RETIRED: Rack Multiple Denial of Service Vulnerabilities

Bugtraq ID:	57430
Class:	Unknown
CVE:	CVE-2012-6109 CVE-2013-0183 CVE-2013-0184
Remote:	Yes
Local:	No
Published:	Jan 16 2013 12:00AM
Updated:	Apr 13 2015 09:31PM
Credit:	Paul Rogers and Vendor
Vulnerable:	SuSE Cloud 1.0 Redhat Subscription Asset Manager 0 Redhat CloudForms 0 Christian Neukirchen Rack 1.2 Christian Neukirchen Rack 1.1 Christian Neukirchen Rack 1.4.0 Christian Neukirchen Rack 1.3.6 Christian Neukirchen Rack 1.3.5 Christian Neukirchen Rack 1.2.5 Christian Neukirchen Rack 1.2.4 Christian Neukirchen Rack 1.1.3 Christian Neukirchen Rack 1.1.2
Not Vulnerable:	Christian Neukirchen Rack 1.4.4 Christian Neukirchen Rack 1.3.9 Christian Neukirchen Rack 1.2.7 Christian Neukirchen Rack 1.1.5

RETIRED: Rack Multiple Denial of Service Vulnerabilities

Rack is prone to multiple denial-of-service vulnerabilities.

Attackers can exploit these issues to cause denial-of-service conditions.

Versions prior to Rack 1.1.5, 1.2.7, 1.3.9, and 1.4.4 are vulnerable.

This BID is being retired. The following individual records exist to better document the issues:

58767 Rack 'lib/rack/multipart.rb' CVE-2012-6109 Denial of Service Vulnerability

58768 Rack 'multipart/parser.rb' CVE-2013-0183 Denial of Service Vulnerability

58769 Rack 'Rack::Auth::AbstractRequest' CVE-2013-0184 Denial of Service Vulnerability

RETIRED: Rack Multiple Denial of Service Vulnerabilities

Attackers can use readily available tools to exploit these issues.

RETIRED: Rack Multiple Denial of Service Vulnerabilities

Solution:
Updates are available. Please see the references for more information.