CVE-2012-5373: Medium severity oracle java se 7 vulnerability
A denial of service flaw was found in the Murmur hash function implementation, as being used by various Java implementations. A specially-crafted set of keys could trigger Murmur hash function collisions, which degrade hash table items insert performance by changing hash table operations complexity from an expected/average O(n) to the worst case O(n^2). Reporters were able to find colliding strings efficiently using equivalent substrings.
As various web application frameworks for Java automatically pre-fill certain arrays with data from the HTTP request (such as GET or POST parameters) for Java web applications, a remote attacker could use this flaw to make the Java virtual machine to use an excessive amount of CPU time by sending a POST request with a large number parameters which hash to the same value.
A different vulnerability than CVE-2012-2739.
References: [1] http://www.openwall.com/lists/oss-security/2012/11/23/4 [2] http://www.ocert.org/advisories/ocert-2012-001.html [3] http://2012.appsec-forum.ch/conferences/#c17 [4] https://www.131002.net/data/talks/appsec12slides.pdf [5] http://asfws12.files.wordpress.com/2012/11/asfws2012-jeanphilippeaumasson-martinbosslet-hashfloodingdosreloaded.pdf
Other sources
Oracle Java SE 7 and earlier, and OpenJDK 7 and earlier, computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table, as demonstrated by a universal multicollision attack against the MurmurHash3 algorithm, a different vulnerability than CVE-2012-2739.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-5373?
CVE-2012-5373 is considered a denial of service vulnerability that can significantly impact performance.
How do I fix CVE-2012-5373?
To fix CVE-2012-5373, upgrade to a version of Oracle JDK, JRE, or OpenJDK that is later than 1.7.0.
What applications are affected by CVE-2012-5373?
CVE-2012-5373 affects various Java implementations that utilize the Murmur hash function, including Oracle JDK, JRE, and OpenJDK.
What kind of attack does CVE-2012-5373 facilitate?
CVE-2012-5373 allows an attacker to create specially-crafted keys that can cause hash collisions, leading to denial of service.
Is there a known exploit for CVE-2012-5373?
While there may be theoretical attacks based on the vulnerability, no specific known exploits have been widely published for CVE-2012-5373.