CVE-2008-3443

Published: Aug 14, 2008Modified: Apr 23, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

The regular expression engine (regex.c) in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 allows remote attackers to cause a denial of service (infinite loop and crash) via multiple long requests to a Ruby socket, related to memory allocation failure, and as demonstrated against Webrick.

Affected (51)

Products: Ruby Lang: Ruby

1 product

Configuration A

51 vulnerable

Vulnerable Software	Affected Versions
Ruby Lang Ruby	Version 1.6.8
Ruby Lang Ruby	Version 1.8.0
Ruby Lang Ruby	Version 1.8.1
Ruby Lang Ruby	Version 1.8.1 -9
Ruby Lang Ruby	Version 1.8.2
Ruby Lang Ruby	Version 1.8.2 preview2
Ruby Lang Ruby	Version 1.8.2 preview3
Ruby Lang Ruby	Version 1.8.2 preview4
Ruby Lang Ruby	Version 1.8.3
Ruby Lang Ruby	Version 1.8.3 preview1
Ruby Lang Ruby	Version 1.8.3 preview2
Ruby Lang Ruby	Version 1.8.3 preview3
Ruby Lang Ruby	Version 1.8.4
Ruby Lang Ruby	Version 1.8.4 preview1
Ruby Lang Ruby	Version 1.8.4 preview2
Ruby Lang Ruby	Version 1.8.4 preview3
Ruby Lang Ruby	Version 1.8.5
Ruby Lang Ruby	Version 1.8.5 p113
Ruby Lang Ruby	Version 1.8.5 p114
Ruby Lang Ruby	Version 1.8.5 p115
Ruby Lang Ruby	Version 1.8.5 p11
Ruby Lang Ruby	Version 1.8.5 p12
Ruby Lang Ruby	Version 1.8.5 p231
Ruby Lang Ruby	Version 1.8.5 p2
Ruby Lang Ruby	Version 1.8.5 p35
Ruby Lang Ruby	Version 1.8.5 p52
Ruby Lang Ruby	Version 1.8.5 preview1
Ruby Lang Ruby	Version 1.8.5 preview2
Ruby Lang Ruby	Version 1.8.5 preview3
Ruby Lang Ruby	Version 1.8.5 preview4
Ruby Lang Ruby	Version 1.8.5 preview5
Ruby Lang Ruby	Version 1.8.6
Ruby Lang Ruby	Version 1.8.6 p110
Ruby Lang Ruby	Version 1.8.6 p111
Ruby Lang Ruby	Version 1.8.6 p114
Ruby Lang Ruby	Version 1.8.6 p230
Ruby Lang Ruby	Version 1.8.6 p286
Ruby Lang Ruby	Version 1.8.6 p36
Ruby Lang Ruby	Version 1.8.6 preview1
Ruby Lang Ruby	Version 1.8.6 preview2
Ruby Lang Ruby	Version 1.8.6 preview3
Ruby Lang Ruby	Version 1.8.7
Ruby Lang Ruby	Version 1.8.7 p17
Ruby Lang Ruby	Version 1.8.7 p22
Ruby Lang Ruby	Version 1.8.7 p71
Ruby Lang Ruby	Version 1.8.7 preview1
Ruby Lang Ruby	Version 1.8.7 preview2
Ruby Lang Ruby	Version 1.8.7 preview3
Ruby Lang Ruby	Version 1.8.7 preview4
Ruby Lang Ruby	Version 1.9.0
Ruby Lang Ruby	Version 1.9.0 r18423

Related CWEs

References (52)

http://lists.apple.com/archives/security-announce/2009/May/msg00002.html

Source: cve@mitre.org

http://secunia.com/advisories/31430

Source: cve@mitre.org

http://secunia.com/advisories/32165

Source: cve@mitre.org

http://secunia.com/advisories/32219

Source: cve@mitre.org

http://secunia.com/advisories/32371

Source: cve@mitre.org

http://secunia.com/advisories/32372

Source: cve@mitre.org

http://secunia.com/advisories/33185

Source: cve@mitre.org

http://secunia.com/advisories/33398

Source: cve@mitre.org

http://secunia.com/advisories/35074

Source: cve@mitre.org

http://securityreason.com/securityalert/4158

Source: cve@mitre.org

http://support.apple.com/kb/HT3549

Source: cve@mitre.org

http://support.avaya.com/elmodocs2/security/ASA-2008-424.htm

Source: cve@mitre.org

http://www.debian.org/security/2009/dsa-1695

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2008-0895.html

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2008-0897.html

Source: cve@mitre.org

http://www.securityfocus.com/bid/30682

Source: cve@mitre.org

http://www.securitytracker.com/id?1021075

Source: cve@mitre.org

http://www.us-cert.gov/cas/techalerts/TA09-133A.html

Source: cve@mitre.org

US Government Resource

http://www.vupen.com/english/advisories/2009/1297

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/44688

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9570

Source: cve@mitre.org

https://usn.ubuntu.com/651-1/

Source: cve@mitre.org

https://usn.ubuntu.com/691-1/

Source: cve@mitre.org

https://www.exploit-db.com/exploits/6239

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00259.html

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00299.html

Source: cve@mitre.org

http://lists.apple.com/archives/security-announce/2009/May/msg00002.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/31430

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/32165

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/32219

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/32371

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/32372

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/33185

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/33398

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/35074

Source: af854a3a-2127-422b-91ae-364da2661108

http://securityreason.com/securityalert/4158

Source: af854a3a-2127-422b-91ae-364da2661108

http://support.apple.com/kb/HT3549

Source: af854a3a-2127-422b-91ae-364da2661108

http://support.avaya.com/elmodocs2/security/ASA-2008-424.htm

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2009/dsa-1695

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.redhat.com/support/errata/RHSA-2008-0895.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.redhat.com/support/errata/RHSA-2008-0897.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/30682

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id?1021075

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.us-cert.gov/cas/techalerts/TA09-133A.html

Source: af854a3a-2127-422b-91ae-364da2661108

US Government Resource

http://www.vupen.com/english/advisories/2009/1297

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/44688

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9570

Source: af854a3a-2127-422b-91ae-364da2661108

https://usn.ubuntu.com/651-1/

Source: af854a3a-2127-422b-91ae-364da2661108

https://usn.ubuntu.com/691-1/

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.exploit-db.com/exploits/6239

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00259.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00299.html

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.