Oracle GlassFish Server Web form hash conflict Denial of Service Vulnerability

Release date: 2011-12-29
Updated on: 2011-12-30

Affected Systems:
Oracle GlassFish Server 3.x
Description:
--------------------------------------------------------------------------------
Bugtraq id: 51194

Oracle GlassFish Server is an open-source and open community platform for building and deploying next-generation applications and services.

When the Oracle GlassFish Server processes the hash form posting and updating the hash form, there is an error in the hash generation function. By sending a specially crafted form in the http post request, attackers can exploit this vulnerability to cause hash conflicts, resulting in high CPU consumption.

<* Source: Alexander Klink (a.klink@cynops.de)

Link: http://www.ocert.org/advisories/ocert-2011-003.html
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Oracle
------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Http://www.oracle.com/technetwork/topics/security/