Java CVE-2012-5373 'MurmurHash' Algorithm Hash Collision Denial of Service Vulnerability
BID:56673
Info
Java CVE-2012-5373 'MurmurHash' Algorithm Hash Collision Denial of Service Vulnerability
| Bugtraq ID: | 56673 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: |
CVE-2012-5373 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 23 2012 12:00AM |
| Updated: | Mar 19 2015 09:48AM |
| Credit: | Jean-Philippe Aumasson |
| Vulnerable: |
Sun JDK (Windows Production Release) 1.7 Sun JDK (Windows Production Release) 1.7.0_4 Sun JDK (Windows Production Release) 1.7.0_2 Sun JDK (Solaris Production Release) 1.7 Sun JDK (Solaris Production Release) 1.7.0_4 Sun JDK (Solaris Production Release) 1.7.0_2 Sun JDK (Linux Production Release) 1.7 Sun JDK (Linux Production Release) 1.7.0_4 Sun JDK (Linux Production Release) 1.7.0_2 |
| Not Vulnerable: | |
Discussion
Java CVE-2012-5373 'MurmurHash' Algorithm Hash Collision Denial of Service Vulnerability
Java is prone to a denial-of-service vulnerability because it uses hash functions based on the 'MurmurHash' algorithm, which is vulnerable to predictable hash collisions.
An attacker can exploit this issue by sending specially crafted sequence of strings to an affected application that uses these strings as keys to create a Hash object (like HTTP requests).
Successful exploits will allow attackers to trigger a high CPU consumption that causes a denial-of-service condition.
Java is prone to a denial-of-service vulnerability because it uses hash functions based on the 'MurmurHash' algorithm, which is vulnerable to predictable hash collisions.
An attacker can exploit this issue by sending specially crafted sequence of strings to an affected application that uses these strings as keys to create a Hash object (like HTTP requests).
Successful exploits will allow attackers to trigger a high CPU consumption that causes a denial-of-service condition.
Exploit / POC
Java CVE-2012-5373 'MurmurHash' Algorithm Hash Collision Denial of Service Vulnerability
An attacker can use readily available tools to exploit this issue.
An attacker can use readily available tools to exploit this issue.
Solution / Fix
Java CVE-2012-5373 'MurmurHash' Algorithm Hash Collision Denial of Service Vulnerability
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Java CVE-2012-5373 'MurmurHash' Algorithm Hash Collision Denial of Service Vulnerability
References:
References:
- OpenJDK Homepage (Oracle)