• 
• 
• 

More Resources

Recent Papers

• The use of value numbers in static analysis.
  
• Towards Certification of Object-Oriented Code with the GNAT Compiler
  
• Couverture paper presented at ERTS² 2010
  
• A principled approach to software engineering
  
• Coverage and Free Software
  

Browse by Technology

• Ada / Ada 2005 / Ada 2012
• AJIS
• ASIS
• AWS
• CodePeer
• GNAT Compilation System
• GNATbench
• GNATcoverage
• GPS
• GtkAda
• PolyORB
• SPARK
• XML/Ada

Dev Log Archives

• February 2012
• January 2012
• December 2011
• November 2011
• October 2011
• September 2011
• August 2011
• July 2011
• June 2011
• May 2011
• April 2011
• March 2011
• February 2011
• January 2011
• December 2010
• November 2010
• October 2010
• September 2010
• August 2010
• July 2010
• June 2010
• May 2010
• April 2010
• March 2010
• February 2010
• January 2010
• December 2009
• November 2009
• October 2009
• September 2009
• August 2009
• July 2009
• June 2009
• May 2009
• April 2009
• March 2009
• February 2009
• January 2009
• December 2008
• November 2008
• October 2008
• September 2008
• August 2008
• July 2008
• June 2008
• May 2008
• April 2008
• March 2008
• February 2008
• January 2008
• December 2007
• November 2007
• October 2007
• September 2007
• August 2007
• July 2007
• June 2007
• May 2007
• April 2007
• March 2007
• February 2007
• January 2007
• December 2006
• November 2006
• October 2006
• September 2006
• August 2006
• July 2006
• June 2006
• May 2006
• April 2006
• March 2006
• February 2006
• January 2006
• December 2005
• November 2005
• October 2005
• September 2005
• August 2005
• July 2005
• June 2005
• May 2005
• April 2005
• March 2005
• February 2005
• January 2005
• December 2004
• November 2004
• October 2004
• September 2004
• August 2004
• July 2004
• June 2004
• May 2004
• April 2004
• March 2004
• February 2004
• January 2004

Security Advisory SA-2012-L119-003: Hash collisions in AWS

Friday January 27, 2012

Problem:

Impacted versions of AWS store key/value pairs from submitted form data in hash tables using a hash function that has predictable collisions. As a result, a single specially crafted HTTP request can cause the server to use hours of CPU time, thus causing a denial of service.

Impact:

All AWS releases and wavefronts prior to 2012-01-21

Status:

This was fixed in AWS 2.11 and 2.10.2 on 2012-01-21

References:

• n.runs-SA-2011.004
• Effective Denial of Service attacks against web application platforms :: AWS round
• AWS: AdaCore site, OpenDO Forge

Posted in AWS, Development Log