Ruby CGI DoS Exploit - Mongrel Hot Fix
There is a denial of service vulnerability for Ruby applications that either use cgi.rb, or run on Mongrel or Litespeed. Rails is affected, details below:
“There has been an exploitable bug in the Ruby CGI library named cgi.rb which allows:Anyone on the Internet to…
Send a single HTTP request to…
Any Ruby program (NOT just Mongrel) using…
cgi.rb multipart parsing with…
A malformed MIME body that…
Causes the Ruby process to go into a 99% CPU infinite loop killing it.”
Zed Shaw has release a temporary hotfix for Mongrel:
THE FIXEveryone using Mongrel can get the fix immediately by installing the latest pre-release version 0.3.14:
sudo gem install mongrel—source=http://mongrel.rubyforge.org/releases
You can find the full details here: http://rubyforge.org/
.
Posted on October 26, 2006
Filed Under Daily Thoughts, Ranting, Ruby on Rails, Security, Tech, Web
Related Posts:
-
Zed Shaw’s PDF Book on Deploying,Serving and Extending Ruby apps with Mongrel
Show my Ruby Gems
Ruby on Rails 1.1 Released!
Apple publishes Ruby on Rails tutorial
Locomotive: OS X 1-click Ruby on Rails development environment update
Understanding Symbols in Ruby
Comments
Leave a Reply
-
Projects
-
Search it all
-
About
I'm Marston and here you'll find my rantings, rhetoric and other useful info. I dig tech, photography, quantum physics and organic food. I'm the founder of SugarStats.com and thats my days developing.
-
Flickr
www.flickr.com
This is a Flickr badge showing public photos from Marston A.. Make your own badge here.
-
Twitter
- Back from Elephant Bar. 30min wait but worth it, great service too. Getting ready for WebPlay 2008 tomorrow in Sunnyvale. 8 hrs ago
- @askmanny Glad you're feeling better. How did the SD Diabetes event go? BTW 16 hrs ago
- Great meeting this morning with Kosmix in Mt. View. Back to work now, for some reason it smells like sulfur outside though. 18 hrs ago
- 4am. Vivid and amazing dreams. Have a morning meeting in Mt. View later. Question now: start working now or go back to bed... We'll see. 1 day ago
- Back from SF, nice scaling Rails presentation by the guys at @newzwag. 1 day ago
- Enjoying the free WiFi at Panera and having an early dinner before heading up to Market st. Gotta hit up the Apple Store. 1 day ago
- Cruising up to SF/SOMA this afternoon, Ruby meetup at Newzwag. Think there is also a Digg meetup at Might too, don't know if I'll make that. 1 day ago
- @PelleB Nice, congrats. Too bad you couldn't launch a week ago and get a free 7 day trail from New Relic. The stats are awesome. 1 day ago
- More updates...