HashMap漏洞

 
== Java == 
 
Java offers the HashMap and Hashtable classes, which use the 
String.hashCode() hash function. It is very similar to DJBX33A (instead of 33, it uses the 
multiplication constant 31 and instead of the start value 5381 it uses 0). Thus it is also 
vulnerable to an equivalent substring attack. When hashing a string, Java also caches the 
hash value in the hash attribute, but only if the result is different from zero. 
Thus, the target value zero is particularly interesting for an attacker as it prevents caching 
and forces re-hashing. 

Different web application parse the POST data differently, but the ones tested (Tomcat, 
Geronima, Jetty, Glassfish) all put the POST form data into either a Hashtable or HashMap 
object. The maximal POST sizes also differ from server to server, with 2 MB being the most 
common. 
 
A Tomcat 6.0.32 server parses a 2 MB string of colliding keys in about 
44 minutes of i7 CPU time, so an attacker with about 6 kbit/s can keep one i7 core constantly 
busy. If the attacker has a Gigabit connection, he can keep about 100.000 i7 cores busy.