|
|
|
|
| |
Credit:
The information has been provided by Mark Thomas.
|
| |
Vulnerable Systems:
* Spring Framework versions 1.1.0-2.5.6, 3.0.0.M1-3.0.0.M2
* dm Server version 1.0.0-1.0.2 (note 2.x not affected since dm Server 2.x requires a 1.6 JDK)
Patch Availability and Workarounds:
* Users of all products may upgrade to JRE/JDK 1.6 which includes the fix for the root cause
* Spring Framework 2.5.6.SEC01 has been released for Community users that includes a workaround to the root cause - see[4] for upgrade steps
* Spring Framework 2.5.6.SR02 is available for Enterprise users that includes a workaround to the root cause; The software can be found in the Customer Portal [5]
* Disable functionality that accepts serializable data from untrusted sources
* Spring Framework 3.0.0.M3 will be released shortly that includes a workaround to the root cause
* dm Server 1.0.2 Community users may replace the Spring Framework 2.5.6 jar with 2.5.6.SEC01 - see[4] for upgrade steps
* dm Server 1.0.3 that includes a workaround to the root cause will be released shortly
* Instrumented Spring Framework 2.5.6.SR02 that includes a workaround to the root cause will be released by April 27, 2009
CVE Information:
CVE-2004-2540
CVE-2009-1190
|
|
|
|
|
