Threat Level: green Handler on Duty: Pasquale Stirparo

SANS ISC: Java Floating point issue (CVE-2010-4476) - SANS Internet Storm Center SANS ISC InfoSec Forums


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Java Floating point issue (CVE-2010-4476)

 Oracle release a security bulletin yesterday relating to the binary floating point issue when converting 2.2250738585072012e-308" to a binary floating-point number.  (http://www.oracle.com/technetwork/topics/security/alert-cve-2010-4476-305811.html)

The problem affects both JRE and JDK 6 update 23 and earlier. 4.0 Update 27 and earlier, as well as,  yes people still use it, SDK & JRE 1.4.2_29.

Applications utilising these versions will be vulnerable to denial of service attacks.  Servlet managers such as tomcat and others are likely affected as these often run older versions of java.  

No patch available just yet. 

- Mark - 

 

Mark

392 Posts
ISC Handler
The Oracle security bulletin references a patch - http://www.oracle.com/technetwork/java/javase/downloads/index.html#fpupdater . It's not an updated version, just a tool that patches all the various affected versions. See the Readme (http://www.oracle.com/technetwork/java/javase/fpupdater-tool-readme-305936.html) for tons of details.
Anonymous
Interesting commentary on Oracle's response here:

http://www.oracle.cc/2011/02/double-trouble-how-a-java-security-issue-was-fixed/
Anonymous

Sign Up for Free or Log In to start participating in the conversation!