CVE-2008-5348 Denial of service in n/a

High 7.1 Published 5 Dec 2008 Updated 7 Aug 2024

Remote attackers can cause denial of service via resource consumption in Java Runtime Environment when Kerberos authentication is enabled.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2008-5348?

CVE-2008-5348 is a high-severity denial of service vulnerability in Sun Jdk, published on 5 Dec 2008. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Unspecified vulnerability in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier, when using Kerberos authentication, allows remote attackers to cause a denial of service (OS resource consumption) via unknown vectors.

Which versions are affected by CVE-2008-5348?

It affects 3 products.

Products include Sun Jdk, Sun Jre, Sun Sdk.

How do I fix CVE-2008-5348?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2008-5348 being exploited?

There is no known exploitation of CVE-2008-5348 in the wild and no public exploit code.

All Sun Jdk vulnerabilities

Sources

Also known as GHSA-gcr4-crvj-h3h7.