CVE-2007-3698

Description

The Java Secure Socket Extension (JSSE) in Sun JDK and JRE 6 Update 1 and earlier, JDK and JRE 5.0 Updates 7 through 11, and SDK and JRE 1.4.2_11 through 1.4.2_14, when using JSSE for SSL/TLS support, allows remote attackers to cause a denial of service (CPU consumption) via certain SSL/TLS handshake requests.

7.8

CVSS

Severity: High

CVSS 2.0 •

EPSS 16.80% Top 10%

Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory cisco.com Vendor Advisory apple.com Vendor Advisory redhat.com Vendor Advisory opensuse.org Vendor Advisory redhat.com Vendor Advisory hp.com Vendor Advisory sun.com Vendor Advisory gentoo.org Vendor Advisory redhat.com Vendor Advisory bea.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory cisco.com Vendor Advisory vupen.com Vendor Advisory vupen.com Vendor Advisory vupen.com Vendor Advisory vupen.com Vendor Advisory vupen.com

Affected: n/a n/a

References

Link	Tags
http://www.redhat.com/support/errata/RHSA-2008-0132.html	patch vendor advisory
http://www.redhat.com/support/errata/RHSA-2007-0818.html	vendor advisory
http://www.vupen.com/english/advisories/2007/2660	vdb entry vendor advisory
http://secunia.com/advisories/26933	third party advisory vendor advisory
http://docs.info.apple.com/article.html?artnum=307177
http://www.securityfocus.com/bid/24846	vdb entry patch
http://secunia.com/advisories/26314	third party advisory vendor advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10634	vdb entry signature
http://support.novell.com/techcenter/psdb/0c36b6416afc3868b8b1b9012955e323.html
http://www.cisco.com/en/US/products/products_security_response09186a008088bd19.html	vendor advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/35333	vdb entry
http://secunia.com/advisories/29897	third party advisory vendor advisory
http://secunia.com/advisories/26015	third party advisory vendor advisory
http://secunia.com/advisories/28056	third party advisory vendor advisory
http://lists.apple.com/archives/Security-announce/2007/Dec/msg00001.html	vendor advisory
http://www.redhat.com/support/errata/RHSA-2008-0100.html	patch vendor advisory
http://secunia.com/advisories/26221	third party advisory vendor advisory
http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00010.html	vendor advisory
http://www.redhat.com/support/errata/RHSA-2007-0956.html	vendor advisory
http://secunia.com/advisories/26645	third party advisory vendor advisory
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01269450	vendor advisory
http://secunia.com/advisories/28777	third party advisory vendor advisory
http://www.securitytracker.com/id?1018357	vdb entry
http://www.vupen.com/english/advisories/2007/4224	vdb entry vendor advisory
http://www.vupen.com/english/advisories/2007/3861	vdb entry vendor advisory
http://www.vupen.com/english/advisories/2007/3009	vdb entry vendor advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102997-1	patch vendor advisory
http://secunia.com/advisories/28880	third party advisory vendor advisory
http://secunia.com/advisories/27716	third party advisory vendor advisory
http://osvdb.org/36663	vdb entry
http://www.gentoo.org/security/en/glsa/glsa-200709-15.xml	vendor advisory
http://secunia.com/advisories/28115	third party advisory vendor advisory
http://secunia.com/advisories/29340	third party advisory vendor advisory
http://www.vupen.com/english/advisories/2007/2495	vdb entry vendor advisory
http://www.redhat.com/support/errata/RHSA-2007-1086.html	vendor advisory
http://secunia.com/advisories/27203	third party advisory vendor advisory
http://secunia.com/advisories/26631	third party advisory vendor advisory
http://dev2dev.bea.com/pub/advisory/249	vendor advisory
http://secunia.com/advisories/27635	third party advisory vendor advisory
http://www.cisco.com/warp/public/707/cisco-sr-20070725-jsse.shtml	vendor advisory

Frequently Asked Questions

What is the severity of CVE-2007-3698?: CVE-2007-3698 has been scored as a high severity vulnerability.
How to fix CVE-2007-3698?: To fix CVE-2007-3698, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2007-3698 being actively exploited in the wild?: It is possible that CVE-2007-3698 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~17% probability that this vulnerability will be exploited by malicious actors in the next 30 days.