CVE-2011-5035
published 2011-12-30CVE-2011-5035: Oracle Glassfish 2.1.1, 3.0.1, and 3.1.1, as used in Communications Server 2.0, Sun Java System Application Server 8.1 and 8.2, and possibly other products…
PriorityP350medium5CVSS 2.0
AVNACLAuNCNINAP
EXPLOIT
EPSS
68.91%
99.3th percentile
Oracle Glassfish 2.1.1, 3.0.1, and 3.1.1, as used in Communications Server 2.0, Sun Java System Application Server 8.1 and 8.2, and possibly other products, computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters, aka Oracle security ticket S0104869.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | glassfish_server | <= 3.1.1 | — |
| oracle | glassfish_server | — | — |
| oracle | glassfish_server | — | — |
Detection & IOCsextracted from sources · hover to see the quote
commandPOST <path> HTTP/1.1 with Content-Type: application/x-www-form-urlencoded; charset=utf-8 and large body of hash-colliding parameters↗
- →Detect exploit attempts by monitoring for HTTP POST requests containing an abnormally large number of form parameters (application/x-www-form-urlencoded) sent in a single request, which is the core delivery mechanism for this hash-collision DoS against GlassFish. ↗
- →Alert on HTTP POST requests with Content-Type: application/x-www-form-urlencoded where Content-Length approaches or exceeds 2MB (the Java/GlassFish default max), as the PoC tool caps Java payloads at 2MB by default. ↗
- →Flag the specific User-Agent string used by the public PoC exploit tool: 'Mozilla/5.0 (Windows; U; Windows NT 6.1; de; rv:1.9.2.20) Gecko/20110803 Firefox/3.6.20 ( .NET CLR 3.5.30729; .NET4.0E)' appearing alongside large POST bodies. ↗
- →The Metasploit module generates a random payload to bypass IDS signatures; pure signature matching on parameter content is insufficient — also monitor for CPU spike correlation with large POST requests to GlassFish endpoints. ↗
- →For Java/GlassFish targets, the collision payload is generated using the DJBX31A hash function (base 31, start 0) over characters in range 0–128; parameters sharing the same hash value will appear as seemingly random but structurally patterned strings. ↗
- →Monitor GlassFish HTTP request parameter parsing for hash table collisions; the attack vector is HTTP POST to any GlassFish endpoint that parses form parameters into a HashMap/HashTable. ↗
- ·The Metasploit module randomises the collision payload per request to evade static IDS signatures, so content-based signatures alone will not reliably detect all exploit attempts. ↗
- ·Red Hat JBoss products are NOT affected because they use JBoss Web / Tomcat as the web container, not the GlassFish Web Container; detection rules should be scoped to GlassFish deployments. ↗
- ·A related but separate variant of this hash-collision issue affects the Java standard library HttpServer class (unlimited HTTP headers stored in HashMap); that variant is tracked under a different bug (Red Hat bug #788606) and is not CVE-2011-5035. ↗
- ·Affected GlassFish versions are 2.1.1, 3.0.1, and 3.1.1; detection and patching efforts should be prioritised against these specific versions. ↗
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
vendor_ubuntu6.4MEDIUM
vendor_redhat5.0MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
OpenJDK 6 (ARM) vulnerabilities
vendor_ubuntu·2012-03-01·CVSS 6.4
CVE-2012-0501 [MEDIUM] OpenJDK 6 (ARM) vulnerabilities
Title: OpenJDK 6 (ARM) vulnerabilities
Summary: Multiple vulnerabilities in OpenJDK 6 for the ARM architecture have
been fixed.
USN 1373-1 fixed vulnerabilities in OpenJDK 6 in Ubuntu 10.04 LTS,
Ubuntu 10.10 and Ubuntu 11.04 for all architectures except for ARM
(armel). This provides the corresponding OpenJDK 6 update for use
with the ARM (armel) architecture in Ubuntu 10.04 LTS, Ubuntu 10.10
and Ubuntu 11.04.
Original advisory details:
It was discovered that the Java HttpServer class did not limit the
number of headers read from a HTTP request. A remote attacker could
cause a denial of service by sending special requests that trigger
hash collisions predictably. (CVE-2011-5035)
ATTENTION: this update changes previous Java HttpServer class behavior
by limiting the number of request he
Ubuntu
OpenJDK 6 vulnerabilities
vendor_ubuntu·2012-02-24·CVSS 6.4
CVE-2011-3563 [MEDIUM] OpenJDK 6 vulnerabilities
Title: OpenJDK 6 vulnerabilities
Summary: Multiple OpenJDK 6 vulnerabilities have been fixed.
It was discovered that the Java HttpServer class did not limit the
number of headers read from a HTTP request. A remote attacker could
cause a denial of service by sending special requests that trigger
hash collisions predictably. (CVE-2011-5035)
ATTENTION: this update changes previous Java HttpServer class behavior
by limiting the number of request headers to 200. This may be increased
by adjusting the sun.net.httpserver.maxReqHeaders property.
It was discovered that the Java Sound component did not properly
check buffer boundaries. A remote attacker could use this to cause
a denial of service or view confidential data. (CVE-2011-3563)
It was discovered that the Java2D implementation does no
Red Hat
GlassFish: hash table collisions CPU usage DoS (oCERT-2011-003)
vendor_redhat·2011-12-28·CVSS 5.0
CVE-2011-5035 [MEDIUM] GlassFish: hash table collisions CPU usage DoS (oCERT-2011-003)
GlassFish: hash table collisions CPU usage DoS (oCERT-2011-003)
Oracle Glassfish 2.1.1, 3.0.1, and 3.1.1, as used in Communications Server 2.0, Sun Java System Application Server 8.1 and 8.2, and possibly other products, computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters, aka Oracle security ticket S0104869.
Statement: Not vulnerable. This issue affects the GlassFish Web Container component. This
component is not shipped with any Red Hat products. JBoss Web and Tomcat
provide the web container used in all JBoss products.
Package: Security (Red Hat JBoss BRMS 5) - Not affected
GHSA
GHSA-6mxv-54wx-wppj: Oracle Glassfish 2
ghsa_unreviewed·2022-05-14
CVE-2011-5035 [MEDIUM] CWE-20 GHSA-6mxv-54wx-wppj: Oracle Glassfish 2
Oracle Glassfish 2.1.1, 3.0.1, and 3.1.1, as used in Communications Server 2.0, Sun Java System Application Server 8.1 and 8.2, and possibly other products, computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters, aka Oracle security ticket S0104869.
No detection rules found.
Exploit-DB
PHP Hash Table Collision - Denial of Service (PoC)
exploitdb·2012-01-03·CVSS 5.0
CVE-2011-4885 [MEDIUM] PHP Hash Table Collision - Denial of Service (PoC)
PHP Hash Table Collision - Denial of Service (PoC)
---
#!/usr/bin/env python
"""
This script was written by Christian Mehlmauer
https://twitter.com/#!/_FireFart_
Sourcecode online at:
https://github.com/FireFart/HashCollision-DOS-POC
Original PHP Payloadgenerator taken from https://github.com/koto/blog-kotowicz-net-examples/tree/master/hashcollision
http://www.ocert.org/advisories/ocert-2011-003.html
CVE:
Apache Geronimo: CVE-2011-5034
Oracle Glassfish: CVE-2011-5035
PHP: CVE-2011-4885
Apache Tomcat: CVE-2011-4858
requires Python 2.7
Examples:
-) Make a single Request, wait for the response and save the response to output0.html
python HashtablePOC.py -u https://host/index.php -v -c 1 -w -o output -t PHP
-) Take down a PHP server(make 500 requests without waiting for a response):
p
Exploit-DB
MyBulletinBoard (MyBB) 1.1.5 - 'CLIENT-IP' SQL Injection
exploitdb·2006-07-15
CVE-2011-5035 MyBulletinBoard (MyBB) 1.1.5 - 'CLIENT-IP' SQL Injection
MyBulletinBoard (MyBB) 1.1.5 - 'CLIENT-IP' SQL Injection
---
#!/usr/bin/php -q -d short_open_tag=on
ipaddress = $ipaddress = getip();
//
// User-agent
//
$this->useragent = $_SERVER['HTTP_USER_AGENT'];
if(strlen($this->useragent) > 100)
{
$this->useragent = substr($this->useragent, 0, 100);
}
//
// Attempt to find a session id in the cookies
//
if($_COOKIE['sid'])
{
$this->sid = addslashes($_COOKIE['sid']);
}
else
{
$this->sid = 0;
}
//
// Attempt to load the session from the database
//
$query = $db->query("SELECT sid,uid FROM ".TABLE_PREFIX."sessions WHERE sid='".$this->sid."' AND ip='".$this->ipaddress."'");
...
injection is blind, but you can ask true-false questions to the database to
retrieve the admin loginkey.
Through that you can build an admin cookie and create a new admin
Metasploit
Hashtable Collisions
metasploit
Hashtable Collisions
Hashtable Collisions
This module uses a denial-of-service (DoS) condition appearing in a variety of programming languages. This vulnerability occurs when storing multiple values in a hash table and all values have the same hash value. This can cause a web server parsing the POST parameters issued with a request into a hash table to consume hours of CPU with a single HTTP request. Currently, only the hash functions for PHP and Java are implemented. This module was tested with PHP + httpd, Tomcat, Glassfish and Geronimo. It also generates a random payload to bypass some IDS signatures.
http://archives.neohapsis.com/archives/bugtraq/2011-12/0181.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-05/msg00010.htmlhttp://marc.info/?l=bugtraq&m=133364885411663&w=2http://marc.info/?l=bugtraq&m=133847939902305&w=2http://marc.info/?l=bugtraq&m=134254866602253&w=2http://marc.info/?l=bugtraq&m=134254957702612&w=2http://marc.info/?l=bugtraq&m=139344343412337&w=2http://rhn.redhat.com/errata/RHSA-2012-0514.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1455.htmlhttp://secunia.com/advisories/48073http://secunia.com/advisories/48074http://secunia.com/advisories/48589http://secunia.com/advisories/48950http://secunia.com/advisories/57126http://security.gentoo.org/glsa/glsa-201406-32.xmlhttp://www.debian.org/security/2012/dsa-2420http://www.kb.cert.org/vuls/id/903934http://www.mandriva.com/security/advisories?name=MDVSA-2013:150http://www.nruns.com/_downloads/advisory28122011.pdfhttp://www.ocert.org/advisories/ocert-2011-003.htmlhttp://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.htmlhttp://www.oracle.com/technetwork/topics/security/cpujan2012-366304.htmlhttp://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.htmlhttps://github.com/FireFart/HashCollision-DOS-POC/blob/master/HashtablePOC.pyhttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16908http://archives.neohapsis.com/archives/bugtraq/2011-12/0181.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-05/msg00010.htmlhttp://marc.info/?l=bugtraq&m=133364885411663&w=2http://marc.info/?l=bugtraq&m=133847939902305&w=2http://marc.info/?l=bugtraq&m=134254866602253&w=2http://marc.info/?l=bugtraq&m=134254957702612&w=2http://marc.info/?l=bugtraq&m=139344343412337&w=2http://rhn.redhat.com/errata/RHSA-2012-0514.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1455.htmlhttp://secunia.com/advisories/48073http://secunia.com/advisories/48074http://secunia.com/advisories/48589http://secunia.com/advisories/48950http://secunia.com/advisories/57126http://security.gentoo.org/glsa/glsa-201406-32.xmlhttp://www.debian.org/security/2012/dsa-2420http://www.kb.cert.org/vuls/id/903934http://www.mandriva.com/security/advisories?name=MDVSA-2013:150http://www.nruns.com/_downloads/advisory28122011.pdfhttp://www.ocert.org/advisories/ocert-2011-003.htmlhttp://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.htmlhttp://www.oracle.com/technetwork/topics/security/cpujan2012-366304.htmlhttp://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.htmlhttps://github.com/FireFart/HashCollision-DOS-POC/blob/master/HashtablePOC.pyhttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16908
2011-12-30
Published