FILE-OTHER Sun Java Runtime Environment Pack200 decompression integer overflow attempt

Description

Detects an archive exploiting CVE-2009-1095, an integer overflow in the Java runtime Pack200 decompression that can allow code execution. The rule matches the crafted archive headers that overflow the decompressor's length calculations.

CVEs

References

• nvd.nist.gov →