Note: This is an archival copy of Security Sun Alert 200599 as previously published on http://sunsolve.sun.com. Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1000461.1. |
Category Security Release Phase Resolved Java 2 Platform, Standard Edition Bug Id 6542796 Date of Resolved Release 10-JUL-2007 Impact The Java Secure Socket Extension (JSSE) that is included in various releases of the Java Runtime Environment does not correctly process SSL/TLS handshake requests. This vulnerability may be exploited to create a Denial of Service (DoS) condition to the system as a whole on a server that listens for SSL/TLS connections using JSSE for SSL/TLS support. Sun acknowledges with thanks, Cisco Systems for bringing this issue to our attention. Contributing Factors This issue can occur in the following releases (for Solaris, Linux, and Windows):
Note: JSSE 1.0.3_xx and earlier, which are optional packages for use with older versions of the JDK, are not affected by this issue. SDK and JRE 1.4.2_10 and earlier, and JDK and JRE 5.0 Update 6 and earlier are also not affected. To determine the default version of the JRE on a system for Solaris and Linux, the following command can be run: % java -version Note: The above command only determines the default version. Other versions may also be installed on the system. To determine the default version of the JRE on a system for Windows:
Note: The above command only determines the default version. Other versions may also be installed on the system. Symptoms If this issue has been exploited to cause a Denial of Service to the system, processes making use of JSSE may be consuming excessive amounts of CPU, causing the system to run slowly and be unresponsive. Workaround There is no workaround for this issue. Please see the Resolution section below. Resolution This issue is addressed in the following releases (for Solaris, Linux, and Windows):
Java SE 6 is available for download at the following links: http://java.sun.com/javase/downloads/index.jsp Java SE 6 Update 2 for Solaris is available in the following patches:
Java SE 5.0 is available for download at the following link: http://java.sun.com/j2se/1.5.0/download.jsp Java SE 5.0 Update 12 for Solaris is available in the following patches:
J2SE 1.4.2 is available for download at the following link: http://java.sun.com/j2se/1.4.2/download.html Note: When installing a new version of the product from a source other than a Solaris patch, it is recommended that the old affected versions be removed from your system. To remove old affected versions on the Windows platform, please see: http://java.com/en/download/help/uninstall_java.xml References118666-12118667-12 118668-12 118669-12 125136-02 125137-02 125138-02 125139-02 Attachments This solution has no attachment |
|