Ruby 1.9 - 'WEBrick::HTTP::DefaultFileHandler' Crafted HTTP Request Denial of Service

source: https://www.securityfocus.com/bid/30644/info Ruby is prone to multiple vulnerabilities that can be leveraged to bypass security restrictions or cause a denial of service: - Multiple security-bypass vulnerabilities occur because of errors in the 'safe level' restriction implementation...

Ruby 1.9 - WEBrick::HTTP::DefaultFileHandler Crafted HTTP Request Denial of Service

Ruby 1.9 - WEBrick::HTTP::DefaultFileHandler Crafted HTTP Request Denial of Service source: https://www.securityfocus.com/bid/30644/info Ruby is prone to multiple vulnerabilities that can be leveraged to bypass security restrictions or cause a denial of service: - Multiple security-bypass...

Ruby 1.9 - Safe Level Multiple Function Restriction Bypass

source: https://www.securityfocus.com/bid/30644/info Ruby is prone to multiple vulnerabilities that can be leveraged to bypass security restrictions or cause a denial of service: - Multiple security-bypass vulnerabilities occur because of errors in the 'safe level' restriction implementation...

Ruby 1.9 dl - Module DL.dlopen Arbitrary Library Access

source: https://www.securityfocus.com/bid/30644/info Ruby is prone to multiple vulnerabilities that can be leveraged to bypass security restrictions or cause a denial of service: - Multiple security-bypass vulnerabilities occur because of errors in the 'safe level' restriction implementation...

ruby -- DoS vulnerability in WEBrick

The official ruby site reports: WEBrick::HTTP::DefaultFileHandler is faulty of exponential time taking requests due to a backtracking regular expression in WEBrick::HTTPUtils.splitheadervalue...

Fedora 9 : ruby-1.8.6.230-4.fc9 (2008-6033)

Tue Jul 1 2008 Akira TAGOH - 1.8.6.230-4 - Backported from upstream SVN to fix a segfault issue with Arrayfill. - Mon Jun 30 2008 Akira TAGOH - 1.8.6.230-3 - Backported from upstream SVN to fix a segfault issue. 452825 - Backported from upstream SVN to fix an integer overflow in rbaryfill. - Wed...

Fedora 8 : ruby-1.8.6.230-4.fc8 (2008-6094)

Tue Jul 1 2008 Akira TAGOH - 1.8.6.230-4 - Backported from upstream SVN to fix a segfault issue with Arrayfill. - Mon Jun 30 2008 Akira TAGOH - 1.8.6.230-3 - Backported from upstream SVN to fix a segfault issue. 452825 - Backported from upstream SVN to fix an integer overflow in rbaryfill. - Wed...

Ruby WEBrick远程目录遍历漏洞

CVECAN ID: CVE-2008-1891 Ruby是一种功能强大的面向对象的脚本语言。 WEBrick是Ruby中内嵌的HTTP服务器程序库。WEBrick组件存在目录遍历漏洞，如果服务器使用的是NTFS或FAT文件系统的话，远程攻击者就可以通过在向使用WEBrick::HTTPServlet::FileHandler或WEBrick::HTTPServer.new的应用所提交的URI请求结尾附加“+”、“%2b”、“.”、“%2e”或“%20”字符执行目录遍历攻击，导致读取任意CGI文件。 Yukihiro Matsumoto Ruby 1.9.x Yukihiro...

Fedora 9 : ruby-1.8.6.230-1.fc9 (2008-5664)

Tue Jun 24 2008 Akira TAGOH - 1.8.6.230-1 - New upstream release. - Security fixes. 452294. - CVE-2008-1891: WEBrick CGI source disclosure. - CVE-2008-2662: Integer overflow in rbstrbufappend. - CVE-2008-2663: Integer overflow in rbarystore. - CVE-2008-2664: Unsafe use of alloca in rbstrformat. -...

Ruby XMLRPC Server Denial of Service Vulnerability

Overview The User-level thread supported in Ruby does not switch while writing to a socket. This in turn blocks all subsequent procrsses when specially crafted requests are sent to the Web server and could result in a denial of service. Impact An attacker could cause a Denial of Service DoS...

Directory traversal

Directory traversal vulnerability in WEBrick in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2, when using NTFS or FAT filesystems, allows remote attackers to read arbitrary CGI files via a trailing 1 + plus, 2 %2b encode...

CVE-2008-1891

Directory traversal vulnerability in WEBrick in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2, when using NTFS or FAT filesystems, allows remote attackers to read arbitrary CGI files via a trailing 1 + plus, 2 %2b encode...

CVE-2008-1891

Directory traversal vulnerability in WEBrick in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2, when using NTFS or FAT filesystems, allows remote attackers to read arbitrary CGI files via a trailing 1 + plus, 2 %2b encode...

CVE-2008-1891

Directory traversal vulnerability in WEBrick in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2, when using NTFS or FAT filesystems, allows remote attackers to read arbitrary CGI files via a trailing 1 + plus, 2 %2b encode...

CVE-2008-1891

The CVE-2008-1891 entry covers a directory traversal in WEBrick for Ruby (affecting Ruby 1.8.4 and earlier, 1.8.5 before p231, 1.8.6 before p230, 1.8.7 before p22, and 1.9.0 before 1.9.0‑2) when using NTFS/FAT filesystems. An attacker could read arbitrary CGI files by supplying a trailing charact...

WEBrick Encoded Traversal Arbitrary CGI Source Disclosure

The remote instance of WEBrick, a standard library of Ruby to implement HTTP servers, allows an attacker to view the source of CGI scripts hosted by the affected application by appending to the URL certain characters, such as '+', '%2b', '.', '%2e', or '%20'. Note that successful exploitation may...

Directory traversal vulnerability in WEBrick

Directory traversal vulnerability in WEBrick in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2, when using NTFS or FAT filesystems, allows remote attackers to read arbitrary CGI files via a trailing 1 + plus, 2 %2b encode...

Ruby WEBrick vulnerable to directory traversal

Overview Ruby WEBrick is vulnerable to a directory traversal on systems that support backslash \ path separators. This vulnerability may allow an attacker to access arbitrary files outside of the web server root directory. Description WEBrick is a Ruby library program to build HTTP servers...

DSECRG-08-018.txt

Digital Security Research Group DSecRG Advisory DSECRG-08-018 Application: Ruby 1.8.6 WEBrick Web server Toolkit and applications that used WEBrick, like Metasploit 3.1 Versions Affected: Ruby 1.8.4 and all prior versions 1.8.5-p114 and all prior versions 1.8.6-p113 and all prior versions 1.9.0-1...

Ruby WEBrick远程目录遍历及信息泄露漏洞

BUGTRAQ ID: 28123 Ruby是一种功能强大的面向对象的脚本语言。 WEBrick是Ruby中内嵌的HTTP服务器程序库。如果程序使用WEBrick::HTTPServer.new方式的:DocumentRoot选项或WEBrick::HTTPServlet::FileHandler方式发布文件的话，就可能没有正确地过滤URL输入，允许攻击者在URL请求中使用“"..%5c..%5c”执行目录遍历攻击，显示任意文件内容。成功攻击要求应用程序所运行的操作系统接受反斜线字符作为路径分隔符，如Windows系统。...