Bug 396455 (CVE-2011-5036) – <dev-ruby/rack-1.1.3 Hash collision DoS (CVE-2011-5036)

• Product: Gentoo Security
• Status: RESOLVED FIXED

[Description Agostino Sarubbo 2011-12-29 21:05:20 UTC]

From secunia security advisory at $URL:


Description:
The vulnerability is caused due to an error within a hash generation function when hashing form posts and updating a hash table. This can be exploited to cause a hash collision resulting in high CPU consumption via a specially crafted form sent in a HTTP POST request.

The vulnerability is reported in version 1.2.0 and prior.


Solution:
Fixed in the GIT repository.

[Comment 1 Hans de Graaff 2011-12-30 06:37:25 UTC]

Already masked the slot that did not receive fixes. I have bumps ready for all other slots, but they are pending test failures already reported upstream.

[Comment 2 Hans de Graaff 2011-12-30 08:09:13 UTC]

I have just added version bumps for all remaining slots. Only one version needs to be stabled (not the latest in that slot to avoid file collisions with later slots).

=dev-ruby/rack-1.1.3

[Comment 3 Agostino Sarubbo 2011-12-30 09:55:09 UTC]

Arches, please test and mark stable:                                                                                                                                                
=dev-ruby/rack-1.1.3                                                                                                                                                               
Target keywords : "amd64 ia64 ppc ppc64 sparc x86"

[Comment 4 Agostino Sarubbo 2011-12-30 10:11:33 UTC]

amd64 stable

[Comment 5 GLSAMaker/CVETool Bot 2011-12-30 15:19:33 UTC]

CVE-2011-5036 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-5036):
  Rack before 1.1.3, 1.2.x before 1.2.5, and 1.3.x before 1.3.6 computes hash
  values for form parameters without restricting the ability to trigger hash
  collisions predictably, which allows remote attackers to cause a denial of
  service (CPU consumption) by sending many crafted parameters.

[Comment 6 Mark Loeser (RETIRED) 2011-12-30 15:54:54 UTC]

ppc/ppc64 done

[Comment 7 Paweł Hajdan, Jr. (RETIRED) 2012-01-04 17:49:49 UTC]

x86 stable

[Comment 8 Raúl Porcel (RETIRED) 2012-01-08 15:39:46 UTC]

ia64/sparc stable

[Comment 9 Agostino Sarubbo 2012-01-08 16:04:55 UTC]

@security, please vote.

[Comment 10 Tim Sammut (RETIRED) 2012-01-08 19:04:38 UTC]

Thanks, folks. GLSA Vote: yes.

[Comment 11 Sean Amoss (RETIRED) 2012-03-04 21:22:16 UTC]

Vote: yes. GLSA request filed.

[Comment 12 GLSAMaker/CVETool Bot 2012-03-06 01:35:59 UTC]

This issue was resolved and addressed in
 GLSA 201203-05 at http://security.gentoo.org/glsa/glsa-201203-05.xml
by GLSA coordinator Sean Amoss (ackle).