The Ruby developers discovered a potential Denial of Service vulnerability in the CGI module (cgi.rb). Specially crafted CGI requests could cause an infinite loop in the server process.
Repetitive attacks could use most of the available processor resources, exhaust the number of allowed parallel connections in web servers, or cause similar effects which render the service unavailable.

There is no possibility of privilege escalation or data loss.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The upstream developers of Ruby have corrected a problem in the CGI module for this language. Specially crafted requests could cause an infinite loop and thus cause the program to eat up cpu cycles.

The 'cgi.rb' CGI is installed. Some versions is vulnerable to remote denial of service.

By sending a specially crafted HTTP POST request, a malicious user can force the remote host to consume a large amount of CPU resources.

*** Warning : Nessus solely relied on the presence of this *** CGI, it did not determine if you specific version is *** vulnerable to that problem.

Another vulnerability has been discovered in the CGI library (cgi.rb) that ships with Ruby which could be used by a malicious user to create a denial of service attack (DoS).

Updated packages have been patched to correct this issue.

An updated ruby package that fixes a denial of service issue for the CGI instance is now available.

[Updated 17 Jan 2005] Errata has been updated to include 32-bit libraries on 64-bit architectures.

Ruby is an interpreted scripting language for object-oriented programming.

A flaw was dicovered in the CGI module of Ruby. If empty data is sent by the POST method to the CGI script which requires MIME type multipart/form-data, it can get stuck in a loop. A remote attacker could trigger this flaw and cause a denial of service. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0983 to this issue.

Users are advised to upgrade to this erratum package, which contains a backported patch to cgi.rb.

The Ruby CGI.rb module contains a bug which can cause the CGI module to go into an infinite loop, thereby causing a denial-of-service situation on the web server by using all available CPU time.

An error was found in Ruby's CGI library that did not correctly check for the end of multipart MIME requests. Using a crafted HTTP request, a remote user could cause a denial of service, where Ruby CGI applications would end up in a loop, monopolizing a CPU.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200411-23 (Ruby: Denial of Service issue)

    Ruby's developers found and fixed an issue in the CGI module that     can be triggered remotely and cause an infinite loop.
  Impact :

    A remote attacker could trigger the vulnerability through an     exposed Ruby web application and cause the server to use unnecessary     CPU resources, potentially resulting in a Denial of Service.
  Workaround :

    There is no known workaround at this time.

Andres Salomon noticed a problem with the CGI session management in Ruby. The CGI:Session's FileStore implementations store session information in an insecure manner by just creating files and ignoring permission issues (CVE-2004-0755).

The ruby developers have corrected a problem in the ruby CGI module that can be triggered remotely and cause an inifinite loop on the server (CVE-2004-0983).

The updated packages are patched to prevent these problems.

A denial of service vulnerability has been discovered in the CGI library included with Ruby, the interpreted scripting language for quick and easy object-oriented programming.

The CGI library in Ruby 1.8 allowed a remote attacker to cause a Denial of Service via an HTTP request with a multipart MIME body that contained an invalid boundary specifier, which would result in an infinite loop and CPU consumption.

Updated packages have been patched to correct this issue.

An error was found in Ruby's CGI library that did not correctly quote the boundary of multipart MIME requests. Using a crafted HTTP request, a remote user could cause a denial of service, where Ruby CGI applications would end up in a loop, monopolizing a CPU.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
20615	Ubuntu 4.10 : ruby1.8 vulnerability (USN-20-1)	Nessus	Ubuntu Local Security Checks	1/15/2006	1/19/2021	medium
15684	Debian DSA-586-1 : ruby - infinite loop	Nessus	Debian Local Security Checks	11/10/2004	1/4/2021	medium
15710	Ruby cgi.rb Malformed HTTP Request CPU Utilization DoS	Nessus	CGI abuses	11/13/2004	1/19/2021	medium
24609	Mandrake Linux Security Advisory : ruby (MDKSA-2006:225)	Nessus	Mandriva Local Security Checks	2/18/2007	1/6/2021	medium
15945	RHEL 2.1 / 3 : ruby (RHSA-2004:635)	Nessus	Red Hat Local Security Checks	12/13/2004	1/14/2021	medium
38113	FreeBSD : ruby -- CGI DoS (d656296b-33ff-11d9-a9e7-0001020eed82)	Nessus	FreeBSD Local Security Checks	4/23/2009	1/6/2021	medium
27952	Ubuntu 5.04 / 5.10 / 6.06 LTS / 6.10 : ruby1.8 vulnerability (USN-371-1)	Nessus	Ubuntu Local Security Checks	11/10/2007	1/19/2021	medium
15724	GLSA-200411-23 : Ruby: Denial of Service issue	Nessus	Gentoo Local Security Checks	11/16/2004	1/6/2021	medium
15650	Mandrake Linux Security Advisory : ruby (MDKSA-2004:128)	Nessus	Mandriva Local Security Checks	11/9/2004	1/6/2021	medium
23847	Debian DSA-1234-1 : ruby1.6 - denial of service	Nessus	Debian Local Security Checks	12/14/2006	1/4/2021	medium
24577	Mandrake Linux Security Advisory : ruby (MDKSA-2006:192)	Nessus	Mandriva Local Security Checks	2/18/2007	1/6/2021	medium
27980	Ubuntu 5.10 / 6.06 LTS / 6.10 : ruby1.8 vulnerability (USN-394-1)	Nessus	Ubuntu Local Security Checks	11/10/2007	1/19/2021	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium