NVD

Id
3524  
Name
CVE-2008-3656  
Description
Algorithmic complexity vulnerability in the WEBrick::HTTPUtils.split_header_value function in WEBrick::HTTP::DefaultFileHandler in WEBrick in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted HTTP request that is processed by a backtracking regular expression.  
Reject
 
CVSS Version
2  
CVSS Score
7.8  
Severity
High  
CVSS Base Score
7.8  
CVSS Impact Subscore
6.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:N/I:N/A:C)  
Pub Date
2017-01-03  
Published
2008-08-12  
Modified Date
2011-03-07  
Seq
2008-3656  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
22224 3524 CVE-2008-3656 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=494401  View
22225 3524 CVE-2008-3656 APPLE-SA-2009-05-12  View
22226 3524 CVE-2008-3656 oval:org.mitre.oval:def:9682  View
22227 3524 CVE-2008-3656 GLSA-200812-17  View
22228 3524 CVE-2008-3656 http://support.apple.com/kb/HT3549  View
22229 3524 CVE-2008-3656 http://support.avaya.com/elmodocs2/security/ASA-2008-424.htm  View
22230 3524 CVE-2008-3656 http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0264  View
22231 3524 CVE-2008-3656 DSA-1651  View
22232 3524 CVE-2008-3656 DSA-1652  View
22233 3524 CVE-2008-3656 RHSA-2008:0897  View
22234 3524 CVE-2008-3656 http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/  View
22235 3524 CVE-2008-3656 20080831 rPSA-2008-0264-1 ruby  View
22236 3524 CVE-2008-3656 30644  View
22237 3524 CVE-2008-3656 1020654  View
22238 3524 CVE-2008-3656 USN-651-1  View
22239 3524 CVE-2008-3656 TA09-133A  View
22240 3524 CVE-2008-3656 ADV-2008-2334  View
22241 3524 CVE-2008-3656 ADV-2009-1297  View
22242 3524 CVE-2008-3656 ruby-webrick-dos(44371)  View
22243 3524 CVE-2008-3656 FEDORA-2008-8738  View
22244 3524 CVE-2008-3656 FEDORA-2008-8736  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
46570 JVNDB-2008-001880 Ruby の WEBrick::HTTP::DefaultFileHandler におけるサービス運用妨害 (DoS) の脆弱性 Ruby の WEBrick に実装されている WEBrick::HTTP::DefaultFileHandler には、バックトラック型正規表現の処理に不備があることによりサービス運用妨害 (DoS) 状態となる脆弱性が存在します。 CVE-2008-3656 33769 CVE-2008-3656 3524 7.8 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-001880.html 2008-08-13 2009-06-29 View