1 / 14

Affected Products Java SE JDK and JRE 6 update 23 and earlier JDK 5.0 Update 27 and earlier

Affected Products Java SE JDK and JRE 6 update 23 and earlier JDK 5.0 Update 27 and earlier SDK 1.4.2_29 and earlier JRockit R27.6.8 and earlier (JDK/JRE 1.4.2,5,6) R28.1.1 and earlier (JDK/JRE 5,6).

dalton
Download Presentation

Affected Products Java SE JDK and JRE 6 update 23 and earlier JDK 5.0 Update 27 and earlier

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Affected Products • Java SE • JDK and JRE 6 update 23 and earlier • JDK 5.0 Update 27 and earlier • SDK 1.4.2_29 and earlier • JRockit • R27.6.8 and earlier (JDK/JRE 1.4.2,5,6) • R28.1.1 and earlier (JDK/JRE 5,6)

  2. class runhang { public static void main(String[] args) { System.out.println("Test:"); double d = Double.parseDouble("2.2250738585072012e-308"); System.out.println("Value: " + d); } } • class compilehang { public static void main(String[] args) { double d = 2.2250738585072012e-308; System.out.println("Value: " + d); } }

  3. 1. Update the Java Runtime Environment (JRE). The JRE provides the libraries, the Java • Virtual Machine, and other components to run applets and applications. • 2. Update your application server's Java Developer Kit (J • Summary: This old bug says that Double.parseDouble(s) hangs for decimal strings in range (Double.MIN_NORMAL-0.5*Double.MIN_VALUE,Double.MIN_NORMAL), and returns incorrect result for decimal string Double.MIN_NORMAL-0.5*Double.MIN_VALUE. • This bug 4421494

  4. This is because current code in FloatingDecimal.doubleValue() incorrectly defines the condition when nextDown(dValue) - dValue == -0.5*ulp(dValue). The current code considers that these are all numbers 2^n which are represented as normal doubles, and nextDown(dValue) - dValue == -1.0*ulp(dValue) for other doubles (subnormal or not 2-powers). However, this is not correct for dValue == Double.MIN_NORMAL, because nextDown(Double.MIN_NORMAL) - Double.MIN_NORMAL == -1.0*ulp(Double.MIN_NORMAL)

  5. Affected product releases and versions:

  6. Affected Tomcat versions: • Tomcat 7 earlier than 7.0.8 • Tomcat 6 earlier than 6.0.32 • Tomcat 5.5 earlier than 5.5.33

  7. Severity and impact • High severity • The vulnerability allows an adversary to trivially execute a *denial of service attack* removing target CAS-running Tomcat instances from service. • No end user data is exposed. No passwords are compromised. No system access is illicitly granted. • The only impact of this vulnerability is to cause service outages.

  8. Manually updating the JVM • Oracle has released a tool for updating affected JVMs. Note however that this tool breaks auto-updating of the JVM, so this tool should only be used in environments that are manually maintained (and in such environments, it may be cleaner and simpler to simply replace the installed ad-hoc JVM with the Update 24 release rather than patching it in place.) • Oracle fpupdater tool

  9. Introduction • The FPUpdater tool allows you to update installed Java Development Kit (JDK) and Java Runtime Environment (JRE) software to address the hang that occurs when parsing strings like "2.2250738585072012e-308" to a binary floating point number, as described in Security Alert for CVE-2010-4476 Released.

  10. System Requirements • The FPUpdater tool is recommended for the Oracle JRE releases shown in the following table: • JRE/JDK ReleaseCommentsJ2SE 1.4.2Required for updates prior to, and including, 1.4.2_29J2SE 5.0Required for updates prior to, and including, 5.0u27J2SE for Embedded 5.0Required for updates prior to, and including, 5.0u27Java SE 6Required for updates prior to, and including, 6u23Java SE for Embedded 6Required for updates prior to, and including, 6u23Java Real-Time System 2Required for updates prior to, and including, 2.2u1JRockit R27Required for updates prior to, and including, R27.6.8JRockit R28Required for updates prior to, and including, R28.1.1

  11. As a result of running the tool, the <JRE_HOME>/lib/rt.jar file is modified and the tool leaves behind the following files: • <JRE_HOME>/lib/rt.jar.fpupdater   Copy of rt.jar before the fix.<JRE_HOME>/lib/.fpupdater.log       Zero-length file indicating that the update has taken place. • If either of these two files are already present, the tool will not perform the update and exits with a warning. • Run the fpupdater tool with the following command. • <JRE_HOME>/bin/java -jar fpupdater.jar -u -v • C:\Program Files\Java\jre6\bin\java

  12. 要先關閉所有JAVA程式

More Related