PT-2012-4226 · Oracle · Oracle Java Se+1

Alexander Klink + 1 · Published 2012-11-28 · Updated 2012-11-28 · CVE-2012-2739

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions prior to 7 Update 6 OpenJDK versions prior to 7u6 build 12 and 8 before build 39

Description The issue allows context-dependent attackers to cause a denial of service, specifically CPU consumption, via crafted input to an application that maintains a hash table. This is due to the computation of hash values without restricting the ability to trigger hash collisions predictably.

Recommendations For Oracle Java SE versions prior to 7 Update 6, update to version 7 Update 6 or later. For OpenJDK versions prior to 7u6 build 12, update to 7u6 build 12 or later. For OpenJDK version 8 before build 39, update to build 39 or later.

Exploit

Fix

DoS

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2012-2739

Affected Products

Openjdk

Oracle Java Se

References · 10

• 🔥 http://armoredbarista.blogspot.de/2012/02/investigating-hashdos-issue.html · Exploit
• http://mail.openjdk.java.net/pipermail/core-libs-dev/2012-May/010238.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-2739 · Security Note
• http://openwall.com/lists/oss-security/2012/06/15/12 · Note
• http://openwall.com/lists/oss-security/2012/06/17/1 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=750533 · Note
• http://ocert.org/advisories/ocert-2011-003.html · Note
• http://nruns.com/_downloads/advisory28122011.pdf · Note
• http://kb.cert.org/vuls/id/903934 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2739 · Note