ID CVE-2008-4310
Summary httputils.rb in WEBrick in Ruby 1.8.1 and 1.8.5, as used in Red Hat Enterprise Linux 4 and 5, allows remote attackers to cause a denial of service (CPU consumption) via a crafted HTTP request. NOTE: this issue exists because of an incomplete fix for CVE-2008-3656.
References
Vulnerable Configurations
  • cpe:2.3:a:ruby-lang:ruby:1.8.1:*:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:1.8.1:*:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:1.8.5:*:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:1.8.5:*:*:*:*:*:*:*
CVSS
Base: 7.8 (as of 29-09-2017 - 01:32)
Impact:
Exploitability:
CWE CWE-399
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE COMPLETE
cvss-vector via4 AV:N/AC:L/Au:N/C:N/I:N/A:C
oval via4
accepted 2013-04-29T04:04:01.547-04:00
class vulnerability
contributors
  • name Aharon Chernin
    organization SCAP.com, LLC
  • name Dragos Prisaca
    organization G2, Inc.
definition_extensions
  • comment The operating system installed on the system is Red Hat Enterprise Linux 4
    oval oval:org.mitre.oval:def:11831
  • comment CentOS Linux 4.x
    oval oval:org.mitre.oval:def:16636
  • comment Oracle Linux 4.x
    oval oval:org.mitre.oval:def:15990
  • comment The operating system installed on the system is Red Hat Enterprise Linux 5
    oval oval:org.mitre.oval:def:11414
  • comment The operating system installed on the system is CentOS Linux 5.x
    oval oval:org.mitre.oval:def:15802
  • comment Oracle Linux 5.x
    oval oval:org.mitre.oval:def:15459
description httputils.rb in WEBrick in Ruby 1.8.1 and 1.8.5, as used in Red Hat Enterprise Linux 4 and 5, allows remote attackers to cause a denial of service (CPU consumption) via a crafted HTTP request. NOTE: this issue exists because of an incomplete fix for CVE-2008-3656.
family unix
id oval:org.mitre.oval:def:10250
status accepted
submitted 2010-07-09T03:56:16-04:00
title httputils.rb in WEBrick in Ruby 1.8.1 and 1.8.5, as used in Red Hat Enterprise Linux 4 and 5, allows remote attackers to cause a denial of service (CPU consumption) via a crafted HTTP request. NOTE: this issue exists because of an incomplete fix for CVE-2008-3656.
version 30
redhat via4
advisories
bugzilla
id 470252
title CVE-2008-4310 ruby: Incomplete fix for CVE-2008-3656
oval
OR
  • comment Red Hat Enterprise Linux must be installed
    oval oval:com.redhat.rhba:tst:20070304026
  • AND
    • comment Red Hat Enterprise Linux 4 is installed
      oval oval:com.redhat.rhba:tst:20070304025
    • OR
      • AND
        • comment irb is earlier than 0:1.8.1-7.el4_7.2
          oval oval:com.redhat.rhsa:tst:20080981001
        • comment irb is signed with Red Hat master key
          oval oval:com.redhat.rhsa:tst:20060427002
      • AND
        • comment ruby is earlier than 0:1.8.1-7.el4_7.2
          oval oval:com.redhat.rhsa:tst:20080981003
        • comment ruby is signed with Red Hat master key
          oval oval:com.redhat.rhsa:tst:20060427004
      • AND
        • comment ruby-devel is earlier than 0:1.8.1-7.el4_7.2
          oval oval:com.redhat.rhsa:tst:20080981005
        • comment ruby-devel is signed with Red Hat master key
          oval oval:com.redhat.rhsa:tst:20060427006
      • AND
        • comment ruby-docs is earlier than 0:1.8.1-7.el4_7.2
          oval oval:com.redhat.rhsa:tst:20080981007
        • comment ruby-docs is signed with Red Hat master key
          oval oval:com.redhat.rhsa:tst:20060427008
      • AND
        • comment ruby-libs is earlier than 0:1.8.1-7.el4_7.2
          oval oval:com.redhat.rhsa:tst:20080981009
        • comment ruby-libs is signed with Red Hat master key
          oval oval:com.redhat.rhsa:tst:20060427010
      • AND
        • comment ruby-mode is earlier than 0:1.8.1-7.el4_7.2
          oval oval:com.redhat.rhsa:tst:20080981011
        • comment ruby-mode is signed with Red Hat master key
          oval oval:com.redhat.rhsa:tst:20060427012
      • AND
        • comment ruby-tcltk is earlier than 0:1.8.1-7.el4_7.2
          oval oval:com.redhat.rhsa:tst:20080981013
        • comment ruby-tcltk is signed with Red Hat master key
          oval oval:com.redhat.rhsa:tst:20060427014
  • AND
    • comment Red Hat Enterprise Linux 5 is installed
      oval oval:com.redhat.rhba:tst:20070331005
    • OR
      • AND
        • comment ruby is earlier than 0:1.8.5-5.el5_2.6
          oval oval:com.redhat.rhsa:tst:20080981016
        • comment ruby is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070965002
      • AND
        • comment ruby-devel is earlier than 0:1.8.5-5.el5_2.6
          oval oval:com.redhat.rhsa:tst:20080981018
        • comment ruby-devel is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070965004
      • AND
        • comment ruby-docs is earlier than 0:1.8.5-5.el5_2.6
          oval oval:com.redhat.rhsa:tst:20080981020
        • comment ruby-docs is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070965006
      • AND
        • comment ruby-irb is earlier than 0:1.8.5-5.el5_2.6
          oval oval:com.redhat.rhsa:tst:20080981022
        • comment ruby-irb is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070965008
      • AND
        • comment ruby-libs is earlier than 0:1.8.5-5.el5_2.6
          oval oval:com.redhat.rhsa:tst:20080981024
        • comment ruby-libs is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070965010
      • AND
        • comment ruby-mode is earlier than 0:1.8.5-5.el5_2.6
          oval oval:com.redhat.rhsa:tst:20080981026
        • comment ruby-mode is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070965012
      • AND
        • comment ruby-rdoc is earlier than 0:1.8.5-5.el5_2.6
          oval oval:com.redhat.rhsa:tst:20080981028
        • comment ruby-rdoc is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070965014
      • AND
        • comment ruby-ri is earlier than 0:1.8.5-5.el5_2.6
          oval oval:com.redhat.rhsa:tst:20080981030
        • comment ruby-ri is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070965016
      • AND
        • comment ruby-tcltk is earlier than 0:1.8.5-5.el5_2.6
          oval oval:com.redhat.rhsa:tst:20080981032
        • comment ruby-tcltk is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070965018
rhsa
id RHSA-2008:0981
released 2008-12-04
severity Moderate
title RHSA-2008:0981: ruby security update (Moderate)
rpms
  • irb-0:1.8.1-7.el4_7.2
  • ruby-0:1.8.1-7.el4_7.2
  • ruby-0:1.8.5-5.el5_2.6
  • ruby-debuginfo-0:1.8.1-7.el4_7.2
  • ruby-debuginfo-0:1.8.5-5.el5_2.6
  • ruby-devel-0:1.8.1-7.el4_7.2
  • ruby-devel-0:1.8.5-5.el5_2.6
  • ruby-docs-0:1.8.1-7.el4_7.2
  • ruby-docs-0:1.8.5-5.el5_2.6
  • ruby-irb-0:1.8.5-5.el5_2.6
  • ruby-libs-0:1.8.1-7.el4_7.2
  • ruby-libs-0:1.8.5-5.el5_2.6
  • ruby-mode-0:1.8.1-7.el4_7.2
  • ruby-mode-0:1.8.5-5.el5_2.6
  • ruby-rdoc-0:1.8.5-5.el5_2.6
  • ruby-ri-0:1.8.5-5.el5_2.6
  • ruby-tcltk-0:1.8.1-7.el4_7.2
  • ruby-tcltk-0:1.8.5-5.el5_2.6
refmap via4
confirm https://bugzilla.redhat.com/show_bug.cgi?id=470252
mlist [oss-security] 20081204 ruby CVE-2008-4310 (Red Hat specific)
secunia 33013
Last major update 29-09-2017 - 01:32
Published 09-12-2008 - 00:30
Last modified 29-09-2017 - 01:32
Back to Top