* Synopsis: MacOSX Java Runtime Environment Remote Denial-of-Service
(DoS) Vulnerability
* Category: Security
* Product: Java SDK and JRE
* State: Open
* Vendor Informed: 03-Apr-2005, 06-Apr-2005
* Found by: Marc Schoenefeld, www.illegalaccess.org
Impact:
A vulnerability in the Java Runtime Environment (JRE) involving object
deserialization could be exploited remotely to cause the Java Virtual
Machine to become unresponsive, which is a type of Denial-of-Service (DoS).
This issue can affect
the JRE if an application that runs on it accepts serialized data from an
untrusted source.
This affects applets, RMI/JRMP, RMI/IIOP and other remoting protocols that
rely on
ObjectInputStream listeners.
The Vulnerability is related to the readObject vulnerability in Sun JDK
1.4.2_05 and earlier
(http://sunsolve.sun.com/search/document.do?assetkey=1-26-57707-1).
Although Sun fixed the bug in JDK 1.4.2_06 for the Intel platforms the
Security Update from Apple did not include this fix in their
java version.
Relief/Workaround
There is no workaround. And the vendor does not react to bug reports
(informed twice to product-security (at) apple (dot) com [email concealed]).
- --
Never be afraid to try something new. Remember, amateurs built the
ark; professionals built the Titanic. -- Anonymous
Hash: SHA1
* Synopsis: MacOSX Java Runtime Environment Remote Denial-of-Service
(DoS) Vulnerability
* Category: Security
* Product: Java SDK and JRE
* State: Open
* Vendor Informed: 03-Apr-2005, 06-Apr-2005
* Found by: Marc Schoenefeld, www.illegalaccess.org
Impact:
A vulnerability in the Java Runtime Environment (JRE) involving object
deserialization could be exploited remotely to cause the Java Virtual
Machine to become unresponsive, which is a type of Denial-of-Service (DoS).
This issue can affect
the JRE if an application that runs on it accepts serialized data from an
untrusted source.
This affects applets, RMI/JRMP, RMI/IIOP and other remoting protocols that
rely on
ObjectInputStream listeners.
The Vulnerability is related to the readObject vulnerability in Sun JDK
1.4.2_05 and earlier
(http://sunsolve.sun.com/search/document.do?assetkey=1-26-57707-1).
Although Sun fixed the bug in JDK 1.4.2_06 for the Intel platforms the
Security Update from Apple did not include this fix in their
java version.
Relief/Workaround
There is no workaround. And the vendor does not react to bug reports
(informed twice to product-security (at) apple (dot) com [email concealed]).
- --
Never be afraid to try something new. Remember, amateurs built the
ark; professionals built the Titanic. -- Anonymous
Marc Schönefeld Dipl. Wirtsch.-Inf. / Software Developer
www.illegalaccess.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (AIX)
iD8DBQFCVbYLqCaQvrKNUNQRAmeUAJ4x2kKj0sNypQd48IUyWn9jFJCf6gCdEgYk
Ea+fgj9JpXhrhiaFAfOPYgs=
=lxe5
-----END PGP SIGNATURE-----
[ reply ]