Bug 460134 (CVE-2008-3790)

Summary: CVE-2008-3790 ruby: DoS vulnerability in the REXML module
Product: [Other] Security Response Reporter: Jan Lieskovsky <jlieskov>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: isenfeld, kreilly, pete.philips, tagoh
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2008-11-13 15:22:43 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 461579, 461580, 461590, 461591    
Bug Blocks:    
Attachments:
Description Flags
Upstream PoC -- XML file with recursively nested entities
none
The Ruby core REXML module patch. none

Description Jan Lieskovsky 2008-08-26 12:05:14 UTC 
Ruby upstream has reported a security vulnerability present in the
Ruby REXML module. The REXML engine is vulnerable to the "XML entity explosion" attack. This issue could allow an attacker to cause a denial of service by 
attempting to parse a XML file with recursively nested entities via the
Ruby XML files parsing engine (REXML).

References:

http://www.ruby-lang.org/en/news/2008/08/23/dos-vulnerability-in-rexml/
http://groups.google.com/group/comp.lang.ruby/browse_thread/thread/19f69e8a081fc0d1/e138e014b74352ca?#e138e014b74352ca
Comment 2 Jan Lieskovsky 2008-08-26 12:10:38 UTC 
Created attachment 314979 [details]
Upstream PoC -- XML file with recursively nested entities
Comment 5 Jan Lieskovsky 2008-08-29 06:42:47 UTC 
Created attachment 315334 [details]
The Ruby core REXML module patch.
Comment 6 Jan Lieskovsky 2008-08-29 06:43:54 UTC 
References (patches):

1, Monkey patch, to be applied on every application by the user
   
http://www.ruby-lang.org/security/20080823rexml/rexml-expansion-fix.rb
http://weblog.rubyonrails.com/2008/8/23/dos-vulnerabilities-in-rexml

2, Standard patch, to be applied to the Ruby core (REXML module) implementation

http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-core/18414
Comment 10 Fedora Update System 2008-10-08 14:21:11 UTC 
ruby-1.8.6.287-2.fc8 has been submitted as an update for Fedora 8.
http://admin.fedoraproject.org/updates/ruby-1.8.6.287-2.fc8
Comment 11 Fedora Update System 2008-10-08 14:23:09 UTC 
ruby-1.8.6.287-2.fc9 has been submitted as an update for Fedora 9.
http://admin.fedoraproject.org/updates/ruby-1.8.6.287-2.fc9
Comment 12 Fedora Update System 2008-10-09 21:29:30 UTC 
ruby-1.8.6.287-2.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 13 Fedora Update System 2008-10-09 21:35:16 UTC 
ruby-1.8.6.287-2.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 14 Red Hat Product Security 2008-11-13 15:22:43 UTC 
This issue was addressed in:

Red Hat Enterprise Linux:
  http://rhn.redhat.com/errata/RHSA-2008-0897.html

Fedora:
  https://admin.fedoraproject.org/updates/F8/FEDORA-2008-8736
  https://admin.fedoraproject.org/updates/F9/FEDORA-2008-8738