PT-2004-2411 · Oracle · Java Runtime Environment

Kurt Huwig · Publicado 2004-12-31 · Atualizado 2017-07-11 · CVE-2004-1503

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Java Runtime Environment (JRE) versions 1.4.2 through 1.5.0

Description The issue is related to an integer overflow in the InitialDirContext in Java Runtime Environment. This allows remote attackers to cause a denial of service, resulting in a Java exception and failed DNS requests. The attack is facilitated by a large number of DNS requests, which causes the xid variable to wrap around and become negative.

Recommendations For Java Runtime Environment versions 1.4.2 through 1.5.0, consider restricting the number of DNS requests to prevent the xid variable from wrapping around and becoming negative, until a patch is available.

Correção

Identificadores relacionados

CVE-2004-1503

Produtos afetados

Java Runtime Environment

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2004-1503 · Nota de Segurança
• http://securityfocus.com/bid/11619 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1503 · Nota
• http://secunia.com/advisories/13142 · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=109994063331773&w=2 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17990 · Nota