Vulnerability CVE-2015-3225

Vulnerability Name:

CVE-2015-3225 (CCN-103917)

Assigned:

2015-06-16

Published:

2015-06-16

Updated:

2018-10-30

Summary:

lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails 3.x and 4.x and other products, allows remote attackers to cause a denial of service (SystemStackError) via a request with a large parameter depth.

CVSS v3 Severity:

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Low

CVSS v2 Severity:

5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Partial

5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Partial

4.3 Medium (REDHAT CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P)
3.2 Low (REDHAT Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Partial

Vulnerability Type:

CWE-19
CWE-400

Vulnerability Consequences:

Denial of Service

References:

Source: MITRE
Type: CNA
CVE-2015-3225

Source: FEDORA
Type: UNKNOWN
FEDORA-2015-12978

Source: FEDORA
Type: UNKNOWN
FEDORA-2015-12979

Source: SUSE
Type: Third Party Advisory
openSUSE-SU-2015:1259

Source: SUSE
Type: Third Party Advisory
openSUSE-SU-2015:1262

Source: SUSE
Type: Third Party Advisory
openSUSE-SU-2015:1263

Source: MLIST
Type: Mailing List, Third Party Advisory
[oss-security] 20150616 [CVE-2015-3225] Potential Denial of Service Vulnerability in Rack

Source: CCN
Type: Rack Web site
Rack

Source: REDHAT
Type: UNKNOWN
RHSA-2015:2290

Source: CCN
Type: oss-security Mailing List, Tue, 16 Jun 2015 11:03:35 -0700
[CVE-2015-3225] Potential Denial of Service Vulnerability in Rack

Source: DEBIAN
Type: UNKNOWN
DSA-3322

Source: BID
Type: UNKNOWN
75232

Source: CCN
Type: BID-75232
Rack 'normalize_params()' Function Denial of Service Vulnerability

Source: XF
Type: UNKNOWN
rack-cve20153225-dos(103917)

Source: CONFIRM
Type: Issue Tracking, Patch, Vendor Advisory
https://github.com/rack/rack/blob/master/HISTORY.md

Source: MLIST
Type: Mailing List, Third Party Advisory
[rubyonrails-security] 20150616 [CVE-2015-3225] Potential Denial of Service Vulnerability in Rack

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2015-3225

Vulnerable Configuration:

Configuration 1:

cpe:/a:rack_project:rack:*:*:*:*:*:*:*:* (Version <= 1.5.3)

OR cpe:/a:rack_project:rack:1.6.0:-:*:*:*:*:*:*

OR cpe:/a:rack_project:rack:1.6.1:*:*:*:*:*:*:*

Configuration 2:

cpe:/o:opensuse:opensuse:13.1:*:*:*:*:*:*:*

OR cpe:/o:opensuse:opensuse:13.2:*:*:*:*:*:*:*

Configuration 3:

cpe:/o:debian:debian_linux:7.0:*:*:*:*:*:*:*

OR cpe:/o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Configuration RedHat 1:

cpe:/o:redhat:enterprise_linux:7:*:*:*:*:*:*:*

Configuration RedHat 2:

cpe:/o:redhat:enterprise_linux:7::server:*:*:*:*:*

Configuration CCN 1:

cpe:/a:rack_project:rack:1.1.4:*:*:*:*:*:*:*

OR cpe:/a:rack_project:rack:1.2.6:*:*:*:*:*:*:*

OR cpe:/a:rack_project:rack:1.3.6:*:*:*:*:*:*:*

OR cpe:/a:crawltrack:crawltrack:1.4.1:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:20153225	V	CVE-2015-3225	2022-06-30
oval:org.opensuse.security:def:25	P	chrony-3.2-9.18.1 on GA media (Moderate)	2022-06-13
oval:org.opensuse.security:def:11	P	automake-1.15.1-2.145 on GA media (Moderate)	2022-06-13
oval:org.opensuse.security:def:113400	P	ruby2.7-rubygem-rack-2.0-2.0.9-1.10 on GA media (Moderate)	2022-01-17
oval:org.opensuse.security:def:113401	P	ruby2.7-rubygem-rack-2.2.3-1.7 on GA media (Moderate)	2022-01-17
oval:org.opensuse.security:def:113362	P	ruby2.2-rubygem-rack-1_6-1.6.5-1.1 on GA media (Moderate)	2022-01-17
oval:org.opensuse.security:def:113399	P	ruby2.7-rubygem-rack-1_6-1.6.13-1.13 on GA media (Moderate)	2022-01-17
oval:org.opensuse.security:def:106804	P	Security update for busybox (Important) (in QA)	2022-01-14
oval:org.opensuse.security:def:106805	P	Security update for MozillaFirefox (Important) (in QA)	2022-01-14
oval:org.opensuse.security:def:55264	P	Security update for binutils (Moderate)	2021-11-02
oval:org.opensuse.security:def:106806	P	ruby2.7-rubygem-rack-2.2.3-1.7 on GA media (Moderate)	2021-10-01
oval:org.opensuse.security:def:106769	P	ruby2.2-rubygem-rack-1_6-1.6.5-1.1 on GA media (Moderate)	2021-10-01
oval:org.opensuse.security:def:55947	P	Security update for Mesa (Moderate)	2021-09-16
oval:org.opensuse.security:def:13857	P	kbd-1.15.5-8.7.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:14739	P	ppc64-diag-2.7.4-1.18 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:14066	P	xorg-x11-7.6_1-14.17 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:13810	P	dstat-0.7.2-1.2 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:13893	P	libdcerpc-binding0-32bit-4.4.2-29.4 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:14011	P	ppc64-diag-2.7.1-5.6 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:14055	P	w3m-0.5.3-157.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:13874	P	libXi6-1.7.4-9.2 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:13986	P	mozilla-nspr-32bit-4.12-15.2 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:14717	P	opie-2.4-724.56 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:14079	P	ant-1.9.4-1.31 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:38200	P	Security update for libcares2 (Important)	2021-08-10
oval:org.opensuse.security:def:70788	P	Security update for the Linux Kernel (Important)	2021-07-14
oval:org.opensuse.security:def:38360	P	Security update for xorg-x11-libX11 (Important)	2021-06-15
oval:org.opensuse.security:def:70901	P	file-5.32-5.22 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:13712	P	qemu-2.3.1-5.7 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:13742	P	vino-3.10.1-1.86 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:13720	P	ruby-2.1-1.6 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:38110	P	Security update for cups (Important)	2021-04-30
oval:org.opensuse.security:def:67548	P	Security update for the Linux Kernel (Important)	2021-02-09
oval:org.opensuse.security:def:55781	P	Security update for python (Important)	2020-12-11
oval:org.opensuse.security:def:55124	P	Security update for postgresql12 (Important)	2020-12-04
oval:org.opensuse.security:def:96510	P	ruby2.5-rubygem-rack-2.0.3-1.29 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:103200	P	ruby2.5-rubygem-rack-2.0.3-1.29 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:89545	P	ruby2.5-rubygem-rack-2.0.3-1.29 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:26439	P	Security update for MozillaThunderbird (Important)	2020-12-01
oval:org.opensuse.security:def:27670	P	Security update for rubygem-rack-cache	2020-12-01
oval:org.opensuse.security:def:26438	P	Security update for ansible (Moderate)	2020-12-01
oval:org.opensuse.security:def:27156	P	kdebase3-runtime on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:27142	P	gtk2 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:56340	P	Security update for libvorbis (Moderate)	2020-12-01
oval:org.opensuse.security:def:26514	P	LibVNCServer on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:27851	P	Security update for pam	2020-12-01
oval:org.opensuse.security:def:26449	P	Security update for nginx (Moderate)	2020-12-01
oval:org.opensuse.security:def:27364	P	PolicyKit-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:27213	P	librsvg on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:26780	P	lvm2 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:56506	P	Security update for evince (Important)	2020-12-01
oval:org.opensuse.security:def:26722	P	kbd on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:38468	P	radvd on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:27568	P	struts on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:39217	P	libvpx1-32bit on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:37731	P	apache2-mod_jk on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:27015	P	perl-spamassassin on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:38579	P	dnsmasq on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:26939	P	libadns1 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:26938	P	libQtWebKit4-32bit on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:38053	P	rpm-32bit on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:27656	P	Security update for python-httplib2	2020-12-01
oval:org.opensuse.security:def:27116	P	emacs on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:27886	P	Security update for rubygem-rack (Moderate)	2020-12-01
oval:org.opensuse.security:def:27014	P	perl-libwww-perl on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:56232	P	Security update for ImageMagick (Important)	2020-12-01
oval:org.opensuse.security:def:27852	P	Security update for perl	2020-12-01
oval:org.opensuse.security:def:26450	P	Security update for MozillaThunderbird (Moderate)	2020-12-01
oval:org.opensuse.security:def:27214	P	libsamplerate on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:37719	P	DirectFB on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:27280	P	python-pywbem on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:27169	P	libFLAC++6 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:26723	P	kde4-kgreeter-plugins on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:56432	P	Security update for libxml2 (Low)	2020-12-01
oval:org.opensuse.security:def:39259	P	Security update for rubygem-rack-1_4 (Moderate)	2020-12-01
oval:org.opensuse.security:def:26641	P	syslog-ng on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:64114	P	Security update for mozilla-nspr, mozilla-nss (Important)	2020-12-01
oval:org.opensuse.security:def:27515	P	mercurial on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:56625	P	Security update for libssh (Important)	2020-12-01
oval:org.opensuse.security:def:37720	P	MozillaFirefox on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:26863	P	apache2-mod_jk on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:38535	P	DirectFB on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:55675	P	Security update for glibc (Important)	2020-12-01
oval:org.opensuse.security:def:37952	P	libquicktime0 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:27117	P	enscript on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:27887	P	Security update for rubygem-rack-1_4 (Moderate)	2020-12-01
oval:org.opensuse.security:def:27067	P	LibVNCServer on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:28352	P	Security update for php53 (Moderate)	2020-12-01
oval:org.opensuse.security:def:26950	P	libgdiplus0 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:27714	P	Security update for bind (Important)	2020-12-01
oval:org.opensuse.security:def:55101	P	eog on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:27170	P	libMagickCore1-32bit on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:26437	P	Security update for enigmail (Important)	2020-12-01
oval:org.opensuse.security:def:27223	P	libtspi1 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:27155	P	kde4-kgreeter-plugins on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:64201	P	ruby2.5-rubygem-rack on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:26642	P	sysstat on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:38419	P	mozilla-nspr-32bit on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:67448	P	Security update for freetds (Moderate)	2020-12-01
oval:org.opensuse.security:def:26513	P	Security update for chromium (Important)	2020-12-01
oval:org.opensuse.security:def:55102	P	evince on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:26864	P	apache2-mod_perl on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:56544	P	Security update for rsyslog (Moderate)	2020-12-01
oval:org.opensuse.security:def:26779	P	logwatch on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:38507	P	unrar on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:55502	P	Security update for gdm (Low)	2020-12-01
oval:org.opensuse.security:def:27617	P	Security update for freetype2	2020-12-01
oval:org.opensuse.security:def:28387	P	Security update for rubygem-rack-1_4 (Moderate)	2020-12-01
oval:org.opensuse.security:def:37815	P	gv on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:27068	P	Mesa-32bit on GA media (Moderate)	2020-12-01
oval:org.cisecurity:def:209	P	DSA-3322-1 -- ruby-rack -- security update	2016-02-08
oval:com.redhat.rhsa:def:20152290	P	RHSA-2015:2290: pcs security, bug fix, and enhancement update (Moderate)	2015-11-19
oval:com.ubuntu.xenial:def:201532250000000	V	CVE-2015-3225 on Ubuntu 16.04 LTS (xenial) - low.	2015-07-26
oval:com.ubuntu.precise:def:20153225000	V	CVE-2015-3225 on Ubuntu 12.04 LTS (precise) - low.	2015-07-26
oval:com.ubuntu.artful:def:20153225000	V	CVE-2015-3225 on Ubuntu 17.10 (artful) - low.	2015-07-26
oval:com.ubuntu.disco:def:201532250000000	V	CVE-2015-3225 on Ubuntu 19.04 (disco) - low.	2015-07-26
oval:com.ubuntu.trusty:def:20153225000	V	CVE-2015-3225 on Ubuntu 14.04 LTS (trusty) - low.	2015-07-26
oval:com.ubuntu.cosmic:def:201532250000000	V	CVE-2015-3225 on Ubuntu 18.10 (cosmic) - low.	2015-07-26
oval:com.ubuntu.bionic:def:20153225000	V	CVE-2015-3225 on Ubuntu 18.04 LTS (bionic) - low.	2015-07-26
oval:com.ubuntu.xenial:def:20153225000	V	CVE-2015-3225 on Ubuntu 16.04 LTS (xenial) - low.	2015-07-26
oval:com.ubuntu.bionic:def:201532250000000	V	CVE-2015-3225 on Ubuntu 18.04 LTS (bionic) - low.	2015-07-26
oval:com.ubuntu.cosmic:def:20153225000	V	CVE-2015-3225 on Ubuntu 18.10 (cosmic) - low.	2015-07-26

BACK