CVE-2009-1190

Exploit

EPSS 2.8%
Veröffentlicht 27.04.2009 22:30:00
Zuletzt bearbeitet 16.06.2026 23:06:42
Erkennungen
Login

Algorithmic complexity vulnerability in the java.util.regex.Pattern.compile method in Sun Java Development Kit (JDK) before 1.6, when used with spring.jar in SpringSource Spring Framework 1.1.0 through 2.5.6 and 3.0.0.M1 through 3.0.0.M2 and dm Server 1.0.0 through 1.0.2, allows remote attackers to cause a denial of service (CPU consumption) via serializable data with a long regex string containing multiple optional groups, a related issue to CVE-2004-2540.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 0 Referenzen 9

NVD 139 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Sun ≫ Jdk Update update_22 Version <= 1.5.0

   Springsource ≫ Dm Server Version 1.0.0
   Springsource ≫ Dm Server Version 1.0.1
   Springsource ≫ Dm Server Version 1.0.2
   Springsource ≫ Spring Framework Version 1.1.0
   Springsource ≫ Spring Framework Version 2.0
   Springsource ≫ Spring Framework Version 2.0 Update m1
   Springsource ≫ Spring Framework Version 2.0 Update m2
   Springsource ≫ Spring Framework Version 2.0 Update m3
   Springsource ≫ Spring Framework Version 2.0 Update m4
   Springsource ≫ Spring Framework Version 2.0 Update m5
   Springsource ≫ Spring Framework Version 2.0 Update rc1
   Springsource ≫ Spring Framework Version 2.0 Update rc2
   Springsource ≫ Spring Framework Version 2.0 Update rc3
   Springsource ≫ Spring Framework Version 2.0 Update rc4
   Springsource ≫ Spring Framework Version 2.0.1
   Springsource ≫ Spring Framework Version 2.0.2
   Springsource ≫ Spring Framework Version 2.0.3
   Springsource ≫ Spring Framework Version 2.0.4
   Springsource ≫ Spring Framework Version 2.0.5
   Springsource ≫ Spring Framework Version 2.1 Update m1
   Springsource ≫ Spring Framework Version 2.1 Update m2
   Springsource ≫ Spring Framework Version 2.1 Update m3
   Springsource ≫ Spring Framework Version 2.1 Update m4
   Springsource ≫ Spring Framework Version 2.5.0
   Springsource ≫ Spring Framework Version 2.5.0 Update rc1
   Springsource ≫ Spring Framework Version 2.5.0 Update rc2
   Springsource ≫ Spring Framework Version 2.5.1
   Springsource ≫ Spring Framework Version 2.5.2
   Springsource ≫ Spring Framework Version 2.5.3
   Springsource ≫ Spring Framework Version 2.5.4
   Springsource ≫ Spring Framework Version 2.5.5
   Springsource ≫ Spring Framework Version 2.5.6
   Springsource ≫ Spring Framework Version 3.0.0 Update m1
   Springsource ≫ Spring Framework Version 3.0.0 Update m2

Sun ≫ Jdk Version 1.1.0

Sun ≫ Jdk Version 1.1.6

Sun ≫ Jdk Version 1.1.6 Update update7

Sun ≫ Jdk Version 1.1.7b

Sun ≫ Jdk Version 1.1.7b Update update5

Sun ≫ Jdk Version 1.1.8 Update update10

Sun ≫ Jdk Version 1.1.8 Update update13

Sun ≫ Jdk Version 1.1.8 Update update14

Sun ≫ Jdk Version 1.1.8 Update update2

Sun ≫ Jdk Version 1.1.8 Update update7

Sun ≫ Jdk Version 1.1.8 Update update8

Sun ≫ Jdk Version 1.2.0

Sun ≫ Jdk Version 1.2.1

Sun ≫ Jdk Version 1.2.1 Update update3

Sun ≫ Jdk Version 1.2.2 Update update4

Sun ≫ Jdk Version 1.2.2 Update update5

Sun ≫ Jdk Version 1.3.0

Sun ≫ Jdk Version 1.3.0_01

Sun ≫ Jdk Version 1.3.0_02

Sun ≫ Jdk Version 1.3.0_03

Sun ≫ Jdk Version 1.3.0_04

Sun ≫ Jdk Version 1.3.0_05

Sun ≫ Jdk Version 1.3.1

Sun ≫ Jdk Version 1.3.1 Update update19

Sun ≫ Jdk Version 1.3.1 Update update20

Sun ≫ Jdk Version 1.3.1_01

Sun ≫ Jdk Version 1.3.1_01a

Sun ≫ Jdk Version 1.3.1_02

Sun ≫ Jdk Version 1.3.1_03

Sun ≫ Jdk Version 1.3.1_04

Sun ≫ Jdk Version 1.3.1_05

Sun ≫ Jdk Version 1.3.1_06

Sun ≫ Jdk Version 1.3.1_07

Sun ≫ Jdk Version 1.3.1_08

Sun ≫ Jdk Version 1.3.1_09

Sun ≫ Jdk Version 1.3.1_10

Sun ≫ Jdk Version 1.3.1_11

Sun ≫ Jdk Version 1.3.1_12

Sun ≫ Jdk Version 1.3.1_13

Sun ≫ Jdk Version 1.3.1_14

Sun ≫ Jdk Version 1.3.1_15

Sun ≫ Jdk Version 1.3.1_16

Sun ≫ Jdk Version 1.3.1_17

Sun ≫ Jdk Version 1.3.1_18

Sun ≫ Jdk Version 1.3.1_19

Sun ≫ Jdk Version 1.3.1_20

Sun ≫ Jdk Version 1.3.1_21

Sun ≫ Jdk Version 1.3.1_22

Sun ≫ Jdk Version 1.3.1_23

Sun ≫ Jdk Version 1.3.1_24

Sun ≫ Jdk Version 1.3.1_25

Sun ≫ Jdk Version 1.3.1_26

Sun ≫ Jdk Version 1.3.1_27

Sun ≫ Jdk Version 1.3.1_28

Sun ≫ Jdk Version 1.4.0

Sun ≫ Jdk Version 1.4.0_01

Sun ≫ Jdk Version 1.4.0_02

Sun ≫ Jdk Version 1.4.0_03

Sun ≫ Jdk Version 1.4.0_04

Sun ≫ Jdk Version 1.4.1

Sun ≫ Jdk Version 1.4.1_01

Sun ≫ Jdk Version 1.4.1_02

Sun ≫ Jdk Version 1.4.1_03

Sun ≫ Jdk Version 1.4.1_04

Sun ≫ Jdk Version 1.4.1_05

Sun ≫ Jdk Version 1.4.1_06

Sun ≫ Jdk Version 1.4.1_07

Sun ≫ Jdk Version 1.4.2

Sun ≫ Jdk Version 1.4.2_1

Sun ≫ Jdk Version 1.4.2_2

Sun ≫ Jdk Version 1.4.2_3

Sun ≫ Jdk Version 1.4.2_4

Sun ≫ Jdk Version 1.4.2_5

Sun ≫ Jdk Version 1.4.2_6

Sun ≫ Jdk Version 1.4.2_7

Sun ≫ Jdk Version 1.4.2_8

Sun ≫ Jdk Version 1.4.2_9

Sun ≫ Jdk Version 1.4.2_10

Sun ≫ Jdk Version 1.4.2_11

Sun ≫ Jdk Version 1.4.2_12

Sun ≫ Jdk Version 1.4.2_13

Sun ≫ Jdk Version 1.4.2_14

Sun ≫ Jdk Version 1.4.2_15

Sun ≫ Jdk Version 1.4.2_16

Sun ≫ Jdk Version 1.4.2_17

Sun ≫ Jdk Version 1.4.2_18

Sun ≫ Jdk Version 1.4.2_19

Sun ≫ Jdk Version 1.5.0

Sun ≫ Jdk Version 1.5.0 Update update_1

Sun ≫ Jdk Version 1.5.0 Update update_10

Sun ≫ Jdk Version 1.5.0 Update update_11

Sun ≫ Jdk Version 1.5.0 Update update_12

Sun ≫ Jdk Version 1.5.0 Update update_13

Sun ≫ Jdk Version 1.5.0 Update update_14

Sun ≫ Jdk Version 1.5.0 Update update_15

Sun ≫ Jdk Version 1.5.0 Update update_16

Sun ≫ Jdk Version 1.5.0 Update update_17

Sun ≫ Jdk Version 1.5.0 Update update_18

Sun ≫ Jdk Version 1.5.0 Update update_19

Sun ≫ Jdk Version 1.5.0 Update update_2

Sun ≫ Jdk Version 1.5.0 Update update_20

Sun ≫ Jdk Version 1.5.0 Update update_21

Sun ≫ Jdk Version 1.5.0 Update update_3

Sun ≫ Jdk Version 1.5.0 Update update_4

Sun ≫ Jdk Version 1.5.0 Update update_5

Sun ≫ Jdk Version 1.5.0 Update update_6

Sun ≫ Jdk Version 1.5.0 Update update_7

Sun ≫ Jdk Version 1.5.0 Update update_8

Sun ≫ Jdk Version 1.5.0 Update update_9

Sun ≫ Jdk Version 1.5.0 Update update1

Sun ≫ Jdk Version 1.5.0 Update update10

Sun ≫ Jdk Version 1.5.0 Update update11

Sun ≫ Jdk Version 1.5.0 Update update11_b03

Sun ≫ Jdk Version 1.5.0 Update update12

Sun ≫ Jdk Version 1.5.0 Update update13

Sun ≫ Jdk Version 1.5.0 Update update14

Sun ≫ Jdk Version 1.5.0 Update update15

Sun ≫ Jdk Version 1.5.0 Update update16

Sun ≫ Jdk Version 1.5.0 Update update17

Sun ≫ Jdk Version 1.5.0 Update update18

Sun ≫ Jdk Version 1.5.0 Update update19

Sun ≫ Jdk Version 1.5.0 Update update2

Sun ≫ Jdk Version 1.5.0 Update update20

Sun ≫ Jdk Version 1.5.0 Update update21

Sun ≫ Jdk Version 1.5.0 Update update22

Sun ≫ Jdk Version 1.5.0 Update update23

Sun ≫ Jdk Version 1.5.0 Update update24

Sun ≫ Jdk Version 1.5.0 Update update25

Sun ≫ Jdk Version 1.5.0 Update update3

Sun ≫ Jdk Version 1.5.0 Update update4

Sun ≫ Jdk Version 1.5.0 Update update5

Sun ≫ Jdk Version 1.5.0 Update update6

Sun ≫ Jdk Version 1.5.0 Update update7

Sun ≫ Jdk Version 1.5.0 Update update7_b03

Sun ≫ Jdk Version 1.5.0 Update update8

Sun ≫ Jdk Version 1.5.0 Update update9

Sun ≫ Jdk Version 1.5.0_03 Edition solaris

Sun ≫ Jdk Version 1.5.0_03 Edition windows

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	2.8%	0.846

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	5	10	2.9	AV:N/AC:L/Au:N/C:N/I:N/A:P

Es wurden noch keine Informationen zu CWE veröffentlicht.

http://secunia.com/advisories/34892

Vendor Advisory

http://www.packetstormsecurity.org/hitb06/DAY_1_-_Marc_Schoenefeld_-_Pentesting_Java_J2EE.pdf

Exploit

http://www.securityfocus.com/archive/1/502926/100/0/threaded

http://www.springsource.com/securityadvisory

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=497161

Exploit

https://exchange.xforce.ibmcloud.com/vulnerabilities/50083

https://nvd.nist.gov/vuln/detail/CVE-2009-1190

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2009-1190

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2009-1190

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2009-1190