PT-2004-2411 · Oracle · Java Runtime Environment

Kurt Huwig · Published 2004-12-31 · Updated 2017-07-11 · CVE-2004-1503

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Java Runtime Environment (JRE) versions 1.4.2 through 1.5.0

Description The issue is related to an integer overflow in the InitialDirContext in Java Runtime Environment. This allows remote attackers to cause a denial of service, resulting in a Java exception and failed DNS requests. The attack is facilitated by a large number of DNS requests, which causes the xid variable to wrap around and become negative.

Recommendations For Java Runtime Environment versions 1.4.2 through 1.5.0, consider restricting the number of DNS requests to prevent the xid variable from wrapping around and becoming negative, until a patch is available.

Fix

Related Identifiers

CVE-2004-1503

Affected Products

Java Runtime Environment

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2004-1503 · Security Note
• http://secunia.com/advisories/13142 · Vendor Advisory
• http://securityfocus.com/bid/11619 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1503 · Note
• http://marc.info/?l=bugtraq&m=109994063331773&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17990 · Note