CVE-2009-1101: Medium severity Java Development Kit (JDK) vulnerability
Unspecified vulnerability in the lightweight HTTP server implementation in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12 and earlier allows remote attackers to cause a denial of service (probably resource consumption) for a JAX-WS service endpoint via a connection without any data, which triggers a file descriptor "leak."
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
For systems running the affected lightweight HTTP server (JAX-WS endpoint) in Java SE JDK / JRE 6 Update 12 and earlier, restrict network access to the JAX-WS service endpoint to trusted IP addresses using host/network firewall rules or network ACLs. Also implement connection rate-limiting (throttling) on that endpoint to reduce the impact of connections that send no data and prevent resource exhaustion.
- Operational
Monitor file descriptor usage for Java processes hosting the JAX-WS service (affected JDK/JRE 6 Update 12 and earlier); if abnormal growth or exhaustion is detected (indicative of the file-descriptor leak), restart the Java process/service to reclaim descriptors and restore availability.
Event History
Frequently Asked Questions
What is the severity of CVE-2009-1101?
CVE-2009-1101 has been classified as a denial of service vulnerability.
How do I fix CVE-2009-1101?
To mitigate CVE-2009-1101, upgrade to a later version of Java SE Development Kit or Java Runtime Environment that addresses the vulnerability.
What software versions are affected by CVE-2009-1101?
CVE-2009-1101 affects Java SE Development Kit and Java Runtime Environment versions 6 Update 12 and earlier.
Can CVE-2009-1101 be exploited remotely?
Yes, CVE-2009-1101 can be exploited by remote attackers to cause a denial of service.
What type of attack does CVE-2009-1101 enable?
CVE-2009-1101 potentially enables resource consumption attacks against JAX-WS service endpoints.