Executive Summary

Informations
NameCVE-2010-4476First vendor Publication2011-02-17
VendorCveLast vendor Modification2012-11-05

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:P)
Cvss Base Score5Attack RangeNetwork
Cvss Impact Score2.9Attack ComplexityLow
Cvss Expoit Score10AuthentificationNone Required
Calculate full CVSS 2.0 Vectors scores

Detail

The Double.parseDouble method in Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 and earlier, as used in OpenJDK, Apache, JBossweb, and other products, allows remote attackers to cause a denial of service via a crafted string that triggers an infinite loop of estimations during conversion to a double-precision binary floating-point number, as demonstrated using 2.2250738585072012e-308.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4476

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:14589
 
Oval ID: oval:org.mitre.oval:def:14589
Title: HP-UX Apache Running Tomcat Servlet Engine, Remote Information Disclosure, Authentication Bypass, Cross-Site Scripting (XSS), Unauthorized Access, Denial of Service (DoS)
Description: The Double.parseDouble method in Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 and earlier, as used in OpenJDK, Apache, JBossweb, and other products, allows remote attackers to cause a denial of service via a crafted string that triggers an infinite loop of estimations during conversion to a double-precision binary floating-point number, as demonstrated using 2.2250738585072012e-308.
Family: unix Class: vulnerability
Reference(s): CVE-2010-4476
Version: 4
Platform(s): HP-UX 11
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:14328
 
Oval ID: oval:org.mitre.oval:def:14328
Title: The Double.parseDouble method in Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 and earlier, as used in OpenJDK, Apache, JBossweb, and other products, allows remote attackers to cause a denial of service via a crafted string that triggers an infinite loop of estimations during conversion to a double-precision binary floating-point number, as demonstrated using 2.2250738585072012e-308.
Description: The Double.parseDouble method in Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 and earlier, as used in OpenJDK, Apache, JBossweb, and other products, allows remote attackers to cause a denial of service via a crafted string that triggers an infinite loop of estimations during conversion to a double-precision binary floating-point number, as demonstrated using 2.2250738585072012e-308.
Family: windows Class: vulnerability
Reference(s): CVE-2010-4476
Version: 5
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Vista
Microsoft Windows 7
Microsoft Windows 8
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows Server 2012
Product(s): Java Development Kit
Java Runtime Environment
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:12745
 
Oval ID: oval:org.mitre.oval:def:12745
Title: HP-UX Apache Web Server, Remote Information Disclosure, Cross-Site Scripting (XSS), Denial of Service (DoS)
Description: The Double.parseDouble method in Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 and earlier, as used in OpenJDK, Apache, JBossweb, and other products, allows remote attackers to cause a denial of service via a crafted string that triggers an infinite loop of estimations during conversion to a double-precision binary floating-point number, as demonstrated using 2.2250738585072012e-308.
Family: unix Class: vulnerability
Reference(s): CVE-2010-4476
Version: 4
Platform(s): HP-UX 11
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:12662
 
Oval ID: oval:org.mitre.oval:def:12662
Title: HP-UX Running Java, Remote Execution of Arbitrary Code, Disclosure of Information, and Other Vulnerabilities
Description: The Double.parseDouble method in Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 and earlier, as used in OpenJDK, Apache, JBossweb, and other products, allows remote attackers to cause a denial of service via a crafted string that triggers an infinite loop of estimations during conversion to a double-precision binary floating-point number, as demonstrated using 2.2250738585072012e-308.
Family: unix Class: vulnerability
Reference(s): CVE-2010-4476
Version: 4
Platform(s): HP-UX 11
Product(s):
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application51
Application81
Application30

Open Source Vulnerability Database (OSVDB)

idDescription
70965Oracle Java SE / Java for Business Double.parseDouble Method Floating Point ...

Internal Sources (Detail)

SourceUrl
AIXAPARhttp://www-01.ibm.com/support/docview.wss?uid=swg1IZ94423
http://www-01.ibm.com/support/docview.wss?uid=swg1PM31983
CONFIRMhttp://blogs.oracle.com/security/2011/02/security_alert_for_cve-2010-44.html
http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_50985...
http://www-01.ibm.com/support/docview.wss?uid=swg21468358
http://www.ibm.com/support/docview.wss?uid=swg24029497
http://www.ibm.com/support/docview.wss?uid=swg24029498
http://www.oracle.com/technetwork/topics/security/alert-cve-2010-4476-305811....
http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.html
http://www.oracle.com/technetwork/topics/security/javacpufeb2011-304611.html
DEBIANhttp://www.debian.org/security/2011/dsa-2161
FEDORAhttp://lists.fedoraproject.org/pipermail/package-announce/2011-February/05392...
http://lists.fedoraproject.org/pipermail/package-announce/2011-February/05393...
HPhttp://marc.info/?l=bugtraq&m=129960314701922&w=2
http://marc.info/?l=bugtraq&m=129960314701922&w=2
http://marc.info/?l=bugtraq&m=130514352726432&w=2
http://marc.info/?l=bugtraq&m=130514352726432&w=2
http://marc.info/?l=bugtraq&m=131041767210772&w=2
http://marc.info/?l=bugtraq&m=131041767210772&w=2
http://marc.info/?l=bugtraq&m=132215163318824&w=2
http://marc.info/?l=bugtraq&m=132215163318824&w=2
http://www13.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02720715&...
http://www13.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02720715&...
MANDRIVAhttp://www.mandriva.com/security/advisories?name=MDVSA-2011:054
MISChttp://blog.fortify.com/blog/2011/02/08/Double-Trouble
http://www.exploringbinary.com/java-hangs-when-converting-2-2250738585072012e...
REDHAThttp://www.redhat.com/support/errata/RHSA-2011-0210.html
http://www.redhat.com/support/errata/RHSA-2011-0211.html
http://www.redhat.com/support/errata/RHSA-2011-0212.html
http://www.redhat.com/support/errata/RHSA-2011-0213.html
http://www.redhat.com/support/errata/RHSA-2011-0214.html
http://www.redhat.com/support/errata/RHSA-2011-0282.html
http://www.redhat.com/support/errata/RHSA-2011-0333.html
http://www.redhat.com/support/errata/RHSA-2011-0334.html
http://www.redhat.com/support/errata/RHSA-2011-0880.html
SECTRACKhttp://www.securitytracker.com/id?1025062
SECUNIAhttp://secunia.com/advisories/43048
http://secunia.com/advisories/43280
http://secunia.com/advisories/43295
http://secunia.com/advisories/43304
http://secunia.com/advisories/43333
http://secunia.com/advisories/43378
http://secunia.com/advisories/43400
http://secunia.com/advisories/43659
http://secunia.com/advisories/44954
http://secunia.com/advisories/45022
http://secunia.com/advisories/45555
http://secunia.com/advisories/49198
SUSEhttp://lists.opensuse.org/opensuse-security-announce/2011-05/msg00004.html
http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00010.html
VUPENhttp://www.vupen.com/english/advisories/2011/0365
http://www.vupen.com/english/advisories/2011/0377
http://www.vupen.com/english/advisories/2011/0379
http://www.vupen.com/english/advisories/2011/0422
http://www.vupen.com/english/advisories/2011/0434
http://www.vupen.com/english/advisories/2011/0605

Alert History

If you want to see full details history, please login or register.
0
1
DateInformations
2013-05-10 23:38:18
  • Multiple Updates
2012-11-07 05:19:55
  • Multiple Updates