• Product Information
• Security Products Overview
• Juniper Networks ISG Series
• IDP Demo
• Product Poster & Z-Card 

Title: Multiple Vendor Java Virtual Machine java.util.zip Null Value Denial Of Service Vulnerability

Severity: MODERATE

Description:

Several implementations of the Java Virtual Machine have been reported to be prone to a denial of service condition.

This vulnerability occurs in several methods in the java.util.zip class. The following native methods have been reported to be vulnerable to this issue:
java.util.zip.Adler32().update();
java.util.zip.Deflater().setDictionary();
java.util.zip.CRC32().update();
java.util.zip.Deflater().deflate();
java.util.zip.CheckedOutputStream().write();
java.util.zip.CheckedInputStream().read();

The methods can be called with certain types of parameters however, there does not appear to be proper checks to see whether the parameters are NULL values. When these native methods are called with NULL values, this will cause the JVM to reach an undefined state which will cause it to behave in an unpredictable manner and possibly crash.

**It has been reported that versions of Macromedia ColdFusion MX are also vulnerable due to the inclusion of a vulnerable version of the Sun JRE. This record will be updated when further details of vulnerable versions are available.

**It has been reported that Opera 7.11j ships with the vulnerable 1.4.1_01 Java Virtual Machine.

**It has been reported that Apache Xalan may be used as an attack vector to trigger this vulnerability.

This BID will be separated into individual entries where appropriate.

Affected Products:

• Apache Software Foundation Xalan-java 2.5.1
• BEA Systems WebLogic Express 5.1.0
• BEA Systems WebLogic Express 5.1.0 SP 1
• BEA Systems WebLogic Express 5.1.0 SP 10
• BEA Systems WebLogic Express 5.1.0 SP 11
• BEA Systems WebLogic Express 5.1.0 SP 12
• BEA Systems WebLogic Express 5.1.0 SP 13
• BEA Systems WebLogic Express 5.1.0 SP 2
• BEA Systems WebLogic Express 5.1.0 SP 3
• BEA Systems WebLogic Express 5.1.0 SP 4
• BEA Systems WebLogic Express 5.1.0 SP 5
• BEA Systems WebLogic Express 5.1.0 SP 6
• BEA Systems WebLogic Express 5.1.0 SP 7
• BEA Systems WebLogic Express 5.1.0 SP 8
• BEA Systems WebLogic Express 5.1.0 SP 9
• BEA Systems WebLogic Express 6.1.0
• BEA Systems WebLogic Express 6.1.0 SP 1
• BEA Systems WebLogic Express 6.1.0 SP 2
• BEA Systems WebLogic Express 6.1.0 SP 3
• BEA Systems WebLogic Express 6.1.0 SP 4
• BEA Systems WebLogic Express 6.1.0 SP 5
• BEA Systems WebLogic Express 7.0.0
• BEA Systems WebLogic Express 7.0.0 SP 1
• BEA Systems WebLogic Express 7.0.0 SP 2
• BEA Systems WebLogic Express 7.0.0 SP 3
• BEA Systems WebLogic Express 7.0.0 SP 4
• BEA Systems WebLogic Express for Win32 5.1.0
• BEA Systems WebLogic Express for Win32 5.1.0 SP 1
• BEA Systems WebLogic Express for Win32 5.1.0 SP 10
• BEA Systems WebLogic Express for Win32 5.1.0 SP 11
• BEA Systems WebLogic Express for Win32 5.1.0 SP 12
• BEA Systems WebLogic Express for Win32 5.1.0 SP 13
• BEA Systems WebLogic Express for Win32 5.1.0 SP 2
• BEA Systems WebLogic Express for Win32 5.1.0 SP 3
• BEA Systems WebLogic Express for Win32 5.1.0 SP 4
• BEA Systems WebLogic Express for Win32 5.1.0 SP 5
• BEA Systems WebLogic Express for Win32 5.1.0 SP 6
• BEA Systems WebLogic Express for Win32 5.1.0 SP 7
• BEA Systems WebLogic Express for Win32 5.1.0 SP 8
• BEA Systems WebLogic Express for Win32 5.1.0 SP 9
• BEA Systems WebLogic Express for Win32 6.1.0
• BEA Systems WebLogic Express for Win32 6.1.0 SP 1
• BEA Systems WebLogic Express for Win32 6.1.0 SP 2
• BEA Systems WebLogic Express for Win32 6.1.0 SP 3
• BEA Systems WebLogic Express for Win32 6.1.0 SP 4
• BEA Systems WebLogic Express for Win32 6.1.0 SP 5
• BEA Systems WebLogic Express for Win32 7.0.0
• BEA Systems WebLogic Express for Win32 7.0.0 SP 1
• BEA Systems WebLogic Express for Win32 7.0.0 SP 2
• BEA Systems WebLogic Express for Win32 7.0.0 SP 3
• BEA Systems WebLogic Server for Win32 5.1.0
• BEA Systems WebLogic Server for Win32 5.1.0 SP 1
• BEA Systems WebLogic Server for Win32 5.1.0 SP 10
• BEA Systems WebLogic Server for Win32 5.1.0 SP 11
• BEA Systems WebLogic Server for Win32 5.1.0 SP 12
• BEA Systems WebLogic Server for Win32 5.1.0 SP 13
• BEA Systems WebLogic Server for Win32 5.1.0 SP 2
• BEA Systems WebLogic Server for Win32 5.1.0 SP 3
• BEA Systems WebLogic Server for Win32 5.1.0 SP 4
• BEA Systems WebLogic Server for Win32 5.1.0 SP 5
• BEA Systems WebLogic Server for Win32 5.1.0 SP 6
• BEA Systems WebLogic Server for Win32 5.1.0 SP 7
• BEA Systems WebLogic Server for Win32 5.1.0 SP 8
• BEA Systems WebLogic Server for Win32 5.1.0 SP 9
• BEA Systems WebLogic Server for Win32 6.1.0
• BEA Systems WebLogic Server for Win32 6.1.0 SP 1
• BEA Systems WebLogic Server for Win32 6.1.0 SP 2
• BEA Systems WebLogic Server for Win32 6.1.0 SP 3
• BEA Systems WebLogic Server for Win32 6.1.0 SP 4
• BEA Systems WebLogic Server for Win32 6.1.0 SP 5
• BEA Systems WebLogic Server for Win32 7.0.0
• BEA Systems WebLogic Server for Win32 7.0.0 SP 1
• BEA Systems WebLogic Server for Win32 7.0.0 SP 2
• BEA Systems WebLogic Server for Win32 7.0.0 SP 3
• BEA Systems Weblogic Server 5.1.0
• BEA Systems Weblogic Server 5.1.0 SP 1
• BEA Systems Weblogic Server 5.1.0 SP 10
• BEA Systems Weblogic Server 5.1.0 SP 11
• BEA Systems Weblogic Server 5.1.0 SP 12
• BEA Systems Weblogic Server 5.1.0 SP 13
• BEA Systems Weblogic Server 5.1.0 SP 2
• BEA Systems Weblogic Server 5.1.0 SP 3
• BEA Systems Weblogic Server 5.1.0 SP 4
• BEA Systems Weblogic Server 5.1.0 SP 5
• BEA Systems Weblogic Server 5.1.0 SP 6
• BEA Systems Weblogic Server 5.1.0 SP 7
• BEA Systems Weblogic Server 5.1.0 SP 8
• BEA Systems Weblogic Server 5.1.0 SP 9
• BEA Systems Weblogic Server 6.1.0
• BEA Systems Weblogic Server 6.1.0 SP 1
• BEA Systems Weblogic Server 6.1.0 SP 2
• BEA Systems Weblogic Server 6.1.0 SP 3
• BEA Systems Weblogic Server 6.1.0 SP 4
• BEA Systems Weblogic Server 6.1.0 SP 5
• BEA Systems Weblogic Server 7.0.0
• BEA Systems Weblogic Server 7.0.0 SP 1
• BEA Systems Weblogic Server 7.0.0 SP 2
• BEA Systems Weblogic Server 7.0.0 SP 3
• BEA Systems Weblogic Server 7.0.0 SP 4
• IBM JDK 1.3.1
• Lotus Domino 6.0.1
• Lotus Notes Client 6.0.1
• Macromedia ColdFusion Server MX Developer
• Macromedia ColdFusion Server MX Enterprise
• Macromedia ColdFusion Server MX Professional
• Opera Software Opera Web Browser 7.11.0
• Opera Software Opera Web Browser 7.11.0 j
• Sun JDK 1.4.1
• Sun JDK 1.4.2
• Sun JRE (Linux Production Release) 1.3.1
• Sun JRE (Linux Production Release) 1.3.1 _01
• Sun JRE (Linux Production Release) 1.3.1 _03
• Sun JRE (Linux Production Release) 1.3.1 _05
• Sun JRE (Linux Production Release) 1.3.1 _06
• Sun JRE (Linux Production Release) 1.3.1 _07
• Sun JRE (Linux Production Release) 1.4.0
• Sun JRE (Linux Production Release) 1.4.0 .0_02
• Sun JRE (Linux Production Release) 1.4.0 .0_03
• Sun JRE (Linux Production Release) 1.4.1
• Sun JRE (Linux Production Release) 1.4.1 _01
• Sun JRE (Solaris Production Release) 1.3.1 _01
• Sun JRE (Solaris Production Release) 1.3.1 _03
• Sun JRE (Solaris Production Release) 1.3.1 _05
• Sun JRE (Solaris Production Release) 1.3.1 _06
• Sun JRE (Solaris Production Release) 1.3.1 _07
• Sun JRE (Solaris Production Release) 1.4.0
• Sun JRE (Solaris Production Release) 1.4.0 .0_02
• Sun JRE (Solaris Production Release) 1.4.0 .0_03
• Sun JRE (Solaris Production Release) 1.4.1
• Sun JRE (Solaris Production Release) 1.4.1 _01
• Sun JRE (Windows Production Release) 1.3.1 _01a
• Sun JRE (Windows Production Release) 1.3.1 _03
• Sun JRE (Windows Production Release) 1.3.1 _05
• Sun JRE (Windows Production Release) 1.3.1 _06
• Sun JRE (Windows Production Release) 1.3.1 _07
• Sun JRE (Windows Production Release) 1.4.0
• Sun JRE (Windows Production Release) 1.4.0 .0_02
• Sun JRE (Windows Production Release) 1.4.0 .0_03
• Sun JRE (Windows Production Release) 1.4.1
• Sun JRE (Windows Production Release) 1.4.1 _01
• Sun SDK (Linux Production Release) 1.3.1 _01
• Sun SDK (Linux Production Release) 1.3.1 _03
• Sun SDK (Linux Production Release) 1.3.1 _05
• Sun SDK (Linux Production Release) 1.3.1 _06
• Sun SDK (Linux Production Release) 1.3.1 _07
• Sun SDK (Linux Production Release) 1.4.0
• Sun SDK (Linux Production Release) 1.4.0 .0_02
• Sun SDK (Linux Production Release) 1.4.0 .0_03
• Sun SDK (Linux Production Release) 1.4.1
• Sun SDK (Linux Production Release) 1.4.1 _01
• Sun SDK (Solaris Production Release) 1.3.1 _01
• Sun SDK (Solaris Production Release) 1.3.1 _03
• Sun SDK (Solaris Production Release) 1.3.1 _05
• Sun SDK (Solaris Production Release) 1.3.1 _06
• Sun SDK (Solaris Production Release) 1.3.1 _07
• Sun SDK (Solaris Production Release) 1.4.0
• Sun SDK (Solaris Production Release) 1.4.0 .0_02
• Sun SDK (Solaris Production Release) 1.4.0 .0_03
• Sun SDK (Solaris Production Release) 1.4.1
• Sun SDK (Solaris Production Release) 1.4.1 _01
• Sun SDK (Windows Production Release) 1.3.1 _01a
• Sun SDK (Windows Production Release) 1.3.1 _03
• Sun SDK (Windows Production Release) 1.3.1 _05
• Sun SDK (Windows Production Release) 1.3.1 _06
• Sun SDK (Windows Production Release) 1.3.1 _07
• Sun SDK (Windows Production Release) 1.4.0
• Sun SDK (Windows Production Release) 1.4.0 .0_02
• Sun SDK (Windows Production Release) 1.4.0 .0_03
• Sun SDK (Windows Production Release) 1.4.1
• Sun SDK (Windows Production Release) 1.4.1 _01

References:

• Apache Software Foundation: Xalan-Java Homepage
• BEA Systems: SECURITY ADVISORY (BEA04-45.00)
• Sun: J2SE Product Page
• Sun Microsystems: Java 2 Runtime Environment 1.4 Homepage

Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.