JVM Security Vulnerability:Java Hangs When Converting 2.2250738585072012e-308

1. JVM Security Vulnerability:Java Hangs When Converting 2.2250738585072012e-308

2. Java Hangs When Converting 2.2250738585072012e-308 Compile this program and run it; the program will hang Try to compile this program; the compiler will hang:

4. Affected Products • Java SE • JDK and JRE 6 update 23 and earlier • JDK 5.0 Update 27 and earlier • SDK 1.4.2_29 and earlier • JRockit • R27.6.8 and earlier (JDK/JRE 1.4.2,5,6) • R28.1.1 and earlier (JDK/JRE 5,6)

5. class runhang { public static void main(String[] args) { System.out.println("Test:"); double d = Double.parseDouble("2.2250738585072012e-308"); System.out.println("Value: " + d); } } • class compilehang { public static void main(String[] args) { double d = 2.2250738585072012e-308; System.out.println("Value: " + d); } }

6. 1. Update the Java Runtime Environment (JRE). The JRE provides the libraries, the Java • Virtual Machine, and other components to run applets and applications. • 2. Update your application server's Java Developer Kit (J • Summary: This old bug says that Double.parseDouble(s) hangs for decimal strings in range (Double.MIN_NORMAL-0.5*Double.MIN_VALUE,Double.MIN_NORMAL), and returns incorrect result for decimal string Double.MIN_NORMAL-0.5*Double.MIN_VALUE. • This bug 4421494

7. This is because current code in FloatingDecimal.doubleValue() incorrectly defines the condition when nextDown(dValue) - dValue == -0.5*ulp(dValue). The current code considers that these are all numbers 2^n which are represented as normal doubles, and nextDown(dValue) - dValue == -1.0*ulp(dValue) for other doubles (subnormal or not 2-powers). However, this is not correct for dValue == Double.MIN_NORMAL, because nextDown(Double.MIN_NORMAL) - Double.MIN_NORMAL == -1.0*ulp(Double.MIN_NORMAL)

8. Affected product releases and versions:

9. Affected Tomcat versions: • Tomcat 7 earlier than 7.0.8 • Tomcat 6 earlier than 6.0.32 • Tomcat 5.5 earlier than 5.5.33

10. Severity and impact • High severity • The vulnerability allows an adversary to trivially execute a *denial of service attack* removing target CAS-running Tomcat instances from service. • No end user data is exposed. No passwords are compromised. No system access is illicitly granted. • The only impact of this vulnerability is to cause service outages.

11. Manually updating the JVM • Oracle has released a tool for updating affected JVMs. Note however that this tool breaks auto-updating of the JVM, so this tool should only be used in environments that are manually maintained (and in such environments, it may be cleaner and simpler to simply replace the installed ad-hoc JVM with the Update 24 release rather than patching it in place.) • Oracle fpupdater tool

12. Introduction • The FPUpdater tool allows you to update installed Java Development Kit (JDK) and Java Runtime Environment (JRE) software to address the hang that occurs when parsing strings like "2.2250738585072012e-308" to a binary floating point number, as described in Security Alert for CVE-2010-4476 Released.

13. System Requirements • The FPUpdater tool is recommended for the Oracle JRE releases shown in the following table: • JRE/JDK ReleaseCommentsJ2SE 1.4.2Required for updates prior to, and including, 1.4.2_29J2SE 5.0Required for updates prior to, and including, 5.0u27J2SE for Embedded 5.0Required for updates prior to, and including, 5.0u27Java SE 6Required for updates prior to, and including, 6u23Java SE for Embedded 6Required for updates prior to, and including, 6u23Java Real-Time System 2Required for updates prior to, and including, 2.2u1JRockit R27Required for updates prior to, and including, R27.6.8JRockit R28Required for updates prior to, and including, R28.1.1

14. As a result of running the tool, the <JRE_HOME>/lib/rt.jar file is modified and the tool leaves behind the following files: • <JRE_HOME>/lib/rt.jar.fpupdater   Copy of rt.jar before the fix.<JRE_HOME>/lib/.fpupdater.log       Zero-length file indicating that the update has taken place. • If either of these two files are already present, the tool will not perform the update and exits with a warning. • Run the fpupdater tool with the following command. • <JRE_HOME>/bin/java -jar fpupdater.jar -u -v • C:\Program Files\Java\jre6\bin\java

15. 要先關閉所有JAVA程式