Bug 767871 (CVE-2011-4610) - CVE-2011-4610 JBoss Web remote denial of service when surrogate pair character is placed at buffer boundary
Summary: CVE-2011-4610 JBoss Web remote denial of service when surrogate pair characte...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2011-4610
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 769147
Blocks: 767873 795277 810065
TreeView+ depends on / blocked
 
Reported: 2011-12-15 04:13 UTC by David Jorm
Modified: 2023-05-12 22:07 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-03-07 06:50:31 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2012:0074 0 normal SHIPPED_LIVE Important: jbossweb security update 2012-02-01 04:03:17 UTC
Red Hat Product Errata RHSA-2012:0075 0 normal SHIPPED_LIVE Important: jbossweb security update 2012-02-01 04:03:13 UTC
Red Hat Product Errata RHSA-2012:0076 0 normal SHIPPED_LIVE Important: jbossweb security update 2012-02-01 04:03:06 UTC
Red Hat Product Errata RHSA-2012:0077 0 normal SHIPPED_LIVE Important: jbossweb security update 2012-02-01 04:03:02 UTC
Red Hat Product Errata RHSA-2012:0078 0 normal SHIPPED_LIVE Important: JBoss Communications Platform 5.1.3 update 2012-02-01 04:02:57 UTC
Red Hat Product Errata RHSA-2012:0325 0 normal SHIPPED_LIVE Important: jbossweb security update 2012-02-22 10:10:34 UTC

Description David Jorm 2011-12-15 04:13:51 UTC 
JBoss Web will enter into an infinite loop when a surrogate pair character is placed at the boundary of an internal buffer. A remote attacker could exploit this flaw to trigger a denial-of-service attack against a JBoss Web server that is hosting applications with UTF-8 character encoding enabled, or that will include user-supplied UTF-8 strings in a response.
Comment 7 David Jorm 2012-01-06 05:04:13 UTC 
Acknowledgements:

Red Hat would like to thank NTT OSSC for reporting this issue.
Comment 8 errata-xmlrpc 2012-01-31 23:06:19 UTC 
This issue has been addressed in following products:

  JBoss Communications Platform 5.1.3

Via RHSA-2012:0078 https://rhn.redhat.com/errata/RHSA-2012-0078.html
Comment 9 errata-xmlrpc 2012-01-31 23:06:47 UTC 
This issue has been addressed in following products:

   JBoss Enterprise Web Platform 5.1.2

Via RHSA-2012:0077 https://rhn.redhat.com/errata/RHSA-2012-0077.html
Comment 10 errata-xmlrpc 2012-01-31 23:07:09 UTC 
This issue has been addressed in following products:

  JBEWP 5 for RHEL 6
  JBEWP 5 for RHEL 4
  JBEWP 5 for RHEL 5

Via RHSA-2012:0076 https://rhn.redhat.com/errata/RHSA-2012-0076.html
Comment 11 errata-xmlrpc 2012-01-31 23:07:29 UTC 
This issue has been addressed in following products:

  JBoss Enterprise Application Platform 5.1.2

Via RHSA-2012:0075 https://rhn.redhat.com/errata/RHSA-2012-0075.html
Comment 12 errata-xmlrpc 2012-01-31 23:07:55 UTC 
This issue has been addressed in following products:

  JBEAP 5 for RHEL 6
  JBEAP 5 for RHEL 4
  JBEAP 5 for RHEL 5

Via RHSA-2012:0074 https://rhn.redhat.com/errata/RHSA-2012-0074.html
Comment 13 errata-xmlrpc 2012-02-22 05:11:26 UTC 
This issue has been addressed in following products:

JBoss Enterprise BRMS Platform 5.2.0, JBoss Enterprise Portal Platform 5.2.0 and JBoss Enterprise SOA Platform 5.2.0

Via RHSA-2012:0325 https://rhn.redhat.com/errata/RHSA-2012-0325.html
Note You need to log in before you can comment on or make changes to this bug.