Common Vulnerabilities and Exposures assigned an identifier CVE-2008-3443 to the following vulnerability: The regular expression engine (regex.c) in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 allows remote attackers to cause a denial of service (infinite loop and crash) via multiple long requests to a Ruby socket, related to memory allocation failure, and as demonstrated against Webrick. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3443 http://www.milw0rm.com/exploits/6239 This issue affects all versions of the Ruby package as shipped with the Red Hat Enteprise Linux 2.1, 3, 4, 5 and Fedora 8, 9 and 10.
ruby-1.8.6.287-2.fc8 has been submitted as an update for Fedora 8. http://admin.fedoraproject.org/updates/ruby-1.8.6.287-2.fc8
ruby-1.8.6.287-2.fc9 has been submitted as an update for Fedora 9. http://admin.fedoraproject.org/updates/ruby-1.8.6.287-2.fc9
ruby-1.8.6.287-2.fc9 has been pushed to the Fedora 9 stable repository. If problems still persist, please make note of it in this bug report.
ruby-1.8.6.287-2.fc8 has been pushed to the Fedora 8 stable repository. If problems still persist, please make note of it in this bug report.
This issue was addressed in: Red Hat Enterprise Linux: http://rhn.redhat.com/errata/RHSA-2008-0897.html http://rhn.redhat.com/errata/RHSA-2008-0895.html http://rhn.redhat.com/errata/RHSA-2008-0896.html Fedora: https://admin.fedoraproject.org/updates/F8/FEDORA-2008-8736 https://admin.fedoraproject.org/updates/F9/FEDORA-2008-8738