vulnerability note CVE-2012-4416 CVE-2012-4420

Java JRE: memory reading via Arrays.fill

Synthesis of the vulnerability

When a Java application uses an integer array, and the Arrays.fill() method, the array memory area is not initialized to zero by the JRE, so an attacker can obtain a fragment memory.
Impacted products: Fedora, HP-UX, MES, Mandriva Linux, Windows (platform), openSUSE, Oracle JRE, Solaris, RHEL, Unix (platform).
Severity: 1/4.
Creation date: 11/09/2012.
Identifiers: 7196857, BID-55501, BID-55538, c03595351, CERTA-2012-AVI-746, CVE-2012-4416, CVE-2012-4420, FEDORA-2012-16346, FEDORA-2012-16351, MDVSA-2012:169, openSUSE-SU-2012:1419-1, openSUSE-SU-2012:1423-1, openSUSE-SU-2012:1424-1, RHSA-2012:1384-01, RHSA-2012:1385-01, RHSA-2012:1386-01, RHSA-2012:1391-01, RHSA-2012:1392-01, VIGILANCE-VUL-11929.

Description of the vulnerability

In Java language, an array is created with:
  array = new int[10];
According to the specifications, this array must be filled with zeros.

Then, this array can be filled with 33 using the following method:
  Arrays.fill(array, 33);

However, as the compiler detects that the array will be filled with 33, it does not fill it with zeros. So, between both instructions, the array contains values previously stored at its memory address. The array thus contains data which can be sensitive, and which (depending on the code) can be sent to the attacker.

When a Java application uses an integer array, and the Arrays.fill() method, the array memory area is not initialized to zero by the JRE, so an attacker can therefore obtain a fragment memory.
Complete Vigil@nce bulletin.... (free access)

Share this bulletin

          

Computer vulnerabilities tracking service

Vigil@nce provides a systems vulnerabilities management. The Vigil@nce computer vulnerability tracking service alerts your teams of vulnerabilities or threats impacting your information system. The Vigil@nce security watch publishes vulnerability bulletins about threats impacting the information system. The Vigil@nce team tracks computer vulnerabilities impacting systems and applications.