IBM SDK, Java Technology Edition denial of service

Vulnerability

A denial-of-service vulnerability exists in the IBM SDK, Java Technology Edition's Object Request Broker (ORB) component. Affected versions include 7.1.0.0 through 7.1.5.21 and 8.0.0.0 through 8.0.8.21. The issue arises from improper enforcement of the JEP 290 MaxRef and MaxDepth deserialization filters, which can be bypassed under certain circumstances.

Exploitation

An attacker can trigger the vulnerability by sending specially crafted serialized data to a vulnerable ORB endpoint. The attacker does not require authentication, but successful exploitation depends on the ORB accepting and deserializing the malicious data. The precise sequence involves sending a serialized object that exceeds the intended filter limits, leading to resource exhaustion.

Impact

Successful exploitation results in a denial of service (DoS) condition, as the ORB may consume excessive memory or CPU resources, causing the Java application to become unresponsive or crash. The impact is limited to availability, with no confidentiality or integrity compromise.

Mitigation

IBM has addressed this vulnerability in the April 2024 Critical Patch Update (CPU). Users should upgrade to the latest fix levels for their SDK versions. For version 7.1, apply 7.1.5.22 or later; for version 8.0, apply 8.0.8.22 or later. There is no known workaround; applying the fix is recommended. Refer to IBM Security Bulletin 7150727 [1] for details.