# \[SEC\] Latest LiteSpeed ruby-lsapi does not vulnerable to the

**URL:** <https://www.ruby-forum.com/t/sec-latest-litespeed-ruby-lsapi-does-not-vulnerable-to-the/75525>\
**Category:** Rails\
**Created:** [November 10, 2006, 6:26pm UTC](https://www.ruby-forum.com/t/sec-latest-litespeed-ruby-lsapi-does-not-vulnerable-to-the/75525 "2006-11-10T18:26:57Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![finster](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/ac8455/32.png) [@finster](https://www.ruby-forum.com/u/finster)\
**Post date:** [November 10, 2006, 6:26pm UTC](https://www.ruby-forum.com/t/sec-latest-litespeed-ruby-lsapi-does-not-vulnerable-to-the/75525/1 "2006-11-10T18:26:57Z")

</div>

Hi,

First, my thanks to Zed for including LiteSpeed in cgi.rb vulnerability  
report. Appreciated!

I just got time to review ruby-lsapi code and test the vulnerability  
against LiteSpeed.  
I found that, in our latest ruby-lsapi release 1.11, lsapi\_read()  
function returns Qnil when the end of request body has been reached. So,  
in theory, LiteSpeed should not be vulnerable to this attack.  
Our test results confirmed what I expected, 500 Internal Server Error  
was returned immediately upon receiving the bad multipart request.

However, it is unsure whether earlier release of ruby-lsapi is  
vulnerable or not, please make sure to upgrade to the latest ruby-lsapi  
release.

Please pay attention not to mix manual installation with gem  
installation, manual installation has higher priority, if you have  
installed earlier version of ruby-lsapi manually and switch to gem  
installation later, please make sure to remove lsapi.so installed  
manually, usually at somewhere under …/lib/ruby/site\_ruby/1.8/.

Best Regards,  
George W.

---

<div class="post-metadata">

**Author:** ![finster](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/ac8455/32.png) [@finster](https://www.ruby-forum.com/u/finster)\
**Post date:** [November 10, 2006, 7:57pm UTC](https://www.ruby-forum.com/t/sec-latest-litespeed-ruby-lsapi-does-not-vulnerable-to-the/75525/2 "2006-11-10T19:57:12Z")

</div>

On 11/10/06, George W. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> First, my thanks to Zed for including LiteSpeed in cgi.rb vulnerability  
> report. Appreciated!

I just got time to review ruby-lsapi code and test the vulnerability

> against LiteSpeed.  
> I found that, in our latest ruby-lsapi release 1.11, lsapi\_read()  
> function returns Qnil when the end of request body has been reached. So,  
> in theory, LiteSpeed should not be vulnerable to this attack.  
> Our test results confirmed what I expected, 500 Internal Server Error  
> was returned immediately upon receiving the bad multipart request.
> 
> However, it is unsure whether earlier release of ruby-lsapi is  
> vulnerable or not, please make sure to upgrade to the latest ruby-lsapi  
> release.

Thanks for the report, George.

Earlier LSAPI hit the CGI bug but _are not affected_ since they quickly  
timeout.

It’s good to know that the latest LSAPI avoids the problem entirely.

I did not test LiteSpeed + FastCGI.

jeremy