Red Hat has released an additional security advisory and updated packages to address multiple products hash collisions denial of service vulnerability. CentOS has also released updated packages to address this vulnerability.
Description
Multiple products contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on a targeted system.
The vulnerability is due to an implementation flaw in the code responsible for handling the hashing functionality in the affected products. A hash table provides the data structure to store user-supplied input using a mathematical property in an effort to minimize the overhead to access a given record. A good hashing function ensures uniqueness of each entry while calculating the location for a set of inputs. However, most implementations do not include mechanisms such as randomized hash functions. As a result, the function could fail to identify occurrences of hash collisions for multiple string patterns.
An unauthenticated, remote attacker could exploit the vulnerability by submitting malicious HTTP POST requests that contain a sequence of string patterns that could generate similar hash keys to a vulnerable application. Processing these requests could introduce multiple hash collisions, and the algorithmic complexity for adding an item into the hash table could increase significantly. The increased complexity could consume excessive system resources, leading to a DoS condition on the system.
The following products are vulnerable:
Apache Tomcat versions prior to 5.5.35, 6.0.35, and 7.0.23
Microsoft .NET Framework versions 1.1 SP1 and prior, versions 2.0 SP2 and prior, versions 3.5 SP1 and prior, and version 4
Jetty versions 8.1.0.RC2 and prior
Libxml2 versions 2.7.8 and prior
Oracle GlassFish versions 3.1.1 and prior
PHP versions 5.3.8 and prior
Ruby versions 1.8.7-p352 and prior
Apache has confirmed the vulnerability in the svn repository. Reports indicate patches are under development and will be released soon.
Microsoft has released a security bulletin at the following link: MS11-100. Microsoft customers can obtain updates directly by using the links in the security bulletin. These updates are also distributed by Windows automatic update features and available on the Windows Update website. Microsoft Windows Server Update Services (WSUS), Systems Management Server, and System Center Configuration Manager can assist administrators in deploying software updates.
Oracle has released a security advisory at the following link: CVE-2011-4815. Oracle has released patches for registered users at the following link: Solaris 11 11/11 SRU 6.6.
VMware has released security advisories at the following links: VMSA-2012-0012and VMSA-2012-0013. VMware has released updated software at the following links:
VMware has notified customers that updated patches are pending for ESXi versions 4.1 and prior.
Alert History
Version 15, December 21, 2012, 6:20 AM: Red Hat has released additional security advisories and updated packages to address multiple products hash collisions denial of service vulnerability.
Version 14, September 4, 2012, 2:15 PM: VMware has released an additional security advisory and updated patches to address the hash collisions denial of service vulnerability found in multiple products.
Version 13, July 17, 2012, 11:35 AM: VMware has released a security advisory and updated patches to address the hash collisions denial of service vulnerability found in multiple products.
Version 12, June 29, 2012, 9:23 AM: HP has released an additional security bulletin and updated software to address the hash collisions denial of service vulnerability found in multiple products.
Version 11, May 10, 2012, 10:10 AM: Apple has released a security advisory and updated software to address the multiple products hash collisions denial of service vulnerability.
Version 10, April 20, 2012, 11:45 AM: Oracle has released a security advisory and patches to address multiple products hash collisions denial of service vulnerability.
Version 9, April 17, 2012, 1:58 PM: HP has released an additional security bulletin and updated software to address multiple products hash collisions denial of service vulnerability.
Version 8, February 24, 2012, 10:54 AM: Red Hat has released additional security advisories and updated packages to address multiple products hash collisions denial of service vulnerability. CentOS has also released updated packages to address this vulnerability.
Version 7, February 7, 2012, 10:34 AM: HP has released a security bulletin to address the multiple products hash collisions denial of service vulnerability.
Version 6, January 31, 2012, 10:54 AM: Red Hat has released additional security advisories and updated packages to address multiple products hash collisions denial of service vulnerability. CentOS has also released updated packages to address this vulnerability.
Version 5, January 23, 2012, 3:11 PM: IBM has released a flash alert and fixes to address the multiple products hash collisions denial of service vulnerability.
Version 4, January 19, 2012, 1:51 PM: Red Hat has released an additional security advisory and updated packages to address the multiple products hash collisions denial of service vulnerability. CentOS has also released updated packages to address this vulnerability.
Version 3, January 17, 2012, 6:08 PM: FreeBSD has released an additional VuXML document and updated ports collection to address the multiple products hash collisions denial of service vulnerability.
Version 2, January 12, 2012, 11:26 AM: FreeBSD has released a VuXML document and updated ports collection to address the multiple products hash collisions denial of service vulnerability. Red Hat and CentOS have also released a security advisory and updated packages to address this vulnerability.
Version 1, January 4, 2012, 1:42 PM: Multiple products contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service condition. Updates are available.
5.3.0 Base | 5.3.1 Base | 5.3.2 Base | 5.3.3 Base | 5.3.4 Base | 5.3.5 Base | 5.3.6 Base | 5.3.7 Base | 5.3.8 Base
Sun Microsystems, Inc.
Sun GlassFish Enterprise Sever
3.0 .1, Base | 3.1 .1, Base
The Jakarta Project
Tomcat Java Server
5.5.0 Base | 5.5.1 Base | 5.5.10 Base | 5.5.11 Base | 5.5.12 Base | 5.5.13 Base | 5.5.14 Base | 5.5.15 Base | 5.5.16 Base | 5.5.17 Base | 5.5.18 Base | 5.5.19 Base | 5.5.2 Base | 5.5.20 Base | 5.5.21 Base | 5.5.22 Base | 5.5.23 Base | 5.5.24 Base | 5.5.25 Base | 5.5.26 Base | 5.5.27 Base | 5.5.28 Base | 5.5.29 Base | 5.5.3 Base | 5.5.30 Base | 5.5.31 Base | 5.5.32 Base | 5.5.33 Base | 5.5.34 Base | 5.5.4 Base | 5.5.5 Base | 5.5.6 Base | 5.5.7 Base | 5.5.8 Base | 5.5.9 Base | 6.0.0 Base | 6.0.1 Base | 6.0.10 Base | 6.0.11 Base | 6.0.12 Base | 6.0.13 Base | 6.0.14 Base | 6.0.15 Base | 6.0.16 Base | 6.0.18 Base | 6.0.19 Base | 6.0.2 Base | 6.0.20 Base | 6.0.21 Base | 6.0.22 Base | 6.0.23 Base | 6.0.24 Base | 6.0.25 Base | 6.0.26 Base | 6.0.27 Base | 6.0.28 Base | 6.0.29 Base | 6.0.3 Base | 6.0.30 Base | 6.0.31 Base | 6.0.32 Base | 6.0.33 Base | 6.0.34 Base | 6.0.4 Base | 6.0.5 Base | 6.0.6 Base | 6.0.7 Base | 6.0.8 Base | 6.0.9 Base | 6.1.0 Base | 7.0 .1, .10, .11, .12, .13, .14, .15, .16, .17, .18, .19, .2, .20, .21, .22, .3, .4, .5, .6, .7, .8, .9, Base
3.5 Base, Update 1, Update 2, Update 3, Update 4 | 4.0 Base | 4.1 Base | 5.0 Base
VMware, Inc.
VMware ESX Server
4.0 Base | 4.1 Base
Alerts and bulletins on the Cisco Security Intelligence Operations Portal are highlighted by analysts in the
Cisco Threat Operations Center and represent a subset of the comprehensive content that is available through Cisco Security IntelliShield Alert Manager Service.
This customizable threat and vulnerability alert service provides security staff with access to timely, accurate, and credible information about threats and vulnerabilities that may affect their environment. Cisco is pleased to offer a free trial of the service.
To register for full access, please visit the IntelliShield trial registration page.
LEGAL DISCLAIMER The urgency and severity ratings of this alert are not tailored to individual users; users may value alerts differently based upon their network configurations and circumstances. THE ALERT, AND INFORMATION CONTAINED THEREIN, ARE PROVIDED ON AN "AS IS" BASIS AND DO NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE ALERT, AND INFORMATION CONTAINED THEREIN, OR MATERIALS LINKED FROM THE ALERT, IS AT YOUR OWN RISK. INFORMATION IN THIS ALERT AND ANY RELATED COMMUNICATIONS IS BASED ON OUR KNOWLEDGE AT THE TIME OF PUBLICATION AND IS SUBJECT TO CHANGE WITHOUT NOTICE. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE ALERTS AT ANY TIME.
