7-p72 and prior 1.8.7 versions; 1.9.*
|
Description: A vulnerability was reported in Ruby. A remote user can cause denial of service conditions.
A remote user can send specially crafted XML data to trigger a flaw in the REXML library and cause the target application to become unresponsive.
Luka Treiber and Mitja Kolsek of ACROS Security reported this vulnerability.
|
Impact: A remote user can cause the target application to become unresponsive.
|
Solution: The vendor has issued a patch, available at:
http://www.ruby-lang.org/security/20080823rexml/rexml-expansion-fix.rb
The vendor's advisory is available at:
http://www.ruby-lang.org/en/news/2008/08/23/dos-vulnerability-in-rexml/
|
Vendor URL: www.ruby-lang.org/en/news/2008/08/23/dos-vulnerability-in-rexml/ (Links to External Site)
|
Cause: State error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Mon, 25 Aug 2008 00:23:42 -0400
Subject: Ruby
|
http://www.ruby-lang.org/en/news/2008/08/23/dos-vulnerability-in-rexml/
|
|
