JVM Security Vulnerability:Java Hangs When Converting 2.22507

38585072012e-308

Java Hangs When Converting 2.2250738585072012e-308

Compile this program and run it; the program will hang

Try to compile this program; the compiler will hang:

• Affected Products– Java SE

• JDK and JRE 6 update 23 and earlier• JDK 5.0 Update 27 and earlier• SDK 1.4.2_29 and earlier

– JRockit• R27.6.8 and earlier (JDK/JRE 1.4.2,5,6)• R28.1.1 and earlier (JDK/JRE 5,6)

• class runhang { public static void main(String[] args) { System.out.println("Test:"); double d = Double.parseDouble("2.2250738585072012e-308"); System.out.println("Value: " + d); } }

• class compilehang { public static void main(String[] args) { double d = 2.2250738585072012e-308; System.out.println("Value: " + d); } }

• 1. Update the Java Runtime Environment (JRE). The JRE provides the libraries, the Java

• Virtual Machine, and other components to run applets and applications.

• 2. Update your application server's Java Developer Kit (J

• Summary: This old bug says that Double.parseDouble(s) hangs for decimal strings in range (Double.MIN_NORMAL-0.5*Double.MIN_VALUE,Double.MIN_NORMAL), and returns incorrect result for decimal string Double.MIN_NORMAL-0.5*Double.MIN_VALUE.

• This bug 4421494

• This is because current code in FloatingDecimal.doubleValue() incorrectly defines the condition when nextDown(dValue) - dValue == -0.5*ulp(dValue). The current code considers that these are all numbers 2^n which are represented as normal doubles, and nextDown(dValue) - dValue == -1.0*ulp(dValue) for other doubles (subnormal or not 2-powers). However, this is not correct for dValue == Double.MIN_NORMAL, because nextDown(Double.MIN_NORMAL) - Double.MIN_NORMAL == -1.0*ulp(Double.MIN_NORMAL)

Affected product releases and versions:

Java SE

JDK and JRE 6 Update 23 and earlier for Windows, Solaris, and Linux

JDK 5.0 Update 27 and earlier for Solaris 9

SDK 1.4.2_29 and earlier for Solaris 8

Java for Business

JDK and JRE 6 Update 23 and earlier for Windows, Solaris and Linux

JDK and JRE 5.0 Update 27 and earlier for Windows, Solaris and Linux

SDK and JRE 1.4.2_29 and earlier for Windows, Solaris and Linux

JRockit

R27.6.8 and earlier (JDK/JRE 1.4.2, 5, 6)

R28.1.1 and earlier (JDK/JRE 5, 6)

• Affected Tomcat versions:

• Tomcat 7 earlier than 7.0.8

• Tomcat 6 earlier than 6.0.32

• Tomcat 5.5 earlier than 5.5.33

• Severity and impact• High severity• The vulnerability allows an adversary to trivially

execute a *denial of service attack* removing target CAS-running Tomcat instances from service.

• No end user data is exposed. No passwords are compromised. No system access is illicitly granted.

• The only impact of this vulnerability is to cause service outages.

• Manually updating the JVM• Oracle has released a tool for updating affected

JVMs. Note however that this tool breaks auto-updating of the JVM, so this tool should only be used in environments that are manually maintained (and in such environments, it may be cleaner and simpler to simply replace the installed ad-hoc JVM with the Update 24 release rather than patching it in place.)

• Oracle fpupdater tool

• Introduction• The FPUpdater tool allows you to update installe

d Java Development Kit (JDK) and Java Runtime Environment (JRE) software to address the hang that occurs when parsing strings like "2.2250738585072012e-308" to a binary floating point number, as described in Security Alert for CVE-2010-4476 Released.

•

• System Requirements• The FPUpdater tool is recommended for the Oracle JRE releases s

hown in the following table:• JRE/JDK ReleaseCommentsJ2SE 1.4.2Required for updates prior

to, and including, 1.4.2_29J2SE 5.0Required for updates prior to, and including, 5.0u27J2SE for Embedded 5.0Required for updates prior to, and including, 5.0u27Java SE 6Required for updates prior to, and including, 6u23Java SE for Embedded 6Required for updates prior to, and including, 6u23Java Real-Time System 2Required for updates prior to, and including, 2.2u1JRockit R27Required for updates prior to, and including, R27.6.8JRockit R28Required for updates prior to, and including, R28.1.1

• As a result of running the tool, the <JRE_HOME>/lib/rt.jar file is modified and the tool leaves behind the following files:

•     <JRE_HOME>/lib/rt.jar.fpupdater   Copy of rt.jar before the fix.    <JRE_HOME>/lib/.fpupdater.log       Zero-length file indicating that the update has taken place.

• If either of these two files are already present, the tool will not perform the update and exits with a warning.

• Run the fpupdater tool with the following command.• <JRE_HOME>/bin/java -jar fpupdater.jar -u -v • C:\Program Files\Java\jre6\bin\java

要先關閉所有 JAVA程式