The CGI module in Ruby 1.6 before 1.6.8, and 1.8 before 1.8.2, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a certain HTTP request.

The Ruby CGI.rb module contains a bug which can cause the CGI module to go into an infinite loop, thereby causing a denial-of-service situation on the web server by using all available CPU time.

An error was found in Ruby's CGI library that did not correctly quote the boundary of multipart MIME requests. Using a crafted HTTP request, a remote user could cause a denial of service, where Ruby CGI applications would end up in a loop, monopolizing a CPU.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An error was found in Ruby's CGI library that did not correctly check for the end of multipart MIME requests. Using a crafted HTTP request, a remote user could cause a denial of service, where Ruby CGI applications would end up in a loop, monopolizing a CPU.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Another vulnerability has been discovered in the CGI library (cgi.rb) that ships with Ruby which could be used by a malicious user to create a denial of service attack (DoS).

Updated packages have been patched to correct this issue.

The CGI library in Ruby 1.8 allowed a remote attacker to cause a Denial of Service via an HTTP request with a multipart MIME body that contained an invalid boundary specifier, which would result in an infinite loop and CPU consumption.

Updated packages have been patched to correct this issue.

A denial of service vulnerability has been discovered in the CGI library included with Ruby, the interpreted scripting language for quick and easy object-oriented programming.

The Ruby developers discovered a potential Denial of Service vulnerability in the CGI module (cgi.rb). Specially crafted CGI requests could cause an infinite loop in the server process.
Repetitive attacks could use most of the available processor resources, exhaust the number of allowed parallel connections in web servers, or cause similar effects which render the service unavailable.

There is no possibility of privilege escalation or data loss.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An updated ruby package that fixes a denial of service issue for the CGI instance is now available.

[Updated 17 Jan 2005] Errata has been updated to include 32-bit libraries on 64-bit architectures.

Ruby is an interpreted scripting language for object-oriented programming.

A flaw was dicovered in the CGI module of Ruby. If empty data is sent by the POST method to the CGI script which requires MIME type multipart/form-data, it can get stuck in a loop. A remote attacker could trigger this flaw and cause a denial of service. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0983 to this issue.

Users are advised to upgrade to this erratum package, which contains a backported patch to cgi.rb.

The remote host is affected by the vulnerability described in GLSA-200411-23 (Ruby: Denial of Service issue)

    Ruby's developers found and fixed an issue in the CGI module that     can be triggered remotely and cause an infinite loop.
  Impact :

    A remote attacker could trigger the vulnerability through an     exposed Ruby web application and cause the server to use unnecessary     CPU resources, potentially resulting in a Denial of Service.
  Workaround :

    There is no known workaround at this time.

The 'cgi.rb' CGI is installed. Some versions is vulnerable to remote denial of service.

By sending a specially crafted HTTP POST request, a malicious user can force the remote host to consume a large amount of CPU resources.

*** Warning : Nessus solely relied on the presence of this *** CGI, it did not determine if you specific version is *** vulnerable to that problem.

The upstream developers of Ruby have corrected a problem in the CGI module for this language. Specially crafted requests could cause an infinite loop and thus cause the program to eat up cpu cycles.

Andres Salomon noticed a problem with the CGI session management in Ruby. The CGI:Session's FileStore implementations store session information in an insecure manner by just creating files and ignoring permission issues (CVE-2004-0755).

The ruby developers have corrected a problem in the ruby CGI module that can be triggered remotely and cause an inifinite loop on the server (CVE-2004-0983).

The updated packages are patched to prevent these problems.

ID	Name	Product	Family	Severity
38113	FreeBSD : ruby -- CGI DoS (d656296b-33ff-11d9-a9e7-0001020eed82)	Nessus	FreeBSD Local Security Checks	medium
27980	Ubuntu 5.10 / 6.06 LTS / 6.10 : ruby1.8 vulnerability (USN-394-1)	Nessus	Ubuntu Local Security Checks	medium
27952	Ubuntu 5.04 / 5.10 / 6.06 LTS / 6.10 : ruby1.8 vulnerability (USN-371-1)	Nessus	Ubuntu Local Security Checks	medium
24609	Mandrake Linux Security Advisory : ruby (MDKSA-2006:225)	Nessus	Mandriva Local Security Checks	medium
24577	Mandrake Linux Security Advisory : ruby (MDKSA-2006:192)	Nessus	Mandriva Local Security Checks	medium
23847	Debian DSA-1234-1 : ruby1.6 - denial of service	Nessus	Debian Local Security Checks	medium
20615	Ubuntu 4.10 : ruby1.8 vulnerability (USN-20-1)	Nessus	Ubuntu Local Security Checks	medium
15945	RHEL 2.1 / 3 : ruby (RHSA-2004:635)	Nessus	Red Hat Local Security Checks	medium
15724	GLSA-200411-23 : Ruby: Denial of Service issue	Nessus	Gentoo Local Security Checks	medium
15710	Ruby cgi.rb Malformed HTTP Request CPU Utilization DoS	Nessus	CGI abuses	medium
15684	Debian DSA-586-1 : ruby - infinite loop	Nessus	Debian Local Security Checks	medium
15650	Mandrake Linux Security Advisory : ruby (MDKSA-2004:128)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2004-0983

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium