CVE-2011-4610: Buffer Overflow
JBoss Web will enter into an infinite loop when a surrogate pair character is placed at the boundary of an internal buffer. A remote attacker could exploit this flaw to trigger a denial-of-service attack against a JBoss Web server that is hosting applications with UTF-8 character encoding enabled, or that will include user-supplied UTF-8 strings in a response.
Other sources
JBoss Web, as used in Red Hat JBoss Communications Platform before 5.1.3, Enterprise Web Platform before 5.1.2, Enterprise Application Platform before 5.1.2, and other products, allows remote attackers to cause a denial of service (infinite loop) via vectors related to a crafted UTF-8 and a "surrogate pair character" that is "at the boundary of an internal buffer."
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2011-4610?
CVE-2011-4610 has a moderate severity rating due to its potential to cause denial-of-service conditions.
How do I fix CVE-2011-4610?
To mitigate CVE-2011-4610, update your JBoss server to a version that is not affected, preferably above 5.1.2.
What kind of attack does CVE-2011-4610 facilitate?
CVE-2011-4610 facilitates a denial-of-service attack by causing JBoss Web to enter an infinite loop.
Which versions of JBoss are affected by CVE-2011-4610?
CVE-2011-4610 affects Red Hat JBoss Communications Platform versions up to 5.1, and JBoss Enterprise Application Platform up to 5.1.2.
Is there a workaround for CVE-2011-4610?
Currently, the best workaround for CVE-2011-4610 is to avoid encoding UTF-8 characters that could trigger the vulnerability.