CVE-2011-5035: Input Validation
Oracle Glassfish 2.1.1, 3.0.1, and 3.1.1, as used in Communications Server 2.0, Sun Java System Application Server 8.1 and 8.2, and possibly other products, computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters, aka Oracle security ticket S0104869.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2011-5035?
CVE-2011-5035 is classified as a high severity vulnerability due to its potential for allowing remote attackers to exploit hash collisions.
How do I fix CVE-2011-5035?
To mitigate CVE-2011-5035, you should upgrade to the latest version of Oracle GlassFish Server that is not affected, beyond version 3.1.1.
Which versions of Oracle GlassFish Server are affected by CVE-2011-5035?
CVE-2011-5035 affects Oracle GlassFish Server versions 2.1.1, 3.0.1, and 3.1.1.
Can CVE-2011-5035 be exploited remotely?
Yes, CVE-2011-5035 can be exploited remotely, allowing attackers to trigger predictable hash collisions.
What type of attack does CVE-2011-5035 facilitate?
CVE-2011-5035 facilitates collision-based attacks that can manipulate input parameters to execute malicious actions.