JRuby CVE-2012-5370 'MurmurHash2' Algorithm Hash Collision Denial of Service Vulnerability
BID:56669
Info
JRuby CVE-2012-5370 'MurmurHash2' Algorithm Hash Collision Denial of Service Vulnerability
| Bugtraq ID: | 56669 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: |
CVE-2012-5370 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 23 2012 12:00AM |
| Updated: | Dec 21 2012 06:50PM |
| Credit: | Jean-Philippe Aumasson |
| Vulnerable: |
JRuby JRuby 1.6.5.1 JRuby JRuby 1.6.5 JRuby JRuby 1.4.1 JRuby JRuby 1.4.0 |
| Not Vulnerable: | |
Discussion
JRuby CVE-2012-5370 'MurmurHash2' Algorithm Hash Collision Denial of Service Vulnerability
JRuby is prone to a denial-of-service vulnerability because it uses hash functions based on the 'MurmurHash2' algorithm, which is vulnerable to predictable hash collisions.
An attacker can exploit this issue by sending specially crafted sequence of strings to an affected application that uses these strings as keys to create a Hash object (like HTTP requests).
Successful exploits will allow attackers to trigger a high CPU consumption that causes a denial-of-service condition.
JRuby is prone to a denial-of-service vulnerability because it uses hash functions based on the 'MurmurHash2' algorithm, which is vulnerable to predictable hash collisions.
An attacker can exploit this issue by sending specially crafted sequence of strings to an affected application that uses these strings as keys to create a Hash object (like HTTP requests).
Successful exploits will allow attackers to trigger a high CPU consumption that causes a denial-of-service condition.
Exploit / POC
JRuby CVE-2012-5370 'MurmurHash2' Algorithm Hash Collision Denial of Service Vulnerability
An attacker can use readily available tools to exploit this issue.
An attacker can use readily available tools to exploit this issue.
Solution / Fix
JRuby CVE-2012-5370 'MurmurHash2' Algorithm Hash Collision Denial of Service Vulnerability
Solution:
Vendor updates are available. Please see the references for more information.
Solution:
Vendor updates are available. Please see the references for more information.
References
JRuby CVE-2012-5370 'MurmurHash2' Algorithm Hash Collision Denial of Service Vulnerability
References:
References:
- JRuby Homepage (JRuby)