1. CVE-Search
  2. CVE-2006-5467
ID CVE-2006-5467
Summary The cgi.rb CGI library for Ruby 1.8 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via an HTTP request with a multipart MIME body that contains an invalid boundary specifier, as demonstrated using a specifier that begins with a "-" instead of "--" and contains an inconsistent ID.
References
Vulnerable Configurations
  • cpe:2.3:a:yukihiro_matsumoto:ruby:1.8:*:*:*:*:*:*:*
    cpe:2.3:a:yukihiro_matsumoto:ruby:1.8:*:*:*:*:*:*:*
CVSS
Base: 5.0 (as of 11-10-2017 - 01:31)
Impact:
Exploitability:
CWE CWE-399
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:N/I:N/A:P
oval via4
accepted 2013-04-29T04:03:02.470-04:00
class vulnerability
contributors
  • name Aharon Chernin
    organization SCAP.com, LLC
  • name Dragos Prisaca
    organization G2, Inc.
definition_extensions
  • comment The operating system installed on the system is Red Hat Enterprise Linux 3
    oval oval:org.mitre.oval:def:11782
  • comment CentOS Linux 3.x
    oval oval:org.mitre.oval:def:16651
  • comment The operating system installed on the system is Red Hat Enterprise Linux 4
    oval oval:org.mitre.oval:def:11831
  • comment CentOS Linux 4.x
    oval oval:org.mitre.oval:def:16636
  • comment Oracle Linux 4.x
    oval oval:org.mitre.oval:def:15990
description The cgi.rb CGI library for Ruby 1.8 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via an HTTP request with a multipart MIME body that contains an invalid boundary specifier, as demonstrated using a specifier that begins with a "-" instead of "--" and contains an inconsistent ID.
family unix
id oval:org.mitre.oval:def:10185
status accepted
submitted 2010-07-09T03:56:16-04:00
title The cgi.rb CGI library for Ruby 1.8 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via an HTTP request with a multipart MIME body that contains an invalid boundary specifier, as demonstrated using a specifier that begins with a "-" instead of "--" and contains an inconsistent ID.
version 29
redhat via4
advisories
bugzilla
id 212396
title CVE-2006-5467 Ruby CGI multipart parsing DoS
oval
OR
  • comment Red Hat Enterprise Linux must be installed
    oval oval:com.redhat.rhba:tst:20070304026
  • AND
    • comment Red Hat Enterprise Linux 4 is installed
      oval oval:com.redhat.rhba:tst:20070304025
    • OR
      • AND
        • comment irb is earlier than 0:1.8.1-7.EL4.8
          oval oval:com.redhat.rhsa:tst:20060729001
        • comment irb is signed with Red Hat master key
          oval oval:com.redhat.rhsa:tst:20060427002
      • AND
        • comment ruby is earlier than 0:1.8.1-7.EL4.8
          oval oval:com.redhat.rhsa:tst:20060729003
        • comment ruby is signed with Red Hat master key
          oval oval:com.redhat.rhsa:tst:20060427004
      • AND
        • comment ruby-devel is earlier than 0:1.8.1-7.EL4.8
          oval oval:com.redhat.rhsa:tst:20060729005
        • comment ruby-devel is signed with Red Hat master key
          oval oval:com.redhat.rhsa:tst:20060427006
      • AND
        • comment ruby-docs is earlier than 0:1.8.1-7.EL4.8
          oval oval:com.redhat.rhsa:tst:20060729007
        • comment ruby-docs is signed with Red Hat master key
          oval oval:com.redhat.rhsa:tst:20060427008
      • AND
        • comment ruby-libs is earlier than 0:1.8.1-7.EL4.8
          oval oval:com.redhat.rhsa:tst:20060729009
        • comment ruby-libs is signed with Red Hat master key
          oval oval:com.redhat.rhsa:tst:20060427010
      • AND
        • comment ruby-mode is earlier than 0:1.8.1-7.EL4.8
          oval oval:com.redhat.rhsa:tst:20060729011
        • comment ruby-mode is signed with Red Hat master key
          oval oval:com.redhat.rhsa:tst:20060427012
      • AND
        • comment ruby-tcltk is earlier than 0:1.8.1-7.EL4.8
          oval oval:com.redhat.rhsa:tst:20060729013
        • comment ruby-tcltk is signed with Red Hat master key
          oval oval:com.redhat.rhsa:tst:20060427014
rhsa
id RHSA-2006:0729
released 2006-11-08
severity Moderate
title RHSA-2006:0729: ruby security update (Moderate)
rpms
  • irb-0:1.6.4-2.AS21.4
  • irb-0:1.6.8-9.EL3.8
  • irb-0:1.8.1-7.EL4.8
  • ruby-0:1.6.4-2.AS21.4
  • ruby-0:1.6.8-9.EL3.8
  • ruby-0:1.8.1-7.EL4.8
  • ruby-debuginfo-0:1.6.8-9.EL3.8
  • ruby-debuginfo-0:1.8.1-7.EL4.8
  • ruby-devel-0:1.6.4-2.AS21.4
  • ruby-devel-0:1.6.8-9.EL3.8
  • ruby-devel-0:1.8.1-7.EL4.8
  • ruby-docs-0:1.6.4-2.AS21.4
  • ruby-docs-0:1.6.8-9.EL3.8
  • ruby-docs-0:1.8.1-7.EL4.8
  • ruby-libs-0:1.6.4-2.AS21.4
  • ruby-libs-0:1.6.8-9.EL3.8
  • ruby-libs-0:1.8.1-7.EL4.8
  • ruby-mode-0:1.6.8-9.EL3.8
  • ruby-mode-0:1.8.1-7.EL4.8
  • ruby-tcltk-0:1.6.4-2.AS21.4
  • ruby-tcltk-0:1.6.8-9.EL3.8
  • ruby-tcltk-0:1.8.1-7.EL4.8
refmap via4
apple APPLE-SA-2007-05-24
bid 20777
confirm http://docs.info.apple.com/article.html?artnum=305530
debian
  • DSA-1234
  • DSA-1235
gentoo GLSA-200611-12
mandriva MDKSA-2006:192
mlist [mongrel-users] 20061025 [SEC] Mongrel Temporary Fix For cgi.rb 99% CPU DoS Attack
openpkg OpenPKG-SA-2006.030
sectrack 1017194
secunia
  • 22615
  • 22624
  • 22761
  • 22929
  • 22932
  • 23040
  • 23344
  • 25402
sgi 20061101-01-P
suse SUSE-SR:2006:026
ubuntu USN-371-1
vupen
  • ADV-2006-4244
  • ADV-2006-4245
  • ADV-2007-1939
statements via4
contributor Mark J Cox
lastmodified 2007-03-14
organization Red Hat
statement Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.
Last major update 11-10-2017 - 01:31
Published 27-10-2006 - 18:07
Last modified 11-10-2017 - 01:31
Back to Top