Note: This is an archival copy of Security Sun Alert 233922 as previously published on http://sunsolve.sun.com.|
Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1019057.1.
Solaris 9 Operating System
Solaris 10 Operating System
Date of Preliminary Release
Date of Resolved Release
Multiple Security Vulnerabilities in ICU 3.2 Library Regular Expression Processing May Cause a Denial of Service (DoS)
Multiple security vulnerabilities in processing regular expressions in the ICU 3.2 library shipped with Solaris may impact applications which make use of this library. Depending on the application, this may allow a local or remote unprivileged user to execute arbitrary code with the privileges of the user running the application via a carefully crafted regular expression which is processed by the application. This may also result in a Denial of Service (DoS) to the application.
Additional information regarding these issues is available at:
CVE-2007-4770 at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4770
CVE-2007-4771 at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4771
2. Contributing Factors
These issues can occur in the following releases:
Note: The Solaris 8 Operating System is not impacted by these issues.
There are no predictable symptoms that would indicate the described issues have been exploited.
There is no workaround for these issues. Please see the Resolution section below.
These issues are addressed in the following releases:
For more information on Security Sun Alerts, see 1009886.1.
Copyright 2000-2008 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved.
07-Mar-2008: Updated Contributing Factors and Resolution sections; RESOLVED
29-May-2008: Updated Contributing Factors and Resolution sections for RHEL
This solution has no attachment