Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 396455 (CVE-2011-5036) - <dev-ruby/rack-1.1.3 Hash collision DoS (CVE-2011-5036)
Summary: <dev-ruby/rack-1.1.3 Hash collision DoS (CVE-2011-5036)
Status: RESOLVED FIXED
Alias: CVE-2011-5036
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: https://secunia.com/advisories/47414/
Whiteboard: B3 [glsa]
Keywords:
Depends on:
Blocks: hashDoS
  Show dependency tree
 
Reported: 2011-12-29 21:05 UTC by Agostino Sarubbo
Modified: 2012-03-06 01:35 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2011-12-29 21:05:20 UTC
From secunia security advisory at $URL:


Description:
The vulnerability is caused due to an error within a hash generation function when hashing form posts and updating a hash table. This can be exploited to cause a hash collision resulting in high CPU consumption via a specially crafted form sent in a HTTP POST request.

The vulnerability is reported in version 1.2.0 and prior.


Solution:
Fixed in the GIT repository.
Comment 1 Hans de Graaff gentoo-dev Security 2011-12-30 06:37:25 UTC
Already masked the slot that did not receive fixes. I have bumps ready for all other slots, but they are pending test failures already reported upstream.
Comment 2 Hans de Graaff gentoo-dev Security 2011-12-30 08:09:13 UTC
I have just added version bumps for all remaining slots. Only one version needs to be stabled (not the latest in that slot to avoid file collisions with later slots).

=dev-ruby/rack-1.1.3
Comment 3 Agostino Sarubbo gentoo-dev 2011-12-30 09:55:09 UTC
Arches, please test and mark stable:                                                                                                                                                
=dev-ruby/rack-1.1.3                                                                                                                                                               
Target keywords : "amd64 ia64 ppc ppc64 sparc x86"
Comment 4 Agostino Sarubbo gentoo-dev 2011-12-30 10:11:33 UTC
amd64 stable
Comment 5 GLSAMaker/CVETool Bot gentoo-dev 2011-12-30 15:19:33 UTC
CVE-2011-5036 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-5036):
  Rack before 1.1.3, 1.2.x before 1.2.5, and 1.3.x before 1.3.6 computes hash
  values for form parameters without restricting the ability to trigger hash
  collisions predictably, which allows remote attackers to cause a denial of
  service (CPU consumption) by sending many crafted parameters.
Comment 6 Mark Loeser (RETIRED) gentoo-dev 2011-12-30 15:54:54 UTC
ppc/ppc64 done
Comment 7 Paweł Hajdan, Jr. (RETIRED) gentoo-dev 2012-01-04 17:49:49 UTC
x86 stable
Comment 8 Raúl Porcel (RETIRED) gentoo-dev 2012-01-08 15:39:46 UTC
ia64/sparc stable
Comment 9 Agostino Sarubbo gentoo-dev 2012-01-08 16:04:55 UTC
@security, please vote.
Comment 10 Tim Sammut (RETIRED) gentoo-dev 2012-01-08 19:04:38 UTC
Thanks, folks. GLSA Vote: yes.
Comment 11 Sean Amoss (RETIRED) gentoo-dev Security 2012-03-04 21:22:16 UTC
Vote: yes. GLSA request filed.
Comment 12 GLSAMaker/CVETool Bot gentoo-dev 2012-03-06 01:35:59 UTC
This issue was resolved and addressed in
 GLSA 201203-05 at http://security.gentoo.org/glsa/glsa-201203-05.xml
by GLSA coordinator Sean Amoss (ackle).