First published: Thu Sep 20 2012(Updated: )
A flaw was discovered in the SSL/TLS in JSSE component of OpenJDK, that allows malicious clients to make an SSL/TLS server use an excessive amount of CPU time by repeatedly sending ClientHello packets. Client can send pre-generated packet, causing the server to repeatedly perform expensive computations when generating ServerHello response. This flaw is similar to OpenSSL <a href="https://access.redhat.com/security/cve/CVE-2011-4619">CVE-2011-4619</a> (<a class="bz_bug_link bz_status_CLOSED bz_closed bz_public " title="CLOSED ERRATA - CVE-2011-4619 openssl: SGC restart DoS attack" href="show_bug.cgi?id=771780">bug #771780</a>), but the problem does not seem to be caused by an attempt to support server gated cryptography (SGC) and rather seems to be caused by an incorrect enforcing of the packet order during the SSL/TLS protocol handshake. Note that the attacker needs to keep connection open and keep re-sending ClientHello packets to keep server busy.
Credit: secalert_us@oracle.com
Affected Software | Affected Version | How to fix |
---|---|---|
Oracle JRE | =1.7.0 | |
Oracle JRE | =1.7.0-update1 | |
Oracle JRE | =1.7.0-update10 | |
Oracle JRE | =1.7.0-update11 | |
Oracle JRE | =1.7.0-update2 | |
Oracle JRE | =1.7.0-update3 | |
Oracle JRE | =1.7.0-update4 | |
Oracle JRE | =1.7.0-update5 | |
Oracle JRE | =1.7.0-update6 | |
Oracle JRE | =1.7.0-update7 | |
Oracle JRE | =1.7.0-update9 | |
Oracle JDK | =1.7.0 | |
Oracle JDK | =1.7.0-update1 | |
Oracle JDK | =1.7.0-update10 | |
Oracle JDK | =1.7.0-update11 | |
Oracle JDK | =1.7.0-update2 | |
Oracle JDK | =1.7.0-update3 | |
Oracle JDK | =1.7.0-update4 | |
Oracle JDK | =1.7.0-update5 | |
Oracle JDK | =1.7.0-update6 | |
Oracle JDK | =1.7.0-update7 | |
Oracle JDK | =1.7.0-update9 | |
Oracle JRE | =1.6.0-update22 | |
Oracle JRE | =1.6.0-update23 | |
Oracle JRE | =1.6.0-update24 | |
Oracle JRE | =1.6.0-update25 | |
Oracle JRE | =1.6.0-update26 | |
Oracle JRE | =1.6.0-update27 | |
Oracle JRE | =1.6.0-update29 | |
Oracle JRE | =1.6.0-update30 | |
Oracle JRE | =1.6.0-update31 | |
Oracle JRE | =1.6.0-update32 | |
Oracle JRE | =1.6.0-update33 | |
Oracle JRE | =1.6.0-update34 | |
Oracle JRE | =1.6.0-update35 | |
Oracle JRE | =1.6.0-update37 | |
Oracle JRE | =1.6.0-update38 | |
Sun JRE | =1.6.0 | |
Sun JRE | =1.6.0-update_1 | |
Sun JRE | =1.6.0-update_10 | |
Sun JRE | =1.6.0-update_11 | |
Sun JRE | =1.6.0-update_12 | |
Sun JRE | =1.6.0-update_13 | |
Sun JRE | =1.6.0-update_14 | |
Sun JRE | =1.6.0-update_15 | |
Sun JRE | =1.6.0-update_16 | |
Sun JRE | =1.6.0-update_17 | |
Sun JRE | =1.6.0-update_18 | |
Sun JRE | =1.6.0-update_19 | |
Sun JRE | =1.6.0-update_2 | |
Sun JRE | =1.6.0-update_20 | |
Sun JRE | =1.6.0-update_21 | |
Sun JRE | =1.6.0-update_3 | |
Sun JRE | =1.6.0-update_4 | |
Sun JRE | =1.6.0-update_5 | |
Sun JRE | =1.6.0-update_6 | |
Sun JRE | =1.6.0-update_7 | |
Sun JRE | =1.6.0-update_9 | |
Oracle JDK | =1.6.0-update22 | |
Oracle JDK | =1.6.0-update23 | |
Oracle JDK | =1.6.0-update24 | |
Oracle JDK | =1.6.0-update25 | |
Oracle JDK | =1.6.0-update26 | |
Oracle JDK | =1.6.0-update27 | |
Oracle JDK | =1.6.0-update29 | |
Oracle JDK | =1.6.0-update30 | |
Oracle JDK | =1.6.0-update31 | |
Oracle JDK | =1.6.0-update32 | |
Oracle JDK | =1.6.0-update33 | |
Oracle JDK | =1.6.0-update34 | |
Oracle JDK | =1.6.0-update35 | |
Oracle JDK | =1.6.0-update37 | |
Oracle JDK | =1.6.0-update38 | |
Sun JDK | =1.6.0 | |
Sun JDK | =1.6.0-update_10 | |
Sun JDK | =1.6.0-update_11 | |
Sun JDK | =1.6.0-update_12 | |
Sun JDK | =1.6.0-update_13 | |
Sun JDK | =1.6.0-update_14 | |
Sun JDK | =1.6.0-update_15 | |
Sun JDK | =1.6.0-update_16 | |
Sun JDK | =1.6.0-update_17 | |
Sun JDK | =1.6.0-update_18 | |
Sun JDK | =1.6.0-update_19 | |
Sun JDK | =1.6.0-update_20 | |
Sun JDK | =1.6.0-update_21 | |
Sun JDK | =1.6.0-update_3 | |
Sun JDK | =1.6.0-update_4 | |
Sun JDK | =1.6.0-update_5 | |
Sun JDK | =1.6.0-update_6 | |
Sun JDK | =1.6.0-update_7 | |
Sun JDK | =1.6.0-update1 | |
Sun JDK | =1.6.0-update1_b06 | |
Sun JDK | =1.6.0-update2 | |
Oracle JRE | =1.5.0-update36 | |
Oracle JRE | =1.5.0-update38 | |
Sun JRE | =1.5.0 | |
Sun JRE | =1.5.0-update1 | |
Sun JRE | =1.5.0-update10 | |
Sun JRE | =1.5.0-update11 | |
Sun JRE | =1.5.0-update12 | |
Sun JRE | =1.5.0-update13 | |
Sun JRE | =1.5.0-update14 | |
Sun JRE | =1.5.0-update15 | |
Sun JRE | =1.5.0-update16 | |
Sun JRE | =1.5.0-update17 | |
Sun JRE | =1.5.0-update18 | |
Sun JRE | =1.5.0-update19 | |
Sun JRE | =1.5.0-update2 | |
Sun JRE | =1.5.0-update20 | |
Sun JRE | =1.5.0-update21 | |
Sun JRE | =1.5.0-update22 | |
Sun JRE | =1.5.0-update23 | |
Sun JRE | =1.5.0-update24 | |
Sun JRE | =1.5.0-update25 | |
Sun JRE | =1.5.0-update26 | |
Sun JRE | =1.5.0-update27 | |
Sun JRE | =1.5.0-update28 | |
Sun JRE | =1.5.0-update29 | |
Sun JRE | =1.5.0-update3 | |
Sun JRE | =1.5.0-update31 | |
Sun JRE | =1.5.0-update33 | |
Sun JRE | =1.5.0-update4 | |
Sun JRE | =1.5.0-update5 | |
Sun JRE | =1.5.0-update6 | |
Sun JRE | =1.5.0-update7 | |
Sun JRE | =1.5.0-update8 | |
Sun JRE | =1.5.0-update9 | |
Oracle JDK | =1.5.0-update36 | |
Oracle JDK | =1.5.0-update38 | |
Sun JDK | =1.5.0 | |
Sun JDK | =1.5.0-update1 | |
Sun JDK | =1.5.0-update10 | |
Sun JDK | =1.5.0-update11 | |
Sun JDK | =1.5.0-update11_b03 | |
Sun JDK | =1.5.0-update12 | |
Sun JDK | =1.5.0-update13 | |
Sun JDK | =1.5.0-update14 | |
Sun JDK | =1.5.0-update15 | |
Sun JDK | =1.5.0-update16 | |
Sun JDK | =1.5.0-update17 | |
Sun JDK | =1.5.0-update18 | |
Sun JDK | =1.5.0-update19 | |
Sun JDK | =1.5.0-update2 | |
Sun JDK | =1.5.0-update20 | |
Sun JDK | =1.5.0-update21 | |
Sun JDK | =1.5.0-update22 | |
Sun JDK | =1.5.0-update23 | |
Sun JDK | =1.5.0-update24 | |
Sun JDK | =1.5.0-update25 | |
Sun JDK | =1.5.0-update26 | |
Sun JDK | =1.5.0-update27 | |
Sun JDK | =1.5.0-update28 | |
Sun JDK | =1.5.0-update29 | |
Sun JDK | =1.5.0-update3 | |
Sun JDK | =1.5.0-update31 | |
Sun JDK | =1.5.0-update33 | |
Sun JDK | =1.5.0-update4 | |
Sun JDK | =1.5.0-update5 | |
Sun JDK | =1.5.0-update6 | |
Sun JDK | =1.5.0-update7 | |
Sun JDK | =1.5.0-update7_b03 | |
Sun JDK | =1.5.0-update8 | |
Sun JDK | =1.5.0-update9 | |
Oracle JRE | <=1.4.2_40 | |
Oracle JRE | =1.4.2_38 | |
Sun JRE | =1.4.2 | |
Sun JRE | =1.4.2_1 | |
Sun JRE | =1.4.2_2 | |
Sun JRE | =1.4.2_3 | |
Sun JRE | =1.4.2_4 | |
Sun JRE | =1.4.2_5 | |
Sun JRE | =1.4.2_6 | |
Sun JRE | =1.4.2_7 | |
Sun JRE | =1.4.2_8 | |
Sun JRE | =1.4.2_9 | |
Sun JRE | =1.4.2_10 | |
Sun JRE | =1.4.2_11 | |
Sun JRE | =1.4.2_12 | |
Sun JRE | =1.4.2_13 | |
Sun JRE | =1.4.2_14 | |
Sun JRE | =1.4.2_15 | |
Sun JRE | =1.4.2_16 | |
Sun JRE | =1.4.2_17 | |
Sun JRE | =1.4.2_18 | |
Sun JRE | =1.4.2_19 | |
Sun JRE | =1.4.2_20 | |
Sun JRE | =1.4.2_21 | |
Sun JRE | =1.4.2_22 | |
Sun JRE | =1.4.2_23 | |
Sun JRE | =1.4.2_24 | |
Sun JRE | =1.4.2_25 | |
Sun JRE | =1.4.2_26 | |
Sun JRE | =1.4.2_27 | |
Sun JRE | =1.4.2_28 | |
Sun JRE | =1.4.2_29 | |
Sun JRE | =1.4.2_30 | |
Sun JRE | =1.4.2_31 | |
Sun JRE | =1.4.2_32 | |
Sun JRE | =1.4.2_33 | |
Sun JRE | =1.4.2_34 | |
Sun JRE | =1.4.2_35 | |
Sun JRE | =1.4.2_36 | |
Sun JRE | =1.4.2_37 | |
Oracle JDK | <=1.4.2_40 | |
Oracle JDK | =1.4.2_38 | |
Sun JDK | =1.4.2 | |
Sun JDK | =1.4.2_1 | |
Sun JDK | =1.4.2_2 | |
Sun JDK | =1.4.2_3 | |
Sun JDK | =1.4.2_4 | |
Sun JDK | =1.4.2_5 | |
Sun JDK | =1.4.2_6 | |
Sun JDK | =1.4.2_7 | |
Sun JDK | =1.4.2_8 | |
Sun JDK | =1.4.2_9 | |
Sun JDK | =1.4.2_10 | |
Sun JDK | =1.4.2_11 | |
Sun JDK | =1.4.2_12 | |
Sun JDK | =1.4.2_13 | |
Sun JDK | =1.4.2_14 | |
Sun JDK | =1.4.2_15 | |
Sun JDK | =1.4.2_16 | |
Sun JDK | =1.4.2_17 | |
Sun JDK | =1.4.2_18 | |
Sun JDK | =1.4.2_19 | |
Sun JDK | =1.4.2_22 | |
Sun JDK | =1.4.2_23 | |
Sun JDK | =1.4.2_25 | |
Sun JDK | =1.4.2_26 | |
Sun JDK | =1.4.2_27 | |
Sun JDK | =1.4.2_28 | |
Sun JDK | =1.4.2_29 | |
Sun JDK | =1.4.2_30 | |
Sun JDK | =1.4.2_31 | |
Sun JDK | =1.4.2_32 | |
Sun JDK | =1.4.2_33 | |
Sun JDK | =1.4.2_34 | |
Sun JDK | =1.4.2_35 | |
Sun JDK | =1.4.2_36 | |
Sun JDK | =1.4.2_37 | |
redhat/icedtea6 | <1.11.6 | 1.11.6 |
redhat/icedtea6 | <1.12.1 | 1.12.1 |
redhat/icedtea7 | <2.1.5 | 2.1.5 |
redhat/icedtea7 | <2.2.5 | 2.2.5 |
redhat/icedtea7 | <2.3.6 | 2.3.6 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.