CVE-2006-6303
published 2006-12-06CVE-2006-6303: The read_multipart function in cgi.rb in Ruby before 1.8.5-p2 does not properly detect boundaries in MIME multipart content, which allows remote attackers to…
PriorityP420medium5CVSS 2.0
AVNACLAuNCNINAP
EPSS
3.59%
88.0th percentile
The read_multipart function in cgi.rb in Ruby before 1.8.5-p2 does not properly detect boundaries in MIME multipart content, which allows remote attackers to cause a denial of service (infinite loop) via crafted HTTP requests, a different issue than CVE-2006-5467.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| yukihiro_matsumoto | ruby | — | — |
| yukihiro_matsumoto | ruby | — | — |
| yukihiro_matsumoto | ruby | — | — |
| yukihiro_matsumoto | ruby | — | — |
| yukihiro_matsumoto | ruby | — | — |
| yukihiro_matsumoto | ruby | — | — |
| yukihiro_matsumoto | ruby | — | — |
| yukihiro_matsumoto | ruby | — | — |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
vendor_redhat5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Ruby vulnerability
vendor_ubuntu·2006-12-08
CVE-2006-6303 Ruby vulnerability
Title: Ruby vulnerability
Summary: Ruby vulnerability
An error was found in Ruby's CGI library that did not correctly quote
the boundary of multipart MIME requests. Using a crafted HTTP request,
a remote user could cause a denial of service, where Ruby CGI
applications would end up in a loop, monopolizing a CPU.
Instructions: In general, a standard system upgrade is sufficient to effect the
necessary changes.
Red Hat
ruby's cgi.rb vulnerable infinite loop DoS
vendor_redhat·2006-12-04·CVSS 5.0
CVE-2006-6303 [MEDIUM] CWE-835 ruby's cgi.rb vulnerable infinite loop DoS
ruby's cgi.rb vulnerable infinite loop DoS
The read_multipart function in cgi.rb in Ruby before 1.8.5-p2 does not properly detect boundaries in MIME multipart content, which allows remote attackers to cause a denial of service (infinite loop) via crafted HTTP requests, a different issue than CVE-2006-5467.
Statement: Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.
GHSA
GHSA-fx2r-qhmq-3jjp: The read_multipart function in cgi
ghsa_unreviewed·2022-05-01·CVSS 5.0
CVE-2006-6303 [MEDIUM] GHSA-fx2r-qhmq-3jjp: The read_multipart function in cgi
The read_multipart function in cgi.rb in Ruby before 1.8.5-p2 does not properly detect boundaries in MIME multipart content, which allows remote attackers to cause a denial of service (infinite loop) via crafted HTTP requests, a different issue than CVE-2006-5467.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2006-6303 ruby's cgi.rb vulnerable infinite loop DoS
bugzilla·2006-12-04·CVSS 5.0
CVE-2006-6303 [MEDIUM] CVE-2006-6303 ruby's cgi.rb vulnerable infinite loop DoS
CVE-2006-6303 ruby's cgi.rb vulnerable infinite loop DoS
Description of problem:
JVN#84798830 described a problem in cgi.rb, which results in infinite loop after
certain HTTP request. While the original advisory is in Japan, you might want to
translate it with Babelfish. Anyways, it doesn't contain any useful information.
The upstream corrected the problem immediately in CVS and even released a new
package with patchlevel of 2.
Version-Release number of selected component (if applicable):
All supported versions (RHEL 2.1 to 5, and both FC 5 and FC 6) seem to contain
the vulnerable code.
How reproducible:
No reproducer.
Additional info:
The translated JVN avdisory:
http://babelfish.altavista.com/babelfish/trurl_pagecontent?lp=ja_en&trurl=http%3a%2f%2fwww.ipa.go.jp%2fsecurity%2fvuln%
Bugzilla
CVE-2006-6303 ruby's cgi.rb vulnerable infinite loop DoS
bugzilla·2006-12-04·CVSS 5.0
CVE-2006-6303 [MEDIUM] CVE-2006-6303 ruby's cgi.rb vulnerable infinite loop DoS
CVE-2006-6303 ruby's cgi.rb vulnerable infinite loop DoS
+++ This bug was initially created as a clone of Bug #218287 +++
Description of problem:
JVN#84798830 described a problem in cgi.rb, which results in infinite loop after
certain HTTP request. While the original advisory is in Japan, you might want to
translate it with Babelfish. Anyways, it doesn't contain any useful information.
The upstream corrected the problem immediately in CVS and even released a new
package with patchlevel of 2.
Version-Release number of selected component (if applicable):
All supported versions (RHEL 2.1 to 5, and both FC 5 and FC 6) seem to contain
the vulnerable code.
How reproducible:
No reproducer.
Additional info:
The translated JVN avdisory:
http://babelfish.altavista.com/babelfish/trurl_pageco
http://bugs.gentoo.org/show_bug.cgi?id=157048http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=218287http://docs.info.apple.com/article.html?artnum=305530http://jvn.jp/jp/JVN%2384798830/index.htmlhttp://lists.apple.com/archives/security-announce/2007/May/msg00004.htmlhttp://secunia.com/advisories/23165http://secunia.com/advisories/23268http://secunia.com/advisories/23454http://secunia.com/advisories/25402http://secunia.com/advisories/27576http://secunia.com/advisories/31090http://security.gentoo.org/glsa/glsa-200612-21.xmlhttp://securitytracker.com/id?1017363http://www.mandriva.com/security/advisories?name=MDKSA-2006:225http://www.novell.com/linux/security/advisories/2007_4_sr.htmlhttp://www.redhat.com/support/errata/RHSA-2007-0961.htmlhttp://www.ruby-lang.org/cgi-bin/cvsweb.cgi/ruby/lib/cgi.rb.diff?f=h&only_with_tag=MAIN&r1=text&tr1=1.92&r2=text&tr2=1.91http://www.ruby-lang.org/en/news/2006/12/04/another-dos-vulnerability-in-cgi-library/http://www.securityfocus.com/bid/21441http://www.ubuntu.com/usn/usn-394-1http://www.vupen.com/english/advisories/2006/4855http://www.vupen.com/english/advisories/2007/1939https://exchange.xforce.ibmcloud.com/vulnerabilities/30734https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10529http://bugs.gentoo.org/show_bug.cgi?id=157048http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=218287http://docs.info.apple.com/article.html?artnum=305530http://jvn.jp/jp/JVN%2384798830/index.htmlhttp://lists.apple.com/archives/security-announce/2007/May/msg00004.htmlhttp://secunia.com/advisories/23165http://secunia.com/advisories/23268http://secunia.com/advisories/23454http://secunia.com/advisories/25402http://secunia.com/advisories/27576http://secunia.com/advisories/31090http://security.gentoo.org/glsa/glsa-200612-21.xmlhttp://securitytracker.com/id?1017363http://www.mandriva.com/security/advisories?name=MDKSA-2006:225http://www.novell.com/linux/security/advisories/2007_4_sr.htmlhttp://www.redhat.com/support/errata/RHSA-2007-0961.htmlhttp://www.ruby-lang.org/cgi-bin/cvsweb.cgi/ruby/lib/cgi.rb.diff?f=h&only_with_tag=MAIN&r1=text&tr1=1.92&r2=text&tr2=1.91http://www.ruby-lang.org/en/news/2006/12/04/another-dos-vulnerability-in-cgi-library/http://www.securityfocus.com/bid/21441http://www.ubuntu.com/usn/usn-394-1http://www.vupen.com/english/advisories/2006/4855http://www.vupen.com/english/advisories/2007/1939https://exchange.xforce.ibmcloud.com/vulnerabilities/30734https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10529
2006-12-06
Published