Secunia

A vulnerability has been reported in Ruby, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to an error in the REXML library when processing recursively nested XML entities. This can be exploited to cause a DoS via a specially crafted XML document.

The vulnerability is reported in versions 1.8.6-p287, 1.8.7-p72, and 1.9.x. Other versions may also be affected.

Solution
The vendor recommends including an additional script in applications using REXML. Please see vendor advisory for more details.

Provided and/or discovered by
Luka Treiber, ACROS Security.

Changelog
Further details available in Customer Area

Original Advisory
Ruby:
http://www.ruby-lang.org/en/news/2008/08/23/dos-vulnerability-in-rexml/

ACROS Security:
http://www.acrossecurity.com/aspr/ASPR-2009-01-05-1-PUB.txt

Deep Links
Links available in Customer Area