PT-2005-4369 · Red Hat+1 · Jboss+3

Marc Schoenefeld · Published 2005-11-16 · Updated 2016-10-18 · CVE-2005-3583

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Java Runtime Environment (JRE) versions 1.4.2 08 through 1.5.0 05 Software Development Kit (SDK) versions 1.4.2 08 through 1.5.0 05

Description The issue allows remote attackers to cause a denial of service, making the Java Virtual Machine (JVM) unresponsive, via a crafted serialized object. This can be achieved with a specially crafted font object, as demonstrated on JBoss.

Recommendations For Java Runtime Environment (JRE) versions 1.4.2 08 through 1.5.0 05, consider updating to a version that is not affected by this issue. For Software Development Kit (SDK) versions 1.4.2 08 through 1.5.0 05, consider updating to a version that is not affected by this issue. As a temporary workaround, consider restricting the use of serialized objects, such as font objects, to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2005-3583

Affected Products

Jboss

Java Runtime Environment

Java Virtual Machine

Software Development Kit

References · 6

• http://secunia.com/advisories/17478 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-3583 · Security Note
• http://securityfocus.com/bid/15312 · Note
• http://securityreason.com/securityalert/143 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3583 · Note
• http://marc.info/?l=bugtraq&m=113113125121878&w=2 · Note