PT-2005-4369 · Red Hat+1 · Jboss+3

Marc Schoenefeld · Publicado 2005-11-16 · Atualizado 2016-10-18 · CVE-2005-3583

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Java Runtime Environment (JRE) versions 1.4.2 08 through 1.5.0 05 Software Development Kit (SDK) versions 1.4.2 08 through 1.5.0 05

Description The issue allows remote attackers to cause a denial of service, making the Java Virtual Machine (JVM) unresponsive, via a crafted serialized object. This can be achieved with a specially crafted font object, as demonstrated on JBoss.

Recommendations For Java Runtime Environment (JRE) versions 1.4.2 08 through 1.5.0 05, consider updating to a version that is not affected by this issue. For Software Development Kit (SDK) versions 1.4.2 08 through 1.5.0 05, consider updating to a version that is not affected by this issue. As a temporary workaround, consider restricting the use of serialized objects, such as font objects, to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2005-3583

Produtos afetados

Jboss

Java Runtime Environment

Java Virtual Machine

Software Development Kit

Referências · 6

• http://securityfocus.com/bid/15312 · Nota
• http://securityreason.com/securityalert/143 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3583 · Nota
• http://secunia.com/advisories/17478 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2005-3583 · Nota de Segurança
• http://marc.info/?l=bugtraq&m=113113125121878&w=2 · Nota