oss-sec mailing list archives
Re: CVE id requests: ruby
From: "Steven M. Christey" <coley () linus mitre org>
Date: Thu, 14 Aug 2008 18:45:52 -0400 (EDT)
Note the following DoS in the regular expression engine, which smells like a NULL pointer dereference. This appears to have been fixed in the latest release. A *likely* (but not provable) changelog entry for the fix is: "regex.c (DOUBLE_STACK, re_compile_fastmap0, re_adjust_startpos), (re_search, re_match_exec): check if failed to allocate memory." - Steve ====================================================== Name: CVE-2008-3443 Status: Candidate URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3443 Reference: MILW0RM:6239 Reference: URL:http://www.milw0rm.com/exploits/6239 The regular expression engine (regex.c) in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 allows remote attackers to cause a denial of service (infinite loop and crash) via multiple long requests to a Ruby socket, related to memory allocation failure, and as demonstrated against Webrick.
Current thread:
- CVE id requests: ruby Steffen Joeris (Aug 11)
- Re: CVE id requests: ruby Steven M. Christey (Aug 12)
- Re: CVE id requests: ruby Steven M. Christey (Aug 14)
- Re: CVE id requests: ruby Steven M. Christey (Aug 12)