CVE-2012-2739
First published: Tue Nov 01 2011(Updated: )
Julian Wälde and Alexander Klink reported that the String.hashCode() hash function is not sufficiently collision resistant. hashCode() value is used in the implementations of HashMap and Hashtable classes: <a href="http://docs.oracle.com/javase/6/docs/api/java/util/HashMap.html">http://docs.oracle.com/javase/6/docs/api/java/util/HashMap.html</a> <a href="http://docs.oracle.com/javase/6/docs/api/java/util/Hashtable.html">http://docs.oracle.com/javase/6/docs/api/java/util/Hashtable.html</a> A specially-crafted set of keys could trigger hash function collisions, which can degrade performance of HashMap or Hashtable by changing hash table operations complexity from an expected/average O(1) to the worst case O(n). Reporters were able to find colliding strings efficiently using equivalent substrings and meet in the middle techniques. This problem can be used to start a denial of service attack against Java applications that use untrusted inputs as HashMap or Hashtable keys. An example of such application is web application server (such as tomcat, see <a class="bz_bug_link bz_status_CLOSED bz_closed bz_public " title="CLOSED ERRATA - CVE-2011-4858 tomcat: hash table collisions CPU usage DoS (oCERT-2011-003)" href="show_bug.cgi?id=750521">bug #750521</a>) that may fill hash tables with data from HTTP request (such as GET or POST parameters). A remote attack could use that to make JVM use excessive amount of CPU time by sending a POST request with large amount of parameters which hash to the same value. This problem is similar to the issue that was previously reported for and fixed in e.g. perl: <a href="http://www.cs.rice.edu/~scrosby/hash/CrosbyWallach_UsenixSec2003.pdf">http://www.cs.rice.edu/~scrosby/hash/CrosbyWallach_UsenixSec2003.pdf</a>
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Oracle JDK 6 | <=1.7.0 | |
| Oracle JDK 6 | =1.7.0 | |
| Oracle JDK 6 | =1.7.0-update1 | |
| Oracle JDK 6 | =1.7.0-update2 | |
| Oracle JDK 6 | =1.7.0-update3 | |
| Oracle JDK 6 | =1.7.0-update4 | |
| Oracle Java Runtime Environment (JRE) | <=1.7.0 | |
| Oracle Java Runtime Environment (JRE) | =1.7.0 | |
| Oracle Java Runtime Environment (JRE) | =1.7.0-update1 | |
| Oracle Java Runtime Environment (JRE) | =1.7.0-update2 | |
| Oracle Java Runtime Environment (JRE) | =1.7.0-update3 | |
| Oracle Java Runtime Environment (JRE) | =1.7.0-update4 | |
| OpenJDK 17 | <=1.7.0 | |
| OpenJDK 17 | =1.6.0 | |
| OpenJDK 17 | =1.8.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://armoredbarista.blogspot.de/2012/02/investigating-hashdos-issue.html
- http://mail.openjdk.java.net/pipermail/core-libs-dev/2012-May/010238.html
- http://www.kb.cert.org/vuls/id/903934
- http://www.nruns.com/_downloads/advisory28122011.pdf
- http://www.ocert.org/advisories/ocert-2011-003.html
- http://www.openwall.com/lists/oss-security/2012/06/15/12
- http://www.openwall.com/lists/oss-security/2012/06/17/1
- https://bugzilla.redhat.com/show_bug.cgi?id=750533
Frequently Asked Questions
What is the severity of CVE-2012-2739?
CVE-2012-2739 has been assigned a medium severity rating due to its potential for denial of service attacks through hash collisions.
How do I fix CVE-2012-2739?
To remediate CVE-2012-2739, upgrade to the latest version of Oracle JDK, Oracle JRE, or OpenJDK that is not affected by this vulnerability.
What are the potential impacts of CVE-2012-2739?
CVE-2012-2739 could allow attackers to execute denial of service attacks by exploiting hash collision vulnerabilities, which could degrade application performance.
Which software versions are affected by CVE-2012-2739?
CVE-2012-2739 affects Oracle JDK versions 1.7.0 and earlier, along with Oracle JRE and OpenJDK versions up to 1.7.0.
Can CVE-2012-2739 be exploited remotely?
Yes, CVE-2012-2739 can be exploited remotely if an application uses the vulnerable String.hashCode() method in its data structure handling.
- collector/redhat-bugzilla
- alias/CVE-2012-2739
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/description
- agent/event
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/oracle
- canonical/oracle jdk 6
- version/oracle jdk 6/1.7.0
- version/oracle jdk 6/1.7.0-update1
- version/oracle jdk 6/1.7.0-update2
- version/oracle jdk 6/1.7.0-update3
- version/oracle jdk 6/1.7.0-update4
- canonical/oracle java runtime environment (jre)
- version/oracle java runtime environment (jre)/1.7.0
- version/oracle java runtime environment (jre)/1.7.0-update1
- version/oracle java runtime environment (jre)/1.7.0-update2
- version/oracle java runtime environment (jre)/1.7.0-update3
- version/oracle java runtime environment (jre)/1.7.0-update4
- canonical/openjdk 17
- version/openjdk 17/1.7.0
- version/openjdk 17/1.6.0
- version/openjdk 17/1.8.0