CVE-2008-3656 Denial of service in n/a
Remote attackers can cause denial of service via CPU exhaustion in Ruby's WEBrick library using crafted HTTP requests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2008-3656?
CVE-2008-3656 is a high-severity denial of service vulnerability in Ruby-Lang Ruby, published on 13 Aug 2008. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Algorithmic complexity vulnerability in the WEBrick::HTTPUtils.split_header_value function in WEBrick::HTTP::DefaultFileHandler in WEBrick in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted HTTP request that is processed by a backtracking regular expression.
Weakness: CWE-399
Which versions are affected by CVE-2008-3656?
It affects 1 product.
Products include Ruby-Lang Ruby.
How do I fix CVE-2008-3656?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2008-3656 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2008-3656 exists.
Public exploit code: 1 Metasploit module and 1 Exploit-DB entry.
Other vulnerabilities in Ruby-Lang Ruby
Sources
Also known as GHSA-823x-6r7f-v9x6.