LMS Status regarding Java Vulnerability CVE-2010-4476

[g.meerkoetter]

Is LMS 3.2 affected by the Oracle Java Floating-Point Value Denial of Service
Vulnerability?


http://blogs.oracle.com/security/2011/02/security_alert_for_cve-2010-44.html


What about Patches?

[ngoldwat]

Hi,

The status is currently under review. Once I hear definitive information I'll post it here.

Thanks,

Nick

[g.meerkoetter]

I just got the confirmation that LMS is vulnerable in my

SR 617002183.

Yes, it took 4 weeks to answer that simple question!

They told me that a patch shall be available on/before 29th Apr.

I did not get a bug ID, yet.

[ngoldwat]

Hi,

Here is a link to the bug:

http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCtn86202

Thanks

[g.meerkoetter]

Thanks for the bug ID and link, though that is not very useful, since all details are still hidden for customers.

Obviously, the patch has not been released yet. My TAC SE told me that it is scheduled for 2011-05-20, now.