Detections
Analytics

Amazon Linux AMI : java-1.6.0-openjdk (ALAS-2016-700)

critical Nessus Plugin ID 91048

Language:

Synopsis

The remote Amazon Linux AMI host is missing a security update.

Description

Multiple flaws were discovered in the Serialization and Hotspot components in OpenJDK. An untrusted Java application or applet could use these flaws to completely bypass Java sandbox restrictions.
(CVE-2016-0686 , CVE-2016-0687)

It was discovered that the RMI server implementation in the JMX component in OpenJDK did not restrict which classes can be deserialized when deserializing authentication credentials. A remote, unauthenticated attacker able to connect to a JMX port could possibly use this flaw to trigger deserialization flaws. (CVE-2016-3427)

It was discovered that the JAXP component in OpenJDK failed to properly handle Unicode surrogate pairs used as part of the XML attribute values. Specially crafted XML input could cause a Java application to use an excessive amount of memory when parsed.
(CVE-2016-3425)

It was discovered that the Security component in OpenJDK failed to check the digest algorithm strength when generating DSA signatures.
The use of a digest weaker than the key strength could lead to the generation of signatures that were weaker than expected.
(CVE-2016-0695)

Solution

Run 'yum update java-1.6.0-openjdk' to update your system.

See Also

https://alas.aws.amazon.com/ALAS-2016-700.html

Plugin Details

Severity: Critical

ID: 91048

File Name: ala_ALAS-2016-700.nasl

Version: 2.4

Type: local

Agent: unix

Published: 5/12/2016

Updated: 5/14/2023

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: Critical

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS v3

Risk Factor: Critical

Base Score: 9.6

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Vulnerability Information

CPE: p-cpe:/a:amazon:linux:java-1.6.0-openjdk-demo, p-cpe:/a:amazon:linux:java-1.6.0-openjdk-src, p-cpe:/a:amazon:linux:java-1.6.0-openjdk, p-cpe:/a:amazon:linux:java-1.6.0-openjdk-devel, cpe:/o:amazon:linux, p-cpe:/a:amazon:linux:java-1.6.0-openjdk-javadoc, p-cpe:/a:amazon:linux:java-1.6.0-openjdk-debuginfo

Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list

Patch Publication Date: 5/11/2016

CISA Known Exploited Vulnerability Due Dates: 6/2/2023

Reference Information

CVE: CVE-2016-0686, CVE-2016-0687, CVE-2016-0695, CVE-2016-3425, CVE-2016-3427

ALAS: 2016-700