From: "Zed A. Shaw" Date: 2006-10-26T05:03:12+09:00 Subject: Re: [SEC] Mongrel Temporary Fix For cgi.rb 99% CPU DoS Attack On Thu, 26 Oct 2006 04:49:33 +0900 James Britt wrote: > Zed also pointed me to Google groups > > http://groups.google.com/group/rubyonrails-talk/browse_frm/thread/8bbee5200ac4312c/87b5d92d513aa3ce#87b5d92d513aa3ce > Thanks folks. Yep, either of those will work. Another point to make is this: If you can't upgrade Mongrel or your software just install the cgi_multipart_eof_fix gem. If you can't even install the gem then use the patch. The gem includes a README, and a test script you can run to validate your server. If you want the latest and greatest Mongrel that will just install the gem for you and have the least hassle then install pre-release Mongrel (see OP). Only warning with pre-release Mongrel is that because of this fix mongrel_upload_progress users might run into problems. Let me know if this is the case, but it's been heavily tested by many people already. -- Zed A. Shaw, MUDCRAP-CE Master Black Belt Sifu http://www.zedshaw.com/ http://safari.oreilly.com/0321483502 -- The Mongrel Book http://mongrel.rubyforge.org/ http://www.lingr.com/room/3yXhqKbfPy8 -- Come get help.