CVE-2006-5467: Medium severity yukihiro matsumoto ruby vulnerability
The cgi.rb CGI library for Ruby 1.8 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via an HTTP request with a multipart MIME body that contains an invalid boundary specifier, as demonstrated using a specifier that begins with a "-" instead of "--" and contains an inconsistent ID.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2006-5467?
CVE-2006-5467 is classified as a moderate severity vulnerability due to its potential to cause a denial of service.
How does CVE-2006-5467 affect Ruby 1.8?
CVE-2006-5467 affects Ruby 1.8 by allowing attackers to exploit the cgi.rb CGI library leading to high CPU consumption and an infinite loop.
What type of attack is facilitated by CVE-2006-5467?
CVE-2006-5467 facilitates denial of service attacks through malformed HTTP requests containing invalid multipart MIME boundaries.
How can I mitigate the risks associated with CVE-2006-5467?
To mitigate CVE-2006-5467, ensure that Ruby is updated to a version that resolves this vulnerability or implement input validation for multipart requests.
Is CVE-2006-5467 still a concern for modern applications?
While CVE-2006-5467 is primarily relevant to Ruby 1.8, any applications still using this outdated version should consider upgrading to avoid potential exploits.