新的安全漏洞，mongrel DOS

本文主要是介绍新的安全漏洞，mongrel DOS，希望对大家解决编程问题提供一定的参考价值，需要的开发者们随着小编来一起学习吧！

http://blog.evanweaver.com/articles/2006/10/25/mongrel-denial-of-service-vulnerability

http://rubyforge.org/pipermail/mongrel-users/2006-October/001946.html

DOS拒绝服务的攻击

针对Mongrel的服务器和Litespeed服务器

后者国内可能用的不多
http://litespeedtech.com/

problem

Zed Shaw makes a full report here, explaining that:

...there has been an [size=24]exploitable bug in the Ruby CGI library named cgi.rb[/size], which allows anyone on the internet to send a single HTTP request to any Ruby program (not just Mongrel) using cgi.rb multipart parsing with a malformed MIME body that causes the Ruby process to go into a [size=18]99% CPU[/size] infinite loop, killing it.

解决的方法就是更新Mongrel

gem install mongrel --source=http://mongrel.rubyforge.org/releases

请时刻留意安全问题

[img]http://bd7lx.iteye.com/upload/picture/pic/193/b0e9dfa8-bed8-4ab5-83aa-60ddd537ae2f.jpg[/img]

这篇关于新的安全漏洞，mongrel DOS的文章就介绍到这儿，希望我们推荐的文章对编程师们有所帮助！

---