PT-2009-3671 · Oracle+2 · Java Se Development Kit+4

Published 2009-03-25 · Updated 2018-10-10 · CVE-2009-1093

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Java SE Development Kit (JDK) and Java Runtime Environment (JRE) versions 5.0 Update 17 and earlier Java SE Development Kit (JDK) and Java Runtime Environment (JRE) versions 6 Update 12 and earlier Java SE Development Kit (JDK) and Java Runtime Environment (JRE) versions 1.3.1 24 and earlier Java SE Development Kit (JDK) and Java Runtime Environment (JRE) versions 1.4.2 19 and earlier

Description The issue is related to the LdapCtx in the LDAP service, which does not close the connection when initialization fails. This allows remote attackers to cause a denial of service, resulting in the LDAP service hanging.

Recommendations For Java SE Development Kit (JDK) and Java Runtime Environment (JRE) versions 5.0 Update 17 and earlier, update to a version later than 5.0 Update 17. For Java SE Development Kit (JDK) and Java Runtime Environment (JRE) versions 6 Update 12 and earlier, update to a version later than 6 Update 12. For Java SE Development Kit (JDK) and Java Runtime Environment (JRE) versions 1.3.1 24 and earlier, update to a version later than 1.3.1 24. For Java SE Development Kit (JDK) and Java Runtime Environment (JRE) versions 1.4.2 19 and earlier, update to a version later than 1.4.2 19.

Fix

DoS

Weakness Enumeration

CWE-16

Related Identifiers

CVE-2009-1093

DSA-1769-1

HPSBUX02429

RHSA-2009:0377

RHSA-2009:0392

RHSA-2009:0394

RHSA-2009:1038

RHSA-2009:1198

RHSA-2009:1662

RHSA-2009_0377

RHSA-2010:0043

Affected Products

Hp-Ux

Java Platform

Java Runtime Environment

Java Se Development Kit

Red Hat

References · 85

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1101 · Security Note
• https://rhn.redhat.com/errata/RHSA-2009-1198.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00001.html · Vendor Advisory
• https://rhn.redhat.com/errata/RHSA-2009-0377.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-06299 · Security Note
• https://bdu.fstec.ru/vul/2015-03027 · Security Note
• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01745133 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1103 · Security Note
• https://bdu.fstec.ru/vul/2015-03026 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2009:137 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2009:162 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1107 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1097 · Security Note
• http://debian.org/security/2009/dsa-1769 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00003.html · Vendor Advisory