Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:27669
HistoryFeb 14, 2012 - 12:00 a.m.

AdaCore Security Advisory SA-2012-L119-003 Hash collisions in AWS

2012-02-1400:00:00
vulners.com
10

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

AdaCore Security Advisory

SA-2012-L119-003 Hash collisions in AWS

Problem: Impacted versions of AWS store key/value pairs from submitted
form data in hash tables using a hash function that has
predictable collisions. As a result, a single specially crafted
HTTP request can cause the server to use hours of CPU time,
thus causing a denial of service.

Impact: All AWS releases and wavefronts prior to 2012-01-21

Status: This was fixed in AWS 2.11 and 2.10.2 on 2012-01-21

References: n.runs-SA-2011.004
http://www.nruns.com/_downloads/advisory28122011.pdf

          Effective Denial of Service attacks against
          web application platforms :: AWS round 
          http://ogrod2.blogspot.com/2012/01/28c3-effective-denial-of-service.html

          AWS
          http://www.adacore.com/home/products/gnatpro/add-on_technologies/web_technologies
          http://forge.open-do.org/projects/aws/

History: 2012-01-27 First published

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iEYEARECAAYFAk8iwlEACgkQK8Lr/hUfADYemQCdHUyHQWMRikkF2XO0n1KSINCt
NbYAoMyczgLV2Bt+aok73Cp90A8tBmEe
=XT3i
-----END PGP SIGNATURE-----