?

Log in

No account? Create an account

Josh-D. S. Davis

Xaminmo / Omnimax / Max Omni / Mad Scientist / Midnight Shadow / Radiation Master

Previous Entry Share Next Entry
DoS Exposure with JRE & JDK hang while converting 2.2250738585072012e-308 into a binary number
Josh 201604 KWP
joshdavis
Pretty obscure, but worth passing on anyway.

Denial of Service Security Exposure with Java JRE/JDK hanging when converting 2.2250738585072012e-308 number (CVE-2010-4476) (PM32387)

This Security Alert addresses a serious security issue CVE-2010-4476 (Java Runtime Environment hangs when converting "2.2250738585072012e-308" to a binary floating-point number). This vulnerability can cause the Java Runtime Environment to go into a hang, infinite loop, and/or crash resulting in a denial of service exposure. This same hang can occur if the number is written without scientific notation (324 decimal places). In addition to the Application Server being exposed to this attack, any Java program using the Double.parseDouble method is also at risk of this exposure including any customer written application or third party written application.

The following IBM Tivoli products contain affected versions of the Java Runtime Environment:


IBM Product Announcement Pages

Application Manager for Smart Business http://www-01.ibm.com/support/docview.wss?uid=swg21469222
Change and Configuration Management Database http://www-01.ibm.com/support/docview.wss?uid=swg21469399
CloudBurstV1.2 http://www-01.ibm.com/support/docview.wss?uid=swg21468934
CloudBurstV2.1 http://www-01.ibm.com/support/docview.wss?uid=swg21468933
Information Archive Contact L2 Support
License Metric Tool http://www-01.ibm.com/support/docview.wss?uid=swg21468996
Maximo Adapter for Microsoft Project https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo Adapter for Primavera http://www-01.ibm.com/support/docview.wss?uid=swg21469011
Maximo Archiving with Optim Data Growth Solution https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo Asset Configuration Manager See Maximo Asset Mgmt: https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo Asset Management https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo Asset Management Essentials https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo Asset Management for Energy Optimization https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo Asset Management Scheduler https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo Asset Navigator https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo Calibration https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo Change and Corrective Action Manager https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo Data Center Infrastructure Management https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo e-Commerce Adapter See Maximo Asset Mgmt: https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo ECRI Integration for Healthcare See Maximo Asset Mgmt: https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo Enterprise Adapter https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo Enterprise Adapter for Oracle See Maximo Asset Mgmt: https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo Enterprise Adapter for SAP See Maximo Asset Mgmt: https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo Everyplace https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo for Government https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo for Life Sciences https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo for Nuclear Power https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo for Oil and Gas https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo for Service Providers https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo for Transportation https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo for Utilities https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo Linear Asset Management See Maximo Asset Mgmt: https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo Mobile Asset Manager See Maximo Asset Mgmt: https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo Mobile Inventory Manager See Maximo Asset Mgmt: https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo Mobile Suite See Maximo Asset Mgmt: https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo Mobile Work Manager https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo Property Performance Management Systems See Maximo Asset Mgmt: https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo SLA Manager https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo Space Management for Facilities https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo Spatial Asset Management https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Prospect http://www-01.ibm.com/support/docview.wss?uid=swg21469197
Security Information and Event Manager Contact IBM Support
Service Delivery Manager http://www-01.ibm.com/support/docview.wss?uid=swg21468932
Service Manager for Smart Business (formerly Tivoli Foundations Service Manager) http://www-01.ibm.com/support/docview.wss?uid=swg21469069
System Storage ProductivityCenter http://www-01.ibm.com/support/docview.wss?uid=swg21469084
Tivoli Access Manager for e-business http://www-01.ibm.com/support/docview.wss?uid=swg24028828
Tivoli Access Manager for Enterprise Single Sign-on http://www-01.ibm.com/support/docview.wss?uid=swg21469013
Tivoli Access Manager for Operating Systems Contact IBM Support
Tivoli Access Manager for Operating Systems Agent Contact IBM Support
Tivoli Application Dependency Discovery Manager http://www-01.ibm.com/support/docview.wss?uid=swg21468728
Tivoli Application Dependency Discovery Manager - Sensor Interim Feature See TADDM: http://www-01.ibm.com/support/docview.wss?uid=swg21468728
Tivoli Asset Discovery for Distributed http://www-01.ibm.com/support/docview.wss?uid=swg21469000
Tivoli Asset Discovery for zOS http://www-01.ibm.com/support/docview.wss?uid=swg21468894
Tivoli Asset Management for IT http://www-01.ibm.com/support/docview.wss?uid=swg21469010
Tivoli Business Service Manager http://www-01.ibm.com/support/docview.wss?uid=swg21468752
Tivoli Business Service Manager for the Enterprise. http://www-01.ibm.com/support/docview.wss?uid=swg21468752
Tivoli Common Reporting http://www-01.ibm.com/support/docview.wss?uid=swg21469046
Tivoli Common Reporting for Asset and Performance Management http://www-01.ibm.com/support/docview.wss?uid=swg21469046
Tivoli Compliance Insight Manager Contact IBM Support
Tivoli Composite Application Manager Agent for WebSpehre DataPower Appliance http://www-01.ibm.com/support/docview.wss?uid=swg21468841
Tivoli Composite Application Manager for Application Diagnostics http://www-01.ibm.com/support/docview.wss?uid=swg21468884
Tivoli Composite Application Manager for Applications http://www-01.ibm.com/support/docview.wss?uid=swg21469054
Tivoli Composite Application Manager for J2EE http://www-01.ibm.com/support/docview.wss?uid=swg21469154
Tivoli Composite Application Manager for SOA http://www-01.ibm.com/support/docview.wss?uid=swg21468841
Tivoli Composite Application Manager for SOA Platform http://www-01.ibm.com/support/docview.wss?uid=swg21468841
ITM http://www-01.ibm.com/support/docview.wss?uid=swg21468884
ITCAMfAD http://www-01.ibm.com/support/docview.wss?uid=swg21469154
ITCAMfAPPS http://www-01.ibm.com/support/docview.wss?uid=swg21469054
ITMfVS http://www-01.ibm.com/support/docview.wss?uid=swg21468884
ITCAMfDP http://www-01.ibm.com/support/docview.wss?uid=swg21468841
Tivoli Composite Application Manager for Transactions http://www-01.ibm.com/support/docview.wss?uid=swg21469183
Tivoli Composite Application Manager for Web Resources http://www-01.ibm.com/support/docview.wss?uid=swg21469261
Tivoli Composite Application Manager for WebSphere http://www-01.ibm.com/support/docview.wss?uid=swg21469264
Tivoli Configuration Manager http://www-01.ibm.com/support/docview.wss?uid=swg21469229
Tivoli Data Warehouse Contact IBM Support
Tivoli Directory Integrator http://www-01.ibm.com/support/docview.wss?uid=swg21468697
Tivoli Directory Integrator for zOS http://www-01.ibm.com/support/docview.wss?uid=swg21468697
Tivoli Directory Server https://www-304.ibm.com/support/docview.wss?uid=swg21469296
Tivoli Dynamic Workload Broker http://www-01.ibm.com/support/docview.wss?uid=swg21468705
Tivoli Enterprise Console http://www-01.ibm.com/support/docview.wss?uid=swg21469001
Tivoli Federated Identity Manager
V6.2.1 - http://www-01.ibm.com/support/docview.wss?uid=swg24028822
V6.2 - http://www-01.ibm.com/support/docview.wss?uid=swg24025908
V6.1.1 - http://www-01.ibm.com/support/docview.wss?uid=swg24021066
Tivoli Federated Identity Manager Business Gateway
V6.2.1 - http://www-01.ibm.com/support/docview.wss?uid=swg24028833
V6.2 - http://www-01.ibm.com/support/docview.wss?uid=swg24025909
V6.1.1 - http://www-01.ibm.com/support/docview.wss?uid=swg24021277
Tivoli Foundations Application Manager http://www-01.ibm.com/support/docview.wss?uid=swg21469222
Tivoli Foundations Service Manager http://www-01.ibm.com/support/docview.wss?uid=swg21469069
Tivoli Identity Manager http://www-01.ibm.com/support/docview.wss?uid=swg21468875
Tivoli Identity Manager for zOS V5.0 http://www-01.ibm.com/support/docview.wss?uid=swg21468875
Tivoli Integration Composer https://www-304.ibm.com/support/docview.wss?uid=swg21469010
Tivoli Key Lifecycle Manager http://www-01.ibm.com/support/docview.wss?uid=swg21468857
Tivoli License Compliance Manager http://www-01.ibm.com/support/docview.wss?uid=swg21468997
Tivoli Management Framework Contact IBM Support
Tivoli Monitoring http://www-01.ibm.com/support/docview.wss?uid=swg21468884
Tivoli Monitoring for Active Directory http://www-01.ibm.com/support/docview.wss?uid=swg21468884
Tivoli Monitoring for Databases Contact IBM Support
Tivoli Monitoring for Energy Management
See ITM: - http://www-01.ibm.com/support/docview.wss?uid=swg21468884
See Systems Director: http://www-01.ibm.com/support/docview.wss?uid=swg21469284
Tivoli Monitoring for Virtual Servers http://www-01.ibm.com/support/docview.wss?uid=swg21468884
Tivoli Netcool Configuration Manager http://www-01.ibm.com/support/docview.wss?uid=swg24029110
Tivoli Netcool Configuration Manager (LegacyIntellidenVersionsPre6.x)
Fix available for Oracle : http://www.oracle.com/technetwork/topics/security/alert-cve-2010-4476-305811.html
Tivoli Netcool Enterprise VoIP Manager Contact IBM Support
Tivoli Netcool Impact http://www-01.ibm.com/support/docview.wss?uid=swg21468724
Tivoli Netcool Performance Manager (Wireless) http://www-01.ibm.com/support/docview.wss?uid=swg21468927
Tivoli Netcool Performance Manager (Wireline) http://www-01.ibm.com/support/docview.wss?uid=swg21468849
Tivoli Netcool Performance Manager for Wireless Development Toolkit http://www-01.ibm.com/support/docview.wss?uid=swg21468927
Tivoli Netcool Portal http://www-01.ibm.com/support/docview.wss?uid=swg21468915
Tivoli Netcool Service Quality Management Center
TNSQM: Contact IBM Support
TBSM URL: http://www-01.ibm.com/support/docview.wss?uid=swg21468752
Tivoli Netcool Service Quality Manager Contact IBM Support
Tivoli Netcool/OMNIbus
See Omnibus - http://www-01.ibm.com/support/docview.wss?uid=swg21469003
See WebGUI - http://www-01.ibm.com/support/docview.wss?uid=swg21469042
Tivoli Netcool/Reporter http://www-01.ibm.com/support/docview.wss?uid=swg21468912
Tivoli Netcool/WebGUI http://www-01.ibm.com/support/docview.wss?uid=swg21469042
Tivoli Netview (Distributed) http://www-01.ibm.com/support/docview.wss?uid=swg21468987
Tivoli NetView for z/OS http://www-01.ibm.com/support/docview.wss?uid=swg21469285
Tivoli Network Manager Entry Edition http://www-01.ibm.com/support/docview.wss?uid=swg21469132
Tivoli Network Manager IP Edition http://www-01.ibm.com/support/docview.wss?uid=swg21469074
Tivoli Network Manager Transmission Edition http://www-01.ibm.com/support/docview.wss?uid=swg21469056
Tivoli OMEGAMON DE on z/OS http://www-01.ibm.com/support/docview.wss?uid=swg21468976
Tivoli OMEGAMON XE for CICS on z/OS http://www-01.ibm.com/support/docview.wss?uid=swg21468976
Tivoli OMEGAMON XE for CICS TG on z/OS http://www-01.ibm.com/support/docview.wss?uid=swg21468976
Tivoli OMEGAMON XE for DB2 Performance Expert for z/OS http://www-01.ibm.com/support/docview.wss?uid=swg21468976
Tivoli OMEGAMON XE for DB2 Performance Monitor for z/OS http://www-01.ibm.com/support/docview.wss?uid=swg21468976
Tivoli OMEGAMON XE for IMS on z/OS http://www-01.ibm.com/support/docview.wss?uid=swg21468976
Tivoli OMEGAMON XE for Mainframe Networks http://www-01.ibm.com/support/docview.wss?uid=swg21468976
Tivoli OMEGAMON XE for Messaging See ITM - http://www-01.ibm.com/support/docview.wss?uid=swg21468884
Tivoli OMEGAMON XE for Messaging for z/OS http://www-01.ibm.com/support/docview.wss?uid=swg21469441
Tivoli OMEGAMON XE for Storage on z/OS http://www-01.ibm.com/support/docview.wss?uid=swg21468976
Tivoli OMEGAMON XE on z/OS http://www-01.ibm.com/support/docview.wss?uid=swg21468976
Tivoli OMEGAMON XE on z/VM and Linux http://www-01.ibm.com/support/docview.wss?uid=swg21468976
Tivoli OMEGAMON z/OS Management Console http://www-01.ibm.com/support/docview.wss?uid=swg21468976
Tivoli OMNIbus and Network Manager See ITNIP - http://www-01.ibm.com/support/docview.wss?uid=swg21469074
Tivoli Performance Analyzer Contact IBM Support
Tivoli Policy Driven Software Distribution Contact IBM Support
Tivoli Provisioning Manager http://www-01.ibm.com/support/docview.wss?uid=swg21469248
Tivoli Provisioning Manager Express for Inventory http://www-01.ibm.com/support/docview.wss?uid=swg21469098
Tivoli Provisioning Manager Express for S/W Distribution http://www-01.ibm.com/support/docview.wss?uid=swg21469105
Tivoli Provisioning Manager for Software Contact IBM Support
Tivoli Release Process Manager http://www-01.ibm.com/support/docview.wss?uid=swg21469398
Tivoli Remote Control http://www-01.ibm.com/support/docview.wss?uid=swg21468949
Tivoli Security Policy Manager V7.0 (TSPM & RTSS)
TSPM - http://www-01.ibm.com/support/docview.wss?uid=swg24022274
RTSS - http://www-01.ibm.com/support/docview.wss?uid=swg24022275
Tivoli Security Policy Manager V7.1 (TSPM & RTSS)
TSPM - http://www-01.ibm.com/support/docview.wss?uid=swg24028456
RTSS - http://www-1.ibm.com/support/docview.wss?uid=swg24028455
Tivoli Service Automation Manager Contact IBM Support
Tivoli Service Level Advisor Contact IBM Support
Tivoli Service Request Manager Contact IBM Support
Tivoli Storage Manager http://www-01.ibm.com/support/docview.wss?uid=swg21469266
Tivoli Storage Manager Extended Edition http://www-01.ibm.com/support/docview.wss?uid=swg21469266
Tivoli Storage Manager FastBack http://www-01.ibm.com/support/docview.wss?uid=swg21469209
Tivoli Storage Manager FastBack for Workstations http://www-01.ibm.com/support/docview.wss?uid=swg21468271
Tivoli Storage Manager for Space Management http://www-01.ibm.com/support/docview.wss?uid=swg21469266
Tivoli Storage Manager for Storage Area Networks http://www-01.ibm.com/support/docview.wss?uid=swg21469266
Tivoli Storage Productivity Center http://www-01.ibm.com/support/docview.wss?uid=swg21469084
Tivoli Storage Productivity Center for Replication http://www-01.ibm.com/support/docview.wss?uid=swg21469084
Tivoli System Automation Application Manager http://www-01.ibm.com/support/docview.wss?uid=swg21468860
Tivoli System Automation for Integrated Operations Management http://www-01.ibm.com/support/docview.wss?uid=swg21468861
Tivoli System Automation for Multiplatforms http://www-01.ibm.com/support/docview.wss?uid=swg21468856
Tivoli System Automation for z/OS http://www-01.ibm.com/support/docview.wss?uid=swg21468862
Tivoli Usage and Accounting Manager http://www-01.ibm.com/support/docview.wss?uid=swg21469080
Tivoli Workload Scheduler http://www-01.ibm.com/support/docview.wss?uid=swg21468704
Tivoli Workload Scheduler for Applications http://www-01.ibm.com/support/docview.wss?uid=swg21468709
Tivoli Workload Scheduler for z/OS http://www-01.ibm.com/support/docview.wss?uid=swg21468747


Consult the following links for related product information:

WebSphere® specific instructions to address this vulnerability: http://www-01.ibm.com/support/docview.wss?uid=swg21462019

DB2® specific instructions to address this vulnerability: https://www-304.ibm.com/support/docview.wss?uid=swg21468291

Tivoli Common Reporting instructions: http://www-01.ibm.com/support/docview.wss?uid=swg21469046
Tags: ,