CVE-2006-5467

The cgi.rb CGI library for Ruby 1.8 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via an HTTP request with a multipart MIME body that contains an invalid boundary specifier, as demonstrated using a specifier that begins with a "-" instead of "--" and contains an inconsistent ID.

🔗 References (52)

• secalert@redhatftp://patches.sgi.com/support/free/security/advisories/20061101-01-P
• secalert@redhathttp://docs.info.apple.com/article.html?artnum=305530
• secalert@redhathttp://lists.apple.com/archives/security-announce/2007/May/msg00004.html
• secalert@redhathttp://rubyforge.org/pipermail/mongrel-users/2006-October/001946.html
• secalert@redhathttp://secunia.com/advisories/22615
• secalert@redhathttp://secunia.com/advisories/22624
• secalert@redhathttp://secunia.com/advisories/22761
• secalert@redhathttp://secunia.com/advisories/22929
• secalert@redhathttp://secunia.com/advisories/22932
• secalert@redhathttp://secunia.com/advisories/23040
• secalert@redhathttp://secunia.com/advisories/23344
• secalert@redhathttp://secunia.com/advisories/25402
• secalert@redhathttp://security.gentoo.org/glsa/glsa-200611-12.xml
• secalert@redhathttp://securitytracker.com/id?1017194
• secalert@redhathttp://www.debian.org/security/2006/dsa-1234