Construct Hash conflicts to implement denial-of-service attacks in various languages

This problem has a serious impact. Please upgrade it in a timely manner using a lower version. Here we provide a patch for your reference.
Http://www.bkjia.com/Article/201201/115882.html

Last week, Dmitry suddenly introduced a new configuration item when 5.4 was released:

This attack is called "denial of service (DoS) vulnerabilities in various languages by calling Hash conflicts" (multiple implementations denial-of-service via hash algorithm collision ).

The attack principle is very simple. Currently, many languages use hash to store k-v data, including frequently used POST data from users. Attackers can construct request headers, with a large number of special "k" values in POST (customized based on the Hash algorithm of each language), the Hash table storing POST data at the underlying layer of the language is "conflicted" (collision) it degrades to a linked list.

In this way, if the data volumeLarge enoughIn this way, when the language is computed, searched, and inserted, a large amount of CPU is occupied, thus implementing DoS attacks.

PHP5.4 tries to avoid the impact of such attacks by adding a limit:

1.   - max_input_vars - specifies how many GET/POST/COOKIE input variables may be

2. Accepted. default value 1000

 

Currently, the affected languages and versions are known to be::

Java, All Versions

JRuby <= 1.6.5

PHP <= 5.3.8, <= 5.4.0RC3

Python, All Versions

Rubinius, All Versions

Ruby <= 1.8.7-p356

Apache Geronimo, All Versions

Apache Tomcat <= 5.5.34, <= 6.0.34, <= 7.0.22

Oracle Glassfish <= 3.1.1

Jetty, All Versions

Plone, All Versions

Rack, All Versions

V8 JavaScript Engine, All Versions

Languages that are not affected by this issue or whose fix versions are::

PHP >=5.3.9, >=5.4.0rc4

JRuby> = 1.6.5.1

Ruby> = 1.8.7-p357, 1.9.x

Apache Tomcat >=5.5.35, >=6.0.35, >=7.0.23

Oracle Glassfish, N/A (Oracle reports that the issue is fixed in the main codeline and scheduled for a future CPU)

CVECVE-2011-4885 (PHP), CVE-2011-4461 (Jetty), CVE-2011-4838 (JRuby), CVE-2011-4462 (Plone), CVE-2011-4815 (Ruby)

Original: http://www.ocert.org/advisories/ocert-2011-003.html <script> </script>

Author: Laruence
Address: http://www.laruence.com/2011/12/29/2412.html