DoS Vulnerability in Ruby -- Update your rails code

[amit]

Hy All


A Denial of Service vulnerability has been found and fixed in ruby.
The vulnerability is due to the BigDecimal method mishandling certain
large input values and can cause the interpreter to crash. This could
be used by an attacker to crash any ruby program which creates
BigDecimal objects based on user input, including almost every Rails
application. This vulnerability has been assigned the CVE name
CVE-2009-1904.

Two ways to fix this


Update code
or add this patch
bigdecimal-segfault-fix.rb into config/initializers of your rails
application.



For more Read The article



http://weblog.rubyonrails.org/2009/6/10/dos-vulnerability-in-ruby

[Pavan Agrawal]

Thanks a lot Amit, really interesting information.

Regards,
Pavan Agrawal