CVE编号
CVE-2006-6303利用情况
暂无补丁情况
没有补丁披露时间
2006-12-07漏洞描述
在1.8.5-P2之前，Ruby中的cgi.rb中的read_multipPart函数不能正确检测MIME多部分内容中的边界，这允许远程攻击者通过精心编制的HTTP请求导致拒绝服务（无限循环），而不是CVE-2006-5467的问题。解决建议
建议您更新当前系统或软件至最新版，完成漏洞的修复。
参考链接 |
|
|---|---|
| http://bugs.gentoo.org/show_bug.cgi?id=157048 | |
| http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=218287 | |
| http://docs.info.apple.com/article.html?artnum=305530 | |
| http://jvn.jp/jp/JVN%2384798830/index.html | |
| http://lists.apple.com/archives/security-announce/2007/May/msg00004.html | |
| http://secunia.com/advisories/23165 | |
| http://secunia.com/advisories/23268 | |
| http://secunia.com/advisories/23454 | |
| http://secunia.com/advisories/25402 | |
| http://secunia.com/advisories/27576 | |
| http://secunia.com/advisories/31090 | |
| http://security.gentoo.org/glsa/glsa-200612-21.xml | |
| http://securitytracker.com/id?1017363 | |
| http://www.mandriva.com/security/advisories?name=MDKSA-2006:225 | |
| http://www.novell.com/linux/security/advisories/2007_4_sr.html | |
| http://www.redhat.com/support/errata/RHSA-2007-0961.html | |
| http://www.ruby-lang.org/cgi-bin/cvsweb.cgi/ruby/lib/cgi.rb.diff?f=h&only_wit... | |
| http://www.ruby-lang.org/en/news/2006/12/04/another-dos-vulnerability-in-cgi-library/ | |
| http://www.securityfocus.com/bid/21441 | |
| http://www.ubuntu.com/usn/usn-394-1 | |
| http://www.vupen.com/english/advisories/2006/4855 | |
| http://www.vupen.com/english/advisories/2007/1939 | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/30734 | |
| https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova... |
受影响软件情况
| # | 类型 | 厂商 | 产品 | 版本 | 影响面 | ||||
| 1 | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| 运行在以下环境 | |||||||||
| 应用 | yukihiro_matsumoto | ruby | 1.8 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | yukihiro_matsumoto | ruby | 1.8.1 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | yukihiro_matsumoto | ruby | 1.8.2 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | yukihiro_matsumoto | ruby | 1.8.2_pre1 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | yukihiro_matsumoto | ruby | 1.8.2_pre2 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | yukihiro_matsumoto | ruby | 1.8.3 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | yukihiro_matsumoto | ruby | 1.8.4 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | yukihiro_matsumoto | ruby | 1.8.5 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | oracle_5 | ruby | * |
Up to (excluding) 1.8.5-5.el5_1.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | oracle_5 | ruby-devel | * |
Up to (excluding) 1.8.5-5.el5_1.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | oracle_5 | ruby-docs | * |
Up to (excluding) 1.8.5-5.el5_1.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | oracle_5 | ruby-irb | * |
Up to (excluding) 1.8.5-5.el5_1.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | oracle_5 | ruby-libs | * |
Up to (excluding) 1.8.5-5.el5_1.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | oracle_5 | ruby-mode | * |
Up to (excluding) 1.8.5-5.el5_1.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | oracle_5 | ruby-rdoc | * |
Up to (excluding) 1.8.5-5.el5_1.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | oracle_5 | ruby-ri | * |
Up to (excluding) 1.8.5-5.el5_1.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | oracle_5 | ruby-tcltk | * |
Up to (excluding) 1.8.5-5.el5_1.1 |
|||||
- 攻击路径 远程
- 攻击复杂度 容易
- 权限要求 无需权限
- 影响范围 全局影响
- EXP成熟度 未验证
- 补丁情况 没有补丁
- 数据保密性 无影响
- 数据完整性 无影响
- 服务器危害 DoS
- 全网数量 N/A
还没有评论，来说两句吧...