CVE: CVE-2010-4476
Component: JDK Double.parseDouble Denial-Of-Service
Severity: Moderate
Release date: 2010-01-01T00:00:00+00:00

The Double.parseDouble method in Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 and earlier, as used in OpenJDK, Apache, JBossweb, and other products, allows remote attackers to cause a denial of service via a crafted string that triggers an infinite loop of estimations during conversion to a double-precision binary floating-point number, as demonstrated using 2.2250738585072012e-308.


Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

Run the following command to restart the Red Hat Network Satellite
server:

# rhn-satellite restart
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259
A patch to correct CVE-2010-4476 for JBoss Enterprise Application Platform
4.2.0.CP09, 4.3.0.CP09, and 5.1 is available from the Red Hat Customer
Portal. To download this patch:

1) Backup your existing JBoss Enterprise Application Platform installation
(including all applications and configuration files).

2) Log into the Customer Portal: https://access.redhat.com/login

3) Navigate to
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html

4) On the left-hand side menu, under "JBoss Enterprise Platforms" click
"Application Platform". Then, use the "Version:" drop down menu to select
"4.2.0.GA_CP09", "4.3.0.GA_CP09", or "5.1.0".

5) The patch is available from the "Security Advisories" link. After
applying the patch, the JBoss server process must be restarted for the
update to take effect.
Updated jbossweb-2.0.0.jar (for 4.3.CP06) and jbossweb-2.1.10.jar (for
5.1.0) files that fix CVE-2010-4476 for JBoss Enterprise Portal Platform
4.3.CP06 and 5.1.0 are available from the Red Hat Customer Portal. To
download and install the updated files:

1) Log into the Customer Portal: https://access.redhat.com/login

2) Navigate to
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html

3) On the left-hand side menu, under "JBoss Enterprise Platforms" click
"Portal Platform". Then, using the "Version:" drop down menu, select the
Portal Platform version you are using, such as "4.3 CP06" or "5.1.0".

4) From the "Security Advisories" tab, click the "CVE-2010-4476 JBossweb
update fixing JDK double bug..." link in the "Download File" column. The
"Software Details" page is displayed, where you can download the update
and view installation instructions.

5) Backup your existing jbossweb.jar file (refer to the "Software Details"
page, from step 4, for the location of this file).

6) After downloading the update, ensure you backed up your existing
jbossweb.jar file as per step 5, and then follow the manual installation
step on the "Software Details" page. After installing the update, the JBoss
server process must be restarted for the update to take effect.
Updated jbossweb-2.0.0.jar (for 4.3.CP04) and jbossweb-2.1.10.jar (for
5.0.2) files that fix CVE-2010-4476 for JBoss Enterprise SOA Platform
4.3.CP04 and 5.0.2 are available from the Red Hat Customer Portal. To
download and install the updated files:

1) Log into the Customer Portal: https://access.redhat.com/login

2) Navigate to
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html

3) On the left-hand side menu, under "JBoss Enterprise Platforms" click
"SOA Platform". Then, using the "Version:" drop down menu, select the SOA
Platform version you are using, such as "4.3.0.GA_CP04" or "5.0.2 GA".

4) From the "Security Advisories" tab, click the "CVE-2010-4476 JBossweb
update fixing JDK double bug..." link in the "Download File" column. The
"Software Details" page is displayed, where you can download the update
and view installation instructions.

5) Backup your existing jbossweb.jar file (refer to the "Software Details"
page, from step 4, for the location of this file).

6) After downloading the update, ensure you backed up your existing
jbossweb.jar file as per step 5, and then follow the manual installation
step on the "Software Details" page. Note that it is recommended to halt
the JBoss Enterprise SOA Platform server by stopping the JBoss Application
Server process before installing this update, and then after installing the
update, restart the JBoss Enterprise SOA Platform server by starting the
JBoss Application Server process.
A patch to correct CVE-2010-4476 for JBoss Enterprise Web Platform 5.1 is
available from the Red Hat Customer Portal. To download this patch:

1) Backup your existing JBoss Enterprise Web Platform installation
(including all applications and configuration files).

2) Log into the Customer Portal: https://access.redhat.com/login

3) Navigate to
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html

4) On the left-hand side menu, under "JBoss Enterprise Platforms" click
"Enterprise Web Platform". Then, use the "Version:" drop down menu to
select "5.1.0".

5) The patch is available from the "Security Advisories" link. After
applying the patch, the JBoss server process must be restarted for the
update to take effect.
The References section of this erratum contains a patch download link (you
must log in to download the patch). Before applying the patch, backup your
existing JBoss Enterprise Web Server installation (including all
applications and configuration files). After applying the patch, the JBoss
server process must be restarted for the update to take effect.