PT-2012-4226 · Oracle · Oracle Java Se+1

Alexander Klink + 1 · Publicado 2012-11-28 · Atualizado 2012-11-28 · CVE-2012-2739

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions prior to 7 Update 6 OpenJDK versions prior to 7u6 build 12 and 8 before build 39

Description The issue allows context-dependent attackers to cause a denial of service, specifically CPU consumption, via crafted input to an application that maintains a hash table. This is due to the computation of hash values without restricting the ability to trigger hash collisions predictably.

Recommendations For Oracle Java SE versions prior to 7 Update 6, update to version 7 Update 6 or later. For OpenJDK versions prior to 7u6 build 12, update to 7u6 build 12 or later. For OpenJDK version 8 before build 39, update to build 39 or later.

Exploit

Correção

DoS

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2012-2739

Produtos afetados

Openjdk

Oracle Java Se

Referências · 10

• 🔥 http://armoredbarista.blogspot.de/2012/02/investigating-hashdos-issue.html · Exploit
• http://mail.openjdk.java.net/pipermail/core-libs-dev/2012-May/010238.html · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2012/06/15/12 · Nota
• http://openwall.com/lists/oss-security/2012/06/17/1 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=750533 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-2739 · Nota de Segurança
• http://ocert.org/advisories/ocert-2011-003.html · Nota
• http://nruns.com/_downloads/advisory28122011.pdf · Nota
• http://kb.cert.org/vuls/id/903934 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2739 · Nota