CVE-2012-2739
First published: Tue Nov 01 2011(Updated: )
Julian Wälde and Alexander Klink reported that the String.hashCode() hash function is not sufficiently collision resistant. hashCode() value is used in the implementations of HashMap and Hashtable classes: <a href="http://docs.oracle.com/javase/6/docs/api/java/util/HashMap.html">http://docs.oracle.com/javase/6/docs/api/java/util/HashMap.html</a> <a href="http://docs.oracle.com/javase/6/docs/api/java/util/Hashtable.html">http://docs.oracle.com/javase/6/docs/api/java/util/Hashtable.html</a> A specially-crafted set of keys could trigger hash function collisions, which can degrade performance of HashMap or Hashtable by changing hash table operations complexity from an expected/average O(1) to the worst case O(n). Reporters were able to find colliding strings efficiently using equivalent substrings and meet in the middle techniques. This problem can be used to start a denial of service attack against Java applications that use untrusted inputs as HashMap or Hashtable keys. An example of such application is web application server (such as tomcat, see <a class="bz_bug_link bz_status_CLOSED bz_closed bz_public " title="CLOSED ERRATA - CVE-2011-4858 tomcat: hash table collisions CPU usage DoS (oCERT-2011-003)" href="show_bug.cgi?id=750521">bug #750521</a>) that may fill hash tables with data from HTTP request (such as GET or POST parameters). A remote attack could use that to make JVM use excessive amount of CPU time by sending a POST request with large amount of parameters which hash to the same value. This problem is similar to the issue that was previously reported for and fixed in e.g. perl: <a href="http://www.cs.rice.edu/~scrosby/hash/CrosbyWallach_UsenixSec2003.pdf">http://www.cs.rice.edu/~scrosby/hash/CrosbyWallach_UsenixSec2003.pdf</a>
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Oracle JDK | <=1.7.0 | |
| Oracle JDK | =1.7.0 | |
| Oracle JDK | =1.7.0-update1 | |
| Oracle JDK | =1.7.0-update2 | |
| Oracle JDK | =1.7.0-update3 | |
| Oracle JDK | =1.7.0-update4 | |
| Oracle JRE | <=1.7.0 | |
| Oracle JRE | =1.7.0 | |
| Oracle JRE | =1.7.0-update1 | |
| Oracle JRE | =1.7.0-update2 | |
| Oracle JRE | =1.7.0-update3 | |
| Oracle JRE | =1.7.0-update4 | |
| Oracle OpenJDK | <=1.7.0 | |
| Oracle OpenJDK | =1.6.0 | |
| Oracle OpenJDK | =1.8.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://armoredbarista.blogspot.de/2012/02/investigating-hashdos-issue.html
- http://mail.openjdk.java.net/pipermail/core-libs-dev/2012-May/010238.html
- http://www.kb.cert.org/vuls/id/903934
- http://www.nruns.com/_downloads/advisory28122011.pdf
- http://www.ocert.org/advisories/ocert-2011-003.html
- http://www.openwall.com/lists/oss-security/2012/06/15/12
- http://www.openwall.com/lists/oss-security/2012/06/17/1
- https://bugzilla.redhat.com/show_bug.cgi?id=750533
- collector/redhat-bugzilla
- alias/CVE-2012-2739
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/description
- agent/event
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/oracle
- canonical/oracle jdk
- version/oracle jdk/1.7.0
- version/oracle jdk/1.7.0-update1
- version/oracle jdk/1.7.0-update2
- version/oracle jdk/1.7.0-update3
- version/oracle jdk/1.7.0-update4
- canonical/oracle jre
- version/oracle jre/1.7.0
- version/oracle jre/1.7.0-update1
- version/oracle jre/1.7.0-update2
- version/oracle jre/1.7.0-update3
- version/oracle jre/1.7.0-update4
- canonical/oracle openjdk
- version/oracle openjdk/1.7.0
- version/oracle openjdk/1.6.0
- version/oracle openjdk/1.8.0