RubyGems BSON Multiple Denial of Service Vulnerabilities

Bugtraq ID:	75045
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2015-4410 CVE-2015-4412 CVE-2015-4411
Remote:	Yes
Local:	No
Published:	Jun 04 2015 12:00AM
Updated:	Jun 04 2015 12:00AM
Credit:	Egor Homakov
Vulnerable:	MongoDB BSON 3.0.3 MongoDB BSON 3.0.2
Not Vulnerable:	MongoDB BSON 3.0.4

RubyGems BSON Multiple Denial of Service Vulnerabilities

RubyGems BSON is prone to multiple denial-of-service vulnerabilities.

An attacker can exploit these issues to crash the affected system, denying service to legitimate users. Due to the nature of this issue, code-injection may be possible; however this has not been confirmed.

RubyGems BSON Multiple Denial of Service Vulnerabilities

The researcher who discovered this issue has created a proof-of-concept. Please see the references for more information.

RubyGems BSON Multiple Denial of Service Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

RubyGems BSON Multiple Denial of Service Vulnerabilities

References:

• BSON Product Page (RubyGems)
  
• bson-ruby Home Page (MongoDB)
  
• Comparing changes (MongoDB)
  
• Injects in Various Ruby Websites Through Regexp. (Egor Homakov)
  
• Mongo BSON Injection: Ruby Regexps Strike Again (Sakurity)