AdaCore Security Advisory - All AWS releases and wavefronts prior to 2012-01-21 suffer from hash collision vulnerabilities.
7e3a1369a020e57b96e59b8b0b9529fdb0e3680525f1bd1d5292095b172b5eb3
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
AdaCore Security Advisory
=========================
SA-2012-L119-003 Hash collisions in AWS
Problem: Impacted versions of AWS store key/value pairs from submitted
form data in hash tables using a hash function that has
predictable collisions. As a result, a single specially crafted
HTTP request can cause the server to use hours of CPU time,
thus causing a denial of service.
Impact: All AWS releases and wavefronts prior to 2012-01-21
Status: This was fixed in AWS 2.11 and 2.10.2 on 2012-01-21
References: n.runs-SA-2011.004
http://www.nruns.com/_downloads/advisory28122011.pdf
Effective Denial of Service attacks against
web application platforms :: AWS round
http://ogrod2.blogspot.com/2012/01/28c3-effective-denial-of-service.html
AWS
http://www.adacore.com/home/products/gnatpro/add-on_technologies/web_technologies
http://forge.open-do.org/projects/aws/
History: 2012-01-27 First published
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iEYEARECAAYFAk8iwlEACgkQK8Lr/hUfADYemQCdHUyHQWMRikkF2XO0n1KSINCt
NbYAoMyczgLV2Bt+aok73Cp90A8tBmEe
=XT3i
-----END PGP SIGNATURE-----