Google CityHash CVE-2012-6051 'MurmurHash3' Algorithm Hash Collision Denial of Service Vulnerability
BID:56736
Info
Google CityHash CVE-2012-6051 'MurmurHash3' Algorithm Hash Collision Denial of Service Vulnerability
| Bugtraq ID: | 56736 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: |
CVE-2012-6051 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 28 2012 12:00AM |
| Updated: | Nov 28 2012 12:00AM |
| Credit: | Jean-Philippe Aumasson and Martin Bo�?let |
| Vulnerable: |
Google CityHash 0 |
| Not Vulnerable: | |
Discussion
Google CityHash CVE-2012-6051 'MurmurHash3' Algorithm Hash Collision Denial of Service Vulnerability
Google CityHash is prone to a denial-of-service vulnerability because it uses hash functions based on the 'MurmurHash3' algorithm, which is vulnerable to predictable hash collisions.
An attacker can exploit this issue by sending a specially crafted sequence of strings to an affected application that uses these strings as keys to create a Hash object (like HTTP requests).
Successful exploits will allow attackers to trigger a high CPU consumption that causes a denial-of-service condition.
Google CityHash is prone to a denial-of-service vulnerability because it uses hash functions based on the 'MurmurHash3' algorithm, which is vulnerable to predictable hash collisions.
An attacker can exploit this issue by sending a specially crafted sequence of strings to an affected application that uses these strings as keys to create a Hash object (like HTTP requests).
Successful exploits will allow attackers to trigger a high CPU consumption that causes a denial-of-service condition.
Exploit / POC
Google CityHash CVE-2012-6051 'MurmurHash3' Algorithm Hash Collision Denial of Service Vulnerability
An attacker can use readily available tools to exploit this issue.
An attacker can use readily available tools to exploit this issue.
Solution / Fix
Google CityHash CVE-2012-6051 'MurmurHash3' Algorithm Hash Collision Denial of Service Vulnerability
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Google CityHash CVE-2012-6051 'MurmurHash3' Algorithm Hash Collision Denial of Service Vulnerability
References:
References:
- Google CityHash Change log (Google)
- Google CityHash Homepage (Google)
- Hash-flooding DoS reloaded (Jean-Philippe Aumasson)