Vulnerability CVE-2009-1190
Published: 2009-04-27   Modified: 2012-02-13

Description:
Algorithmic complexity vulnerability in the java.util.regex.Pattern.compile method in Sun Java Development Kit (JDK) before 1.6, when used with spring.jar in SpringSource Spring Framework 1.1.0 through 2.5.6 and 3.0.0.M1 through 3.0.0.M2 and dm Server 1.0.0 through 1.0.2, allows remote attackers to cause a denial of service (CPU consumption) via serializable data with a long regex string containing multiple optional groups, a related issue to CVE-2004-2540.

See advisories in our WLB2 database:
Topic
Author
Date
Med.
Spring Framework Remote Denial of Service Vulnerability
Mark Thomas
29.04.2009

Type:

CWE-399

 (Resource Management Errors)

CVSS2 => (AV:N/AC:L/Au:N/C:N/I:N/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
5/10
2.9/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
None
None
Partial
Affected software
SUN -> JDK 

 References:
http://www.packetstormsecurity.org/hitb06/DAY_1_-_Marc_Schoenefeld_-_Pentesting_Java_J2EE.pdf
http://www.securityfocus.com/archive/1/502926/100/0/threaded
http://www.springsource.com/securityadvisory
https://bugzilla.redhat.com/show_bug.cgi?id=497161
https://exchange.xforce.ibmcloud.com/vulnerabilities/50083
Copyright 2024, cxsecurity.com

 

Back to Top