FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2011-4815

This CVE name corresponds to:

Entered	Topic
2012-01-16	Multiple implementations -- DoS via hash algorithm collision

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2011-4815 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2011-4815
Phase	Assigned(20111214)

Description

Ruby (aka CRuby) before 1.8.7-p357 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.

References

Source	Reference
BUGTRAQ	20111228 n.runs-SA-2011.004 - web programming languages and platforms - DoS through hash table
MLIST	[ruby-talk] 20111228 [ANN] ruby 1.8.7 patchlevel 357 released
MISC	http://www.nruns.com/_downloads/advisory28122011.pdf
MISC	http://www.ocert.org/advisories/ocert-2011-003.html
CONFIRM	http://support.apple.com/kb/HT5281
CONFIRM	http://www.ruby-lang.org/en/news/2011/12/28/denial-of-service-attack-was-found-for-rubys-hash-algorithm/
APPLE	APPLE-SA-2012-05-09-1
REDHAT	RHSA-2012:0069
REDHAT	RHSA-2012:0070
CERT-VN	VU#903934
JVN	JVN#90615481
JVNDB	JVNDB-2012-000066
SECTRACK	1026474
SECUNIA	47822
SECUNIA	47405
XF	ruby-hash-dos(72020)