SillyDog701

[Ramona]

SECUNIA ADVISORY ID:
SA17478

VERIFY ADVISORY:
http://secunia.com/advisories/17478/

CRITICAL:
Less critical

IMPACT:
DoS

WHERE:
>From remote

SOFTWARE:
Sun Java JRE 1.5.x / 5.x
http://secunia.com/product/4228/
Sun Java JRE 1.4.x
http://secunia.com/product/784/
Sun Java JRE 1.3.x
http://secunia.com/product/87/
Sun Java JDK 1.5.x
http://secunia.com/product/4621/
Sun Java SDK 1.3.x
http://secunia.com/product/1660/
Sun Java SDK 1.4.x
http://secunia.com/product/1661/

DESCRIPTION:
Marc Schoenefeld has reported a vulnerability in Sun Java Runtime
Environment (JRE), which can be exploited by malicious people to
cause a DoS (Denial of Service).

The vulnerability is caused due to an unspecified error in the
handling of serialized Java objects. This can be exploited to crash
the Java Virtual Machine (JVM) via an application deserializing
objects from untrusted sources.

The vulnerability has been reported in versions 1.4.2_08, 1.4.2_09,
and 1.5.0_05. Prior versions may also be affected.

SOLUTION:
The vulnerability will reportedly be fixed by the vendor in upcoming
releases for 1.3.x, 1.4.x, and 1.5.x.

Restrict applications from deserializing objects from untrusted
sources.

PROVIDED AND/OR DISCOVERED BY:
Marc Schoenefeld

UserAgent: Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.7.12) Gecko/20050915 Firefox/1.0.7 (ax)

[Antony]

SECUNIA ADVISORY ID:
SA17478

SOLUTION:
...

Restrict applications from deserializing objects from untrusted
sources.

Thanks Ramona for the heads-up.

I highly doubt Secunia's Solution is useful to most users.
How many people here know how to de-serialise objects in Java? and how many of us know how to restrict applications from doing so?

UserAgent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/416.11 (KHTML, like Gecko) Safari/416.12

[Ramona]

Thanks Antony, and I agree. Feel free to delete if you wish. I was just reading about serializing, and it's definitely over my head!

UserAgent: Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.7.12) Gecko/20050915 Firefox/1.0.7 (ax)