Sun Java HotSpot DoS Vulnerability

Bugtraq ID:	522
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	Yes
Published:	Jul 06 1999 12:00AM
Updated:	Jul 06 1999 12:00AM
Credit:	Posted to NTBugtraq July 6, 1999 by Per Arne Johansson <[email protected]>.
Vulnerable:	Sun Java HotSpot Performance Engine 1.0 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 Microsoft IIS 4.0 + Cisco Building Broadband Service Manager (BBSM) 5.0 + Cisco Building Broadband Service Manager (BBSM) 5.0 + Cisco Call Manager 3.0 + Cisco Call Manager 3.0 + Cisco Call Manager 2.0 + Cisco Call Manager 2.0 + Cisco Call Manager 1.0 + Cisco Call Manager 1.0 + Cisco ICS 7750 + Cisco ICS 7750 + Cisco IP/VC 3540 Video Rate Matching Module + Cisco IP/VC 3540 Video Rate Matching Module + Cisco Unity Server 2.4 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.2 + Cisco Unity Server 2.0 + Cisco Unity Server 2.0 + Cisco uOne 4.0 + Cisco uOne 4.0 + Cisco uOne 3.0 + Cisco uOne 3.0 + Cisco uOne 2.0 + Cisco uOne 2.0 + Cisco uOne 1.0 + Cisco uOne 1.0 + Hancom Hancom Office 2007 0 + Hancom Hancom Office 2007 0 + Microsoft BackOffice 4.5 + Microsoft BackOffice 4.5 + Microsoft Windows NT 4.0 Option Pack + Microsoft Windows NT 4.0 Option Pack
Not Vulnerable:

Sun Java HotSpot DoS Vulnerability

When IIS and Sun's Java HotSpot Performance engine are running simultaneously, the following URL will cause the system to crash:
h t t p ://targethost/servlet/[
The following is the error message:
# HotSpot Virtual Machine Error, Internal Error
#
# Error ID: 4649454C44345950450E4350500026
Affected processes are Jrun, ServletExec and IIS.

Sun Java HotSpot DoS Vulnerability

see discussion

Sun Java HotSpot DoS Vulnerability

Solution:
Sun has recognized this as a problem. Progress reports on their solution can be found at:
http://developer.java.sun.com/developer/bugParade/index.html
Note: According to Sun, this bug will be added to the above site in a few days. -July 19, 1999