The Java Secure Socket Extension (JSSE) that is included in various releases of the Java Runtime Environment does not correctly process SSL/TLS handshake requests. This vulnerability may be exploited to create a Denial of Service (DoS) condition to the system as a whole on a server that listens for SSL/TLS connections using JSSE for SSL/TLS support.

Sun acknowledges with thanks, Cisco Systems for bringing this issue to our attention.

This issue can occur in the following releases (for Solaris, Linux, and Windows):

• JDK and JRE 6 Update 1 and earlier
• JDK and JRE 5.0 Updates 7, 8, 9, 10, and 11
• SDK and JRE 1.4.2_11, _12, _13, and _14

Note: JSSE 1.0.3_xx and earlier, which are optional packages for use with older versions of the JDK, are not affected by this issue. SDK and JRE 1.4.2_10 and earlier, and JDK and JRE 5.0 Update 6 and earlier are also not affected.

To determine the default version of the JRE on a system for Solaris and Linux, the following command can be run:

    % java -version

Note: The above command only determines the default version. Other versions may also be installed on the system.

To determine the default version of the JRE on a system for Windows:

1. Click "Start"
2. Select "Run"
3. Type "cmd" (starts a command-line)
4. At the prompt, type "java -version"

Note: The above command only determines the default version. Other versions may also be installed on the system.

If this issue has been exploited to cause a Denial of Service to the system, processes making use of JSSE may be consuming excessive amounts of CPU, causing the system to run slowly and be unresponsive.

There is no workaround for this issue. Please see the Resolution section below.

This issue is addressed in the following releases (for Solaris, Linux, and Windows):

• JDK and JRE 6 Update 2 or later
• JDK and JRE 5.0 Update 12 and later
• SDK and JRE 1.4.2_15 and later

Java SE 6 is available for download at the following links:

http://java.sun.com/javase/downloads/index.jsp

Java SE 6 Update 2 for Solaris is available in the following patches:

• Java SE 6: update 2 (as delivered in patch 125136-02 or later)
• Java SE 6: update 2 (as delivered in patch 125137-02 or later (64bit))
• Java SE 6_x86: update 2 (as delivered in patch 125138-02 or later)
• Java SE 6_x86: update 2 (as delivered in patch 125139-02 or later (64bit))

Java SE 5.0 is available for download at the following link:

http://java.sun.com/j2se/1.5.0/download.jsp

Java SE 5.0 Update 12 for Solaris is available in the following patches:

• J2SE 5.0: update 12 (as delivered in patch 118666-12 or later)
• J2SE 5.0: update 12 (as delivered in patch 118667-12 or later (64bit))
• J2SE 5.0_x86: update 12 (as delivered in patch 118668-12 or later)
• J2SE 5.0_x86: update 12 (as delivered in patch 118669-12 or later (64bit))

J2SE 1.4.2 is available for download at the following link:

http://java.sun.com/j2se/1.4.2/download.html

Note: When installing a new version of the product from a source other than a Solaris patch, it is recommended that the old affected versions be removed from your system. To remove old affected versions on the Windows platform, please see:

http://java.com/en/download/help/uninstall_java.xml

This solution has no attachment