PT-2009-3740 · Sun+1 · Java Development Kit+2
Marc Schoenefeld
·
Published
2009-04-27
·
Updated
2022-05-02
·
CVE-2009-1190
CVSS v2.0
5.0
Medium
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:P |
Name of the Vulnerable Software and Affected Versions
Sun Java Development Kit (JDK) versions prior to 1.6
SpringSource Spring Framework versions 1.1.0 through 2.5.6 and 3.0.0.M1 through 3.0.0.M2
dm Server versions 1.0.0 through 1.0.2
Description
The issue allows remote attackers to cause a denial of service (CPU consumption) via serializable data with a long regex string containing multiple optional groups. This is related to an algorithmic complexity vulnerability in the java.util.regex.Pattern.compile method.
Recommendations
For Sun Java Development Kit (JDK) versions prior to 1.6, update to version 1.6 or later.
For SpringSource Spring Framework versions 1.1.0 through 2.5.6, update to a version outside of this range.
For SpringSource Spring Framework versions 3.0.0.M1 through 3.0.0.M2, update to a version outside of this range.
For dm Server versions 1.0.0 through 1.0.2, update to a version outside of this range.
As a temporary workaround, consider restricting the use of the
java.util.regex.Pattern.compile method to minimize the risk of exploitation.Exploit
Fix
DoS
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Spring Framework
Java Development Kit
M-Server