OCaml Hash Collision Denial Of Service Vulnerability

Bugtraq ID:	51881
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2012-0839
Remote:	Yes
Local:	No
Published:	Dec 30 2011 12:00AM
Updated:	Dec 30 2011 12:00AM
Credit:	Alexander Klink and Julian Waelde
Vulnerable:	OCaml OCaml 3.12.1
Not Vulnerable:

OCaml Hash Collision Denial Of Service Vulnerability

OCaml is prone to a denial-of-service vulnerability.

An attacker can exploit this issue by sending a small number of specially crafted webform form posts to an affected application.

Successful exploits will attackers to disrupt the availability of sites that use OCaml.

OCaml Hash Collision Denial Of Service Vulnerability

An attacker can use readily available tools to exploit this issue.

OCaml Hash Collision Denial Of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of any more recent information, please mail us at: [email protected].

OCaml Hash Collision Denial Of Service Vulnerability

References:

• #2011-003 multiple implementations denial-of-service via hash algorithm collisio (oCert)
  
• CVE-2012-0839 ocaml: hash table collisions CPU usage DoS (oCERT-2011-003) [NEEDI (Red Hat)
  
• Hashtbl and security ([Caml-list])
  
• OCaml Homepage (OCaml)