|
Sun Java XSL Template Parsing Denial of Service
|
|
Secunia Advisory:
|
SA9784
|
|
|
Release Date:
|
2003-09-19
|
|
Popularity:
|
8,287 views
|
|
|
Critical:
|
Less critical
|
|
Impact:
|
DoS
|
|
Where:
|
Local system
|
|
Solution Status:
|
Unpatched
|
|
| Software: | Sun Java JRE 1.3.x
Sun Java JRE 1.4.x
Sun Java SDK 1.3.x
Sun Java SDK 1.4.x
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
Description:
A vulnerability has been reported in Java allowing malicious users to cause a Denial of Service.
The problem is that some sun classes fail to handle certain parameters properly. One vulnerable class is "sun.misc.MessageUtils.toStdout", which can't handle null objects. This could be exploited by malicious users, who are able to make a Java based application parse a XSL template, to cause a Denial of Service on JVM.
The vulnerability has been reported to affect all current versions of Java.
Solution:
Restrict access so that only trusted users can access applications, which parse XSL templates.
Provided and/or discovered by:
Marc Schoenefeld
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
