SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |    Help    |   

SecurityTracker
Archives


Welcome to SecurityTracker!
 
Click to Sign Up
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com
Sign Up!





Category:  Application (Generic)  >  Java Enterprise System (JES) Vendors:  Sun
Java Enterprise System (JES) Network Security Services (NSS) Memory Leak Lets Remote Users Deny Service
SecurityTracker Alert ID:  1016294
SecurityTracker URL:  http://securitytracker.com/id?1016294
CVE Reference:  CVE-2006-3127   (Links to External Site)
Updated:  Jul 17 2006
Original Entry Date:  Jun 14 2006
Impact:  Denial of service via network
Fix Available:  Yes   Exploit Included:  Yes   Vendor Confirmed:  Yes  
Advisory:  Sun Alert
Version(s): 2003Q4, 2004Q2, 2005Q1
Description:  A vulnerability was reported in Java Enterprise System (JES) when Network Security Services (NSS) is installed. A remote user can cause denial of service conditions.

The Network Security Services (NSS) code will leak 256 bytes of memory per RSA cryptographic operation. A remote user can initiate a large number of cryptographic operations to cuase the system to run out of memory and hang or panic.
Impact:  A remote user can cause denial of service conditions.
Solution:  Sun has issued the following fixes.

SPARC Platform

* Sun Java Enterprise System 2003Q4, 2004Q2 and 2005Q1 (for Solaris 8) with patch 119209-09 or later
* Sun Java Enterprise System 2003Q4, 2004Q2 and 2005Q1 (for Solaris 9) with patch 119211-09 or later
* Sun Java Enterprise System 2005Q1 (for Solaris 10) with patch 119213-09 or later

x86 Platform

* Sun Java Enterprise System 2003Q4, 2004Q2 and 2005Q1 (for Solaris 9) with patch 119212-09 or later
* Sun Java Enterprise System 2005Q1 (for Solaris 10) with patch 119214-09 or later

Linux Platform

* Sun Java Enterprise System 2003Q4, 2004Q2 and 2005Q1 (for Linux) with patch 121656-07

The Sun advisory, available at:

http://sunsolve.sun.com/search/document.do?assetkey=1-26-102461-1
Vendor URL:  sunsolve.sun.com/search/document.do?assetkey=1-26-102461-1 (Links to External Site)
Cause:  Resource error
Underlying OS:  Linux (Any), UNIX (Solaris - SunOS)

Message History:   This archive entry has one or more follow-up message(s) listed below.
Apr 30 2007 (Sun Issues Fix for Java Directory Server) Java Enterprise System (JES) Network Security Services (NSS) Memory Leak Lets Remote Users Deny Service
Sun has issued a fix for Sun Java Directory Server.


 Source Message Contents
Date:  Wed, 14 Jun 2006 00:20:19 -0400
Subject:  Sun Java Enterprise System (JES) and Network Security Services (NSS) vulnerability

 
 
> Memory Leak in NSS May Cause the System to Hang or Panic
 
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102461-1


Go to the Top of This SecurityTracker Archive Page



Home   |    View Topics   |    Search   |    Contact Us   |    Help

Copyright 2007, SecurityGlobal.net LLC