Rubinius CVE-2012-5372 'MurmurHash3' Algorithm Hash Collision Denial of Service Vulnerability
BID:56670
Info
Rubinius CVE-2012-5372 'MurmurHash3' Algorithm Hash Collision Denial of Service Vulnerability
| Bugtraq ID: | 56670 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: |
CVE-2012-5372 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 23 2012 12:00AM |
| Updated: | Nov 23 2012 12:00AM |
| Credit: | Jean-Philippe Aumasson |
| Vulnerable: |
Rubinius Rubinius 1.2.4 |
| Not Vulnerable: | |
Discussion
Rubinius CVE-2012-5372 'MurmurHash3' Algorithm Hash Collision Denial of Service Vulnerability
Rubinius is prone to a denial-of-service vulnerability because it uses hash functions based on the 'MurmurHash3' algorithm, which is vulnerable to predictable hash collisions.
An attacker can exploit this issue by sending specially crafted sequence of strings to an affected application that uses these strings as keys to create a Hash object (like HTTP requests).
Successful exploits will allow attackers to trigger a high CPU consumption that causes a denial-of-service condition.
Rubinius is prone to a denial-of-service vulnerability because it uses hash functions based on the 'MurmurHash3' algorithm, which is vulnerable to predictable hash collisions.
An attacker can exploit this issue by sending specially crafted sequence of strings to an affected application that uses these strings as keys to create a Hash object (like HTTP requests).
Successful exploits will allow attackers to trigger a high CPU consumption that causes a denial-of-service condition.
Exploit / POC
Rubinius CVE-2012-5372 'MurmurHash3' Algorithm Hash Collision Denial of Service Vulnerability
An attacker can use readily available tools to exploit this issue.
An attacker can use readily available tools to exploit this issue.
Solution / Fix
Rubinius CVE-2012-5372 'MurmurHash3' Algorithm Hash Collision Denial of Service Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Rubinius CVE-2012-5372 'MurmurHash3' Algorithm Hash Collision Denial of Service Vulnerability
References:
References:
- Hash-flooding DoS reloaded (Jean-Philippe Aumasson)
- Rubinius Homepage (Rubinius)
- #2012-001 multiple implementations denial-of-service via MurmurHash algorithm co (oCERT)