Signature Detail

HTTP: Rails Routing Vulnerability

This signature detects attempts to exploit a known vulnerability against Rails v1.1.5 and earlier. A successful attack can result in a denial-of-service condition.

Extended Description

Ruby on Rails is prone to a vulnerability in its routing functionality that may result in denial-of-service or data loss issues. Attackers may exploit this issue by issuing HTTP GET requests to predictable URIs to affected webservers. This issue affects Ruby on Rails versions 1.1.0, 1.1.1, 1.1.2, 1.1.4, and 1.1.5.

Affected Products

• Gentoo Linux
• Ruby on Rails 1.1.0
• Ruby on Rails 1.1.1
• Ruby on Rails 1.1.2
• Ruby on Rails 1.1.4
• Ruby on Rails 1.1.5
• SuSE SUSE Linux Enterprise SDK 10
• Ubuntu Ubuntu Linux 5.10.0 Amd64
• Ubuntu Ubuntu Linux 5.10.0 I386
• Ubuntu Ubuntu Linux 5.10.0 Powerpc
• Ubuntu Ubuntu Linux 6.06 LTS Amd64
• Ubuntu Ubuntu Linux 6.06 LTS I386
• Ubuntu Ubuntu Linux 6.06 LTS Powerpc
• Ubuntu Ubuntu Linux 6.06 LTS Sparc
• Ubuntu Ubuntu Linux 6.10 Amd64
• Ubuntu Ubuntu Linux 6.10 I386
• Ubuntu Ubuntu Linux 6.10 Powerpc
• Ubuntu Ubuntu Linux 6.10 Sparc

References

• BugTraq: 19454
• CVE: CVE-2006-4112
• URL: http://weblog.rubyonrails.org/2006/8/10/rails-1-1-6-backports-and-full-disclosure
• URL: http://nvd.nist.gov/nvd.cfm?cvename=CVE-2006-4112