CVE-2004-0983 Denial of service in n/a
Remote attackers can cause a denial of service via infinite loop in the Ruby CGI module, requiring an upgrade to patched versions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2004-0983?
CVE-2004-0983 is a medium-severity denial of service vulnerability in Gentoo Linux, published on 19 Nov 2004. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The CGI module in Ruby 1.6 before 1.6.8, and 1.8 before 1.8.2, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a certain HTTP request.
Which versions are affected by CVE-2004-0983?
It affects 5 products.
Linux distribution packages (32)
irb Red Hat:enterprise_linux:3::as | All versions | 0:1.6.8-9.EL3.3 |
ruby Red Hat:enterprise_linux:3::as | All versions | 0:1.6.8-9.EL3.3 |
ruby-debuginfo Red Hat:enterprise_linux:3::as | All versions | 0:1.6.8-9.EL3.3 |
ruby-devel Red Hat:enterprise_linux:3::as | All versions | 0:1.6.8-9.EL3.3 |
ruby-docs Red Hat:enterprise_linux:3::as | All versions | 0:1.6.8-9.EL3.3 |
ruby-libs Red Hat:enterprise_linux:3::as | All versions | 0:1.6.8-9.EL3.3 |
ruby-mode Red Hat:enterprise_linux:3::as | All versions | 0:1.6.8-9.EL3.3 |
ruby-tcltk Red Hat:enterprise_linux:3::as | All versions | 0:1.6.8-9.EL3.3 |
irb Red Hat:enterprise_linux:3::desktop | All versions | 0:1.6.8-9.EL3.3 |
ruby Red Hat:enterprise_linux:3::desktop | All versions | 0:1.6.8-9.EL3.3 |
ruby-debuginfo Red Hat:enterprise_linux:3::desktop | All versions | 0:1.6.8-9.EL3.3 |
ruby-devel Red Hat:enterprise_linux:3::desktop | All versions | 0:1.6.8-9.EL3.3 |
ruby-docs Red Hat:enterprise_linux:3::desktop | All versions | 0:1.6.8-9.EL3.3 |
ruby-libs Red Hat:enterprise_linux:3::desktop | All versions | 0:1.6.8-9.EL3.3 |
ruby-mode Red Hat:enterprise_linux:3::desktop | All versions | 0:1.6.8-9.EL3.3 |
ruby-tcltk Red Hat:enterprise_linux:3::desktop | All versions | 0:1.6.8-9.EL3.3 |
irb Red Hat:enterprise_linux:3::es | All versions | 0:1.6.8-9.EL3.3 |
ruby Red Hat:enterprise_linux:3::es | All versions | 0:1.6.8-9.EL3.3 |
ruby-debuginfo Red Hat:enterprise_linux:3::es | All versions | 0:1.6.8-9.EL3.3 |
ruby-devel Red Hat:enterprise_linux:3::es | All versions | 0:1.6.8-9.EL3.3 |
ruby-docs Red Hat:enterprise_linux:3::es | All versions | 0:1.6.8-9.EL3.3 |
ruby-libs Red Hat:enterprise_linux:3::es | All versions | 0:1.6.8-9.EL3.3 |
ruby-mode Red Hat:enterprise_linux:3::es | All versions | 0:1.6.8-9.EL3.3 |
ruby-tcltk Red Hat:enterprise_linux:3::es | All versions | 0:1.6.8-9.EL3.3 |
irb Red Hat:enterprise_linux:3::ws | All versions | 0:1.6.8-9.EL3.3 |
ruby Red Hat:enterprise_linux:3::ws | All versions | 0:1.6.8-9.EL3.3 |
ruby-debuginfo Red Hat:enterprise_linux:3::ws | All versions | 0:1.6.8-9.EL3.3 |
ruby-devel Red Hat:enterprise_linux:3::ws | All versions | 0:1.6.8-9.EL3.3 |
ruby-docs Red Hat:enterprise_linux:3::ws | All versions | 0:1.6.8-9.EL3.3 |
ruby-libs Red Hat:enterprise_linux:3::ws | All versions | 0:1.6.8-9.EL3.3 |
ruby-mode Red Hat:enterprise_linux:3::ws | All versions | 0:1.6.8-9.EL3.3 |
ruby-tcltk Red Hat:enterprise_linux:3::ws | All versions | 0:1.6.8-9.EL3.3 |
Products include Gentoo Linux, Mandrakesoft Mandrake Linux, Mandrakesoft Mandrake Linux Corporate Server, Ubuntu Ubuntu Linux, Yukihiro Matsumoto Ruby.
How do I fix CVE-2004-0983?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2004-0983 being exploited?
There is no known exploitation of CVE-2004-0983 in the wild and no public exploit code.
Other vulnerabilities in Gentoo Linux
Sources
Also known as DSA-586-1, GHSA-f94p-wf3v-wp5p, RHSA-2004:635.