Which kind of webapps can realistically be affected by the floating bug?

Question

There's an easy way to totally lock a lot of JVM:

class runhang {
public static void main(String[] args) {
  System.out.println("Test:");
  double d = Double.parseDouble("2.2250738585072012e-308");
  System.out.println("Value: " + d);
 }
}

or, to hang the compiler:

class compilehang {
public static void main(String[] args) {
  double d = 2.2250738585072012e-308;
  System.out.println("Value: " + d);
 }
}

as explained here: http://www.exploringbinary.com/java-hangs-when-converting-2-2250738585072012e-308/

My question is very simple: which kind of well-conceived web application do you know that can realistically be affected by this?

In other words: on which kind of webapps could an attacker perform a Denial of Service using that known weakness?

It is bad, it is terribly bad. But besides programmers using floating-point for monetary computation I don't see many Java-backed websites that can be crashed.

I can see toy scientific applets being candidates but besides that...

Here's a threadump of the blocked thread (done using "kill -3" on Linux):

"main" prio=1 tid=0x09ab8a10 nid=0x57e9 runnable [0xbfbde000..0xbfbde728]
        at sun.misc.FDBigInt.mult(FloatingDecimal.java:2617)
        at sun.misc.FloatingDecimal.multPow52(FloatingDecimal.java:158)
        at sun.misc.FloatingDecimal.doubleValue(FloatingDecimal.java:1510)
        at java.lang.Double.parseDouble(Double.java:482)

EDIT

JVMs locked here:

java version "1.5.0_10" Java(TM) 2 Runtime Environment, Standard Edition (build 1.5.0_10-b03) Java HotSpot(TM) Server VM (build 1.5.0_10-b03, mixed mode)

java version "1.6.0_17" Java(TM) SE Runtime Environment (build 1.6.0_17-b04) Java HotSpot(TM) Server VM (build 14.3-b01, mixed mode)

Answer 1

Many web servers parse part of the http headers using Double.parse, so we are dealing with infrastructure here (in addition to any problems with applications that run in the container). The comments of the Exploring Binary blog you link to have the following as an example:

GET / HTTP/1.1
Host: myhost
Connection: keep-alive
Accept-Language: en-us;q=2.2250738585072012e-308

If the servlet that the request is going against makes a call to any of the localization APIs (which would then attempt to parse the language header), the above will bring the server down.

So yes, this is a very big problem. The attack surface is quite large, and the consequences quite high.

Answer 2

Hate to state the obvious, but all application that lets the user submits the string "2.2250738585072011e-308", and calls parse double on can "realistically" be affected.

Answer 3

All versions of Tomcat have been patched and released to handle the "Accept-Language" condition.

Oracle has released a hot fix which can be found here:

http://www.oracle.com/technetwork/java/javase/fpupdater-tool-readme-305936.html

The hotfix will work for java 1.4, 1.5, and 1.6.

Answer 4

Anything where you let the user enter a floating point number and do a comparison or calculation on it should be suspect. I would say a payment form, loan calculator, and bidding form would be the most common. All it would take is one little calculator utility in your entire application to be able to hang the web server by repeated hits.

Answer 5

I understand that this number is only one in a range of numbers that would crash applications but just couldn't resist commenting, check the last 4 digits. 2012, it speaks volumes of the number, the ancient predicted doomsday, and our modern applications are pointing to a crashing threshold unless fixed :-)