CVE-2009-3875 Security feature bypass in n/a

Medium 5.0 Published 5 Nov 2009 Updated 7 Aug 2024

Remote attackers can bypass authentication by exploiting timing side-channels in Java's MessageDigest.isEqual function to spoof HMAC signatures.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2009-3875?

CVE-2009-3875 is a medium-severity vulnerability in Sun Jdk, published on 5 Nov 2009. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The MessageDigest.isEqual function in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to spoof HMAC-based digital signatures, and possibly bypass authentication, via unspecified vectors related to "timing attack vulnerabilities," aka Bug Id 6863503.

Weakness: CWE-310

Which versions are affected by CVE-2009-3875?

It affects 3 products.

Products include Sun Jdk, Sun Jre, Sun Sdk.

How do I fix CVE-2009-3875?

Upgrade to a fixed version.

Is CVE-2009-3875 being exploited?

There is no known exploitation of CVE-2009-3875 in the wild and no public exploit code.

All Sun Jdk vulnerabilities

Sources

Also known as GHSA-p88x-7ffg-vgpw.