Java Runtime hangs when converting a certain number, SAP security note 1556366

SAP security note 1556366, "Java Runtime hangs when converting a certain number". Below are the symptom and SAP recommended solution.

Description

Symptom

Oracle recently issued a security alert for the Java Runtime Environment, resulting in the Java Runtime Environment hanging when converting a string to a certain number. See Oracle Security Alert CVE-2010-4476 for details.

Certain SAP products are also affected by the same vulnerability.

Solution

Solutions to this issue are available with the following versions:

• Java Runtime Environment within the SAP VM Container: A kernel patch is available as mentioned in the SP Patch Level.
• Java Runtime Environment of the SAP JVM: A fixed version of the SAP JVM is available as mentioned in the SP Patch Level.

Reason and prerequisites

A malicious user can trigger a condition where the process enters an infinite loop, consuming all available processing time. This causes the entire machine to become unresponsive until the process is manually terminated. This flaw can be exploited to launch a denial of service (DoS) attack.

CVSS

Score 5.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

References

• 1561103 – Java Runtime lacks appropriate authorizations