[SEC] Latest LiteSpeed ruby-lsapi does not vulnerable to the

Rails
1

Hi,

First, my thanks to Zed for including LiteSpeed in cgi.rb vulnerability
report. Appreciated!

I just got time to review ruby-lsapi code and test the vulnerability
against LiteSpeed.
I found that, in our latest ruby-lsapi release 1.11, lsapi_read()
function returns Qnil when the end of request body has been reached. So,
in theory, LiteSpeed should not be vulnerable to this attack.
Our test results confirmed what I expected, 500 Internal Server Error
was returned immediately upon receiving the bad multipart request.

However, it is unsure whether earlier release of ruby-lsapi is
vulnerable or not, please make sure to upgrade to the latest ruby-lsapi
release.

Please pay attention not to mix manual installation with gem
installation, manual installation has higher priority, if you have
installed earlier version of ruby-lsapi manually and switch to gem
installation later, please make sure to remove lsapi.so installed
manually, usually at somewhere under …/lib/ruby/site_ruby/1.8/.

Best Regards,
George W.

2

On 11/10/06, George W. [email protected] wrote:

First, my thanks to Zed for including LiteSpeed in cgi.rb vulnerability
report. Appreciated!

I just got time to review ruby-lsapi code and test the vulnerability

against LiteSpeed.
I found that, in our latest ruby-lsapi release 1.11, lsapi_read()
function returns Qnil when the end of request body has been reached. So,
in theory, LiteSpeed should not be vulnerable to this attack.
Our test results confirmed what I expected, 500 Internal Server Error
was returned immediately upon receiving the bad multipart request.

However, it is unsure whether earlier release of ruby-lsapi is
vulnerable or not, please make sure to upgrade to the latest ruby-lsapi
release.

Thanks for the report, George.

Earlier LSAPI hit the CGI bug but are not affected since they quickly
timeout.

It’s good to know that the latest LSAPI avoids the problem entirely.

I did not test LiteSpeed + FastCGI.

jeremy