Bug 189540 - CVE-2006-1931 Ruby http/xmlrpc server DoS
Summary: CVE-2006-1931 Ruby http/xmlrpc server DoS
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: ruby
Version: 5
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Akira TAGOH
QA Contact: Bill Huang
URL:
Whiteboard: impact=moderate,reported=20060412,sou...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2006-04-20 20:13 UTC by Josh Bressers
Modified: 2007-11-30 22:11 UTC (History)
0 users

Fixed In Version: 1.8.4-3.2
Clone Of:
Environment:
Last Closed: 2006-04-21 04:51:29 UTC
Type: ---
Embargoed:

Attachments (Terms of Use)

Description Josh Bressers 2006-04-20 20:13:46 UTC 
Ruby http/xmlrpc server DoS

A bug was found in the way ruby creates its http (and thus xmlrpc)
server.  The server uses blocking sockets, so if it is possible to
send a very large amount of data via the socket, the server will block
other connections resulting in a denial of service.

The original report (and patch) are here:
http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-dev/27787

A reproducer is described here:
http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-dev/26405


This issue also affects FC4
Comment 1 Akira TAGOH 2006-04-21 04:51:29 UTC 
As I said in the mail, those issues has been fixed in 1.8.3.
So it won't affects ruby packages on FC since we've already pushed 1.8.4 for them.
Note You need to log in before you can comment on or make changes to this bug.