「cgi.rb」CGIがインストールされています。一部のバージョンは、リモートサービス拒否に対して脆弱です。

悪意のあるユーザーが、特別に細工されたHTTP POSTリクエストを送信して、リモートホストに大量のCPUリソースを消費させる可能性があります。

*** 警告：Nessusは、この***CGIの存在にのみ依存しており、特定のバージョンが***その問題に対して脆弱であるかどうかは判断していません。

The 'cgi.rb' CGI is installed. Some versions is vulnerable to remote denial of service.

By sending a specially crafted HTTP POST request, a malicious user can force the remote host to consume a large amount of CPU resources.

*** Warning : Nessus solely relied on the presence of this *** CGI, it did not determine if you specific version is *** vulnerable to that problem.

Another vulnerability has been discovered in the CGI library (cgi.rb) that ships with Ruby which could be used by a malicious user to create a denial of service attack (DoS).

Updated packages have been patched to correct this issue.

The upstream developers of Ruby have corrected a problem in the CGI module for this language. Specially crafted requests could cause an infinite loop and thus cause the program to eat up cpu cycles.

The Ruby developers discovered a potential Denial of Service vulnerability in the CGI module (cgi.rb). Specially crafted CGI requests could cause an infinite loop in the server process.
Repetitive attacks could use most of the available processor resources, exhaust the number of allowed parallel connections in web servers, or cause similar effects which render the service unavailable.

There is no possibility of privilege escalation or data loss.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An error was found in Ruby's CGI library that did not correctly check for the end of multipart MIME requests. Using a crafted HTTP request, a remote user could cause a denial of service, where Ruby CGI applications would end up in a loop, monopolizing a CPU.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An updated ruby package that fixes a denial of service issue for the CGI instance is now available.

[Updated 17 Jan 2005] Errata has been updated to include 32-bit libraries on 64-bit architectures.

Ruby is an interpreted scripting language for object-oriented programming.

A flaw was dicovered in the CGI module of Ruby. If empty data is sent by the POST method to the CGI script which requires MIME type multipart/form-data, it can get stuck in a loop. A remote attacker could trigger this flaw and cause a denial of service. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0983 to this issue.

Users are advised to upgrade to this erratum package, which contains a backported patch to cgi.rb.

The Ruby CGI.rb module contains a bug which can cause the CGI module to go into an infinite loop, thereby causing a denial-of-service situation on the web server by using all available CPU time.

已安裝「cgi.rb」CGI。有些版本容易遭受拒絕服務攻擊。

惡意使用者可藉由傳送特製的 HTTP POST 要求，強制遠端主機消耗大量 CPU 資源。

*** 警告：Nessus 僅相信存在此 *** CGI，並不能確定您的特定版本是否 *** 容易受到該問題影響。

已安装“cgi.rb”CGI。某些版本序易受到远程拒绝服务的影响。

通过发送特别构建的 HTTP POST 请求，恶意用户可强制远程主机消耗大量 CPU 资源。

*** 警告：Nessus 仅依赖此 *** CGI 的存在性，而未确定具体版本是否 *** 容易受到该问题的影响。

The remote host is affected by the vulnerability described in GLSA-200411-23 (Ruby: Denial of Service issue)

    Ruby's developers found and fixed an issue in the CGI module that     can be triggered remotely and cause an infinite loop.
  Impact :

    A remote attacker could trigger the vulnerability through an     exposed Ruby web application and cause the server to use unnecessary     CPU resources, potentially resulting in a Denial of Service.
  Workaround :

    There is no known workaround at this time.

Andres Salomon noticed a problem with the CGI session management in Ruby. The CGI:Session's FileStore implementations store session information in an insecure manner by just creating files and ignoring permission issues (CVE-2004-0755).

The ruby developers have corrected a problem in the ruby CGI module that can be triggered remotely and cause an inifinite loop on the server (CVE-2004-0983).

The updated packages are patched to prevent these problems.

An error was found in Ruby's CGI library that did not correctly quote the boundary of multipart MIME requests. Using a crafted HTTP request, a remote user could cause a denial of service, where Ruby CGI applications would end up in a loop, monopolizing a CPU.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The CGI library in Ruby 1.8 allowed a remote attacker to cause a Denial of Service via an HTTP request with a multipart MIME body that contained an invalid boundary specifier, which would result in an infinite loop and CPU consumption.

Updated packages have been patched to correct this issue.

A denial of service vulnerability has been discovered in the CGI library included with Ruby, the interpreted scripting language for quick and easy object-oriented programming.

ID	名稱	產品	系列	已發布	已更新	嚴重性
15710	Ruby cgi.rbの無効な形式のHTTPリクエストのCPU使用率のDoS	Nessus	CGI abuses	2004/11/13	2021/1/19	medium
15710	Ruby cgi.rb Malformed HTTP Request CPU Utilization DoS	Nessus	CGI abuses	2004/11/13	2021/1/19	medium
24609	Mandrake Linux Security Advisory : ruby (MDKSA-2006:225)	Nessus	Mandriva Local Security Checks	2007/2/18	2021/1/6	medium
15684	Debian DSA-586-1 : ruby - infinite loop	Nessus	Debian Local Security Checks	2004/11/10	2021/1/4	medium
20615	Ubuntu 4.10 : ruby1.8 vulnerability (USN-20-1)	Nessus	Ubuntu Local Security Checks	2006/1/15	2021/1/19	medium
27952	Ubuntu 5.04 / 5.10 / 6.06 LTS / 6.10 : ruby1.8 vulnerability (USN-371-1)	Nessus	Ubuntu Local Security Checks	2007/11/10	2021/1/19	medium
15945	RHEL 2.1 / 3 : ruby (RHSA-2004:635)	Nessus	Red Hat Local Security Checks	2004/12/13	2021/1/14	medium
38113	FreeBSD : ruby -- CGI DoS (d656296b-33ff-11d9-a9e7-0001020eed82)	Nessus	FreeBSD Local Security Checks	2009/4/23	2021/1/6	medium
15710	Ruby cgi.rb 格式錯誤的 HTTP 要求 CPU 使用率 DoS	Nessus	CGI abuses	2004/11/13	2021/1/19	medium
15710	Ruby cgi.rb 畸形 HTTP 请求 CPU 使用率 DoS	Nessus	CGI abuses	2004/11/13	2021/1/19	medium
15724	GLSA-200411-23 : Ruby: Denial of Service issue	Nessus	Gentoo Local Security Checks	2004/11/16	2021/1/6	medium
15650	Mandrake Linux Security Advisory : ruby (MDKSA-2004:128)	Nessus	Mandriva Local Security Checks	2004/11/9	2021/1/6	medium
27980	Ubuntu 5.10 / 6.06 LTS / 6.10 : ruby1.8 vulnerability (USN-394-1)	Nessus	Ubuntu Local Security Checks	2007/11/10	2021/1/19	medium
24577	Mandrake Linux Security Advisory : ruby (MDKSA-2006:192)	Nessus	Mandriva Local Security Checks	2007/2/18	2021/1/6	medium
23847	Debian DSA-1234-1 : ruby1.6 - denial of service	Nessus	Debian Local Security Checks	2006/12/14	2021/1/4	medium

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium