BID:10301

Sun Java Runtime Environment Unspecified Remote Denial Of Service Vulnerability

Info

Sun Java Runtime Environment Unspecified Remote Denial Of Service Vulnerability

Bugtraq ID:	10301
Class:	Unknown
CVE:	CVE-2004-0651
Remote:	Yes
Local:	No
Published:	May 07 2004 12:00AM
Updated:	Jul 12 2009 04:07AM
Credit:	This issue was disclosed in the referenced vendor alert.
Vulnerable:	Sun SDK (Windows Production Release) 1.4.2 _03 Sun SDK (Windows Production Release) 1.4.2 Sun SDK (Windows Production Release) 1.4.1 _03 Sun SDK (Windows Production Release) 1.4.1 Sun SDK (Solaris Production Release) 1.4.2 _03 Sun SDK (Solaris Production Release) 1.4.2 Sun SDK (Solaris Production Release) 1.4.1 _03 Sun SDK (Solaris Production Release) 1.4.1 Sun SDK (Linux Production Release) 1.4.2 _03 Sun SDK (Linux Production Release) 1.4.2 Sun JRE (Windows Production Release) 1.4.2 _03 Sun JRE (Windows Production Release) 1.4.2 Sun JRE (Solaris Production Release) 1.4.2 _03 Sun JRE (Solaris Production Release) 1.4.2 Sun JRE (Linux Production Release) 1.4.2 _03 Sun JRE (Linux Production Release) 1.4.2 Sun Java 2 Runtime Environment 1.4.2 _03 + Oracle Oracle10g Application Server 10.1 .0.2 + Oracle Oracle10g Application Server 10.1 .0.2 + Oracle Oracle10g Application Server 10.1 .0.2 + Oracle Oracle10g Enterprise Edition 10.1 .0.2 + Oracle Oracle10g Enterprise Edition 10.1 .0.2 + Oracle Oracle10g Enterprise Edition 10.1 .0.2 + Oracle Oracle10g Personal Edition 10.1 .0.2 + Oracle Oracle10g Personal Edition 10.1 .0.2 + Oracle Oracle10g Personal Edition 10.1 .0.2 + Oracle Oracle10g Standard Edition 10.1 .0.2

Not Vulnerable:	Sun SDK (Windows Production Release) 1.4.2 _04 Sun SDK (Solaris Production Release) 1.4.2 _04 Sun SDK (Linux Production Release) 1.4.2 _04 Sun JRE (Windows Production Release) 1.4.2 _04 Sun JRE (Solaris Production Release) 1.4.2 _04 + Opera Software Opera Web Browser 7.54 Sun JRE (Linux Production Release) 1.4.2 _04 + Opera Software Opera Web Browser 7.54

Discussion

Sun Java Runtime Environment Unspecified Remote Denial Of Service Vulnerability

It has been reported that Sun's Java Runtime Environment, as well as the Java Software Development Kit are affected by an unspecified, remote denial of service vulnerability.

This issue would allow an attacker to cause the affected JRE to become unresponsive, denying service to legitimate users.

Reports from Harry Johnston indicate the OraClient 10g component of Oracle Database Server 10g incorporates a vulnerable version of the Java Runtime Environment and is therefore vulnerable to this issue.

Exploit / POC

Sun Java Runtime Environment Unspecified Remote Denial Of Service Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Solution / Fix

Sun Java Runtime Environment Unspecified Remote Denial Of Service Vulnerability

Solution:
HP has released advisory HPSBUX01044 for HP-UX. Users are advised to upgrade to Java 1.4.2.03.01 if they are running 1.4.2 releases 1.4.2.02 and earlier. Further instructions may be found in the attached advisory.

Sun has released alert 57555 along with an upgrade dealing with this issue. Please see the referenced web advisory for more information.

Sun JRE (Linux Production Release) 1.4.2