PT-2004-3432 · Oracle · Software Development Kit+2

Published 2004-12-31 · Updated 2017-07-11 · CVE-2004-2540

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Java Runtime Environment (JRE) versions 1.4.0 through 1.4.2 05 Software Development Kit (SDK) versions 1.4.0 through 1.4.2 05

Description The issue allows remote attackers to cause a denial of service, making the Java Virtual Machine (JVM) unresponsive, via crafted serialized data. This is due to the readObject method in the affected Java Runtime Environment (JRE) and Software Development Kit (SDK) versions.

Recommendations For Java Runtime Environment (JRE) versions 1.4.0 through 1.4.2 05, consider updating to a version that contains a fix for this issue. For Software Development Kit (SDK) versions 1.4.0 through 1.4.2 05, consider updating to a version that contains a fix for this issue. As a temporary workaround, consider restricting the use of the readObject method until a patch is available.

Fix

Related Identifiers

CVE-2004-2540

Affected Products

Java Runtime Environment

Java Virtual Machine

Software Development Kit

References · 6

• http://sunsolve.sun.com/searchproxy/document.do?assetkey=1-26-57707-1 · Vendor Advisory
• http://secunia.com/advisories/13271 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-2540 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2540 · Note
• http://archives.neohapsis.com/archives/bugtraq/2005-04/0113.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/20027 · Note