Interstage Application Server: JRE vulnerability on parsing floating-point strings (CVE-2010-4476). May 30th, 2011

Notes on using this web page

1. Description

There is a problem that JRE hangs when converting a specific floating point (hereafter FP) string such as "2.2250738585072012e-308" to a binary floating-point number by java.lang.Double class. It makes the process using java.lang.Double go into an infinite loop.

This problem affects a system in the following case:

1. The application gets a FP number string and converts it to a binary format, and
2. The application is opened to the publc, and an attacker can send the malicious data to it.

Servlet service satisfies the case a). Therefore, a Java application which uses Servlet service is affected by this vulnerability if it receives the data. Then, such an application is vulnerable with or without the above case b).

2. Impact

If a system is opened to anyone on the Internet, an attacker is able to make the system go into an infinite loop causing in Denial of Service.

If an application server which is opened on the Internet (or as a public service) uses Servret service, the Servret service might get into a Denial of Service condition.

However, if the system is opened to the limited clients, the impact might be less.

When this problem happens, kill the Java process.

3. Affected systems and corresponding action

3-1. Affected systems:

GP7000F, PRIMEPOWER, PRIMERGY, GP5000, CELSIUS, FMV, AT compatible machine, PRIMEQUEST, SPARC Enterprise

3-2. Affected products and required patch

* For the solution, please refer to "3-3. Workaround".

Note: Determining the affected product
To check the software version, refer to the "FUJITSU SOFTWARE RELEASE GUIDE" supplied with the product.

• In Solaris
  To determine if the package is installed, the following command may be used:
      pkginfo -l 'Package name'
  The version of Java can be determined as follows:
      /opt/FJSVawjbk/{jdk|jre}{12c|12e|13|14|5|6}/bin/java -version
• In Linux
  To determine if the package is installed, the following command may be used:
      rpm -qa | grep 'Package name'
  The version of Java can be determined as follows:
      /opt/FJSVawjbk/{jdk|jre}{13|14|5|6}/bin/java -version
• In Windows
  The version of Java can be determined as follows:
  < JDK/JRE installed folder >\bin\java -version

3-3. Workaround

Apply a tool to update the JDK/JRE which has the vulnerability.
For getting the tool, please contact a Fujitsu system engineer or your partner(s). 

[Note]
If this problem has been detoured by the workaround which was described in this security bulletin of the initial release, that is, using Oracle FPUpdater Tool, it is not necessary to use this tool.

If Oracle FPUpdater Tool has never been used for this problem in your system, please only use the tool which is provided in this security bulletin of the second release. It is not necessary to use Oracle FPUpdater Tool.

4. Related information

1. CVE-2010-4476
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=2010-4476
2. Oracle Security Alert for CVE-2010-4476
   http://www.oracle.com/technetwork/topics/security/alert-cve-2010-4476-305811.html

5. Revision history

• May 30th, 2011: Second release
  • 3-3. Workaround
    • Remove the description about Oracle FPUpdater tool.
    • Add the description about Fujitsu tool.
• April 20th, 2011: Initial release