Multiple buffer overflows in Sun Java Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 7 and earlier, Java System Development Kit (SDK) and JRE 1.4.2_12 and earlier 1.4.x versions, and SDK and JRE 1.3.1_18 and earlier allow attackers to develop Java applets that read, write, or execute local files, possibly related to (1) integer overflows in the Java_sun_awt_image_ImagingLib_convolveBI, awt_parseRaster, and awt_parseColorModel functions; (2) a stack overflow in the Java_sun_awt_image_ImagingLib_lookupByteRaster function; and (3) improper handling of certain negative values in the Java_sun_font_SunLayoutEngine_nativeLayout function. NOTE: some of these details are obtained from third party information.

According to its version number, the Sun JRE installed on the remote host has two buffer overflow issues that may allow an untrusted applet to elevate its privileges to, for example, read or write local files or to execute local applications subject to the privileges of the user running the applet.

In addition, another set of vulnerabilities may allow an untrusted applet to access data in other applets.

java-1.5.0-ibm packages that correct several security issues are available for Red Hat Enterprise Linux 4 Extras.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

IBM's 1.5.0 Java release includes the IBM Java 2 Runtime Environment and the IBM Java 2 Software Development Kit.

Vulnerabilities were discovered in the Java Runtime Environment. An untrusted applet could use these vulnerabilities to access data from other applets. (CVE-2006-6736, CVE-2006-6737)

Serialization flaws were discovered in the Java Runtime Environment.
An untrusted applet or application could use these flaws to elevate its privileges. (CVE-2006-6745)

Buffer overflow vulnerabilities were discovered in the Java Runtime Environment. An untrusted applet could use these flaws to elevate its privileges, possibly reading and writing local files or executing local applications. (CVE-2006-6731)

Daniel Bleichenbacher discovered an attack on PKCS #1 v1.5 signatures.
Where an RSA key with exponent 3 is used it may be possible for an attacker to forge a PKCS #1 v1.5 signature that would be incorrectly verified by implementations that do not check for excess data in the RSA exponentiation result of the signature. (CVE-2006-4339)

All users of java-ibm-1.5.0 should upgrade to these packages, which contain IBM's 1.5.0 SR3 Java release which resolves these issues.

Please note that the packages in this erratum are identical to those we released on January 24th 2007 in advisory RHEA-2007:0027. We have issued this security update because when we released RHEA-2007:0027 we were not aware that it contained fixes for security issues. If you have already updated to those packages you will not need to apply this update.

Updated java-1.4.2-ibm packages to correct several security issues are now available for Red Hat Enterprise Linux 3 and 4 Extras.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

IBM's 1.4.2 SR7 Java release includes the IBM Java 2 Runtime Environment and the IBM Java 2 Software Development Kit.

A number of security issues were found :

Vulnerabilities were discovered in the Java Runtime Environment. An untrusted applet could use these vulnerabilities to access data from other applets. (CVE-2006-6736, CVE-2006-6737)

Serialization flaws were discovered in the Java Runtime Environment.
An untrusted applet or application could use these flaws to elevate its privileges. (CVE-2006-6745)

Buffer overflow vulnerabilities were discovered in the Java Runtime Environment. An untrusted applet could use these flaws to elevate its privileges, possibly reading and writing local files or executing local applications. (CVE-2006-6731)

Daniel Bleichenbacher discovered an attack on PKCS #1 v1.5 signatures.
Where an RSA key with exponent 3 is used it may be possible for an attacker to forge a PKCS #1 v1.5 signature that would be incorrectly verified by implementations that do not check for excess data in the RSA exponentiation result of the signature. (CVE-2006-4339)

All users of java-1.4.2-ibm should upgrade to these updated packages, which contain IBM's 1.4.2 SR7 Java release which resolves these issues.

The remote Mac OS X 10.4 host is running a version of Java for Mac OS X that is older than release 6.

The remote version of this software contains several security vulnerabilities that may allow a rogue Java applet to escalate its privileges and to add or remove arbitrary items from the user's KeyChain.

To exploit these flaws, an attacker would need to lure an attacker into executing a rogue Java applet.

The remote host is affected by the vulnerability described in GLSA-200705-20 (Blackdown Java: Applet privilege escalation)

    Chris Evans has discovered multiple buffer overflows in the Sun JDK and     the Sun JRE possibly related to various AWT and font layout functions.
    Tom Hawtin has discovered an unspecified vulnerability in the Sun JDK     and the Sun JRE relating to unintended applet data access. He has also     discovered multiple other unspecified vulnerabilities in the Sun JDK     and the Sun JRE allowing unintended Java applet or application resource     acquisition. Additionally, a memory corruption error has been found in     the handling of GIF images with zero width field blocks.
  Impact :

    An attacker could entice a user to run a specially crafted Java applet     or application that could read, write, or execute local files with the     privileges of the user running the JVM, access data maintained in other     Java applets, or escalate the privileges of the currently running Java     applet or application allowing for unauthorized access to system     resources.
  Workaround :

    Disable the 'nsplugin' USE flag in order to prevent web applets from     being run.

The remote host is affected by the vulnerability described in GLSA-200702-08 (AMD64 x86 emulation Sun's J2SE Development Kit: Multiple vulnerabilities)

    Chris Evans has discovered multiple buffer overflows in Sun JDK and Sun     JRE possibly related to various AWT or font layout functions. Tom     Hawtin has discovered an unspecified vulnerability in Sun JDK and Sun     JRE relating to unintended applet data access. He has also discovered     multiple other unspecified vulnerabilities in Sun JDK and Sun JRE     allowing unintended Java applet or application resource acquisition.
    Additionally, a memory corruption error has been found in the handling     of GIF images with zero width field blocks.
  Impact :

    An attacker could entice a user to run a specially crafted Java applet     or application that could read, write, or execute local files with the     privileges of the user running the JVM, access data maintained in other     Java applets, or escalate the privileges of the currently running Java     applet or application allowing for unauthorized access to system     resources.
  Workaround :

    There is no known workaround at this time.

IBMJava2-JRE and IBMJava2-SDK packages that correct several security issues are available for Red Hat Enterprise Linux 2.1.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

IBM's 1.3.1 Java release includes the IBM Java 2 Runtime Environment and the IBM Java 2 Software Development Kit.

Vulnerabilities were discovered in the Java Runtime Environment. An untrusted applet could use these vulnerabilities to access data from other applets. (CVE-2006-6736, CVE-2006-6737)

Buffer overflow vulnerabilities were discovered in the Java Runtime Environment. An untrusted applet could use these flaws to elevate its privileges, possibly reading and writing local files or executing local applications. (CVE-2006-6731)

Daniel Bleichenbacher discovered an attack on PKCS #1 v1.5 signatures.
Where an RSA key with exponent 3 is used it may be possible for an attacker to forge a PKCS #1 v1.5 signature that would be incorrectly verified by implementations that do not check for excess data in the RSA exponentiation result of the signature. (CVE-2006-4339)

All users of IBMJava2 should upgrade to these updated packages, which contain IBM's 1.3.1 SR10a Java release which resolves these issues.

Please note that the packages in this erratum are the same as those we released on January 24th 2007 with advisories RHBA-2007:0023 and RHEA-2007:0024. We have issued this security update as these previous advisories did not specify that they fixed critical security issues.
If you have already updated to those versions of IBMJava you will not need to apply this update.

The remote host is affected by the vulnerability described in GLSA-200701-15 (Sun JDK/JRE: Multiple vulnerabilities)

    Chris Evans has discovered multiple buffer overflows in Sun JDK and Sun     JRE possibly related to various AWT or font layout functions. Tom     Hawtin has discovered an unspecified vulnerability in Sun JDK and Sun     JRE relating to unintended applet data access. He has also discovered     multiple other unspecified vulnerabilities in Sun JDK and Sun JRE     allowing unintended Java applet or application resource acquisition.
  Impact :

    An attacker could entice a user to run a specially crafted Java applet     or application that could read, write, or execute local files with the     privileges of the user running the JVM; access data maintained in other     Java applets; or escalate the privileges of the currently running Java     applet or application allowing for unauthorized access to system     resources.
  Workaround :

    There is no known workaround at this time.

According to its version number, the Sun JRE installed on the remote host has two buffer overflow issues that may allow an untrusted applet to elevate its privileges to, for example, read or write local files or to execute local applications subject to the privileges of the user running the applet. 

In addition, another set of vulnerabilities may allow an untrusted applet to access data in other applets.

ID	Name	Product	Family	Severity
64818	Sun Java JRE Multiple Vulnerabilities (102729 / 102732) (Unix)	Nessus	Misc.	high
63839	RHEL 4 : java-1.5.0-ibm (RHSA-2007:0073)	Nessus	Red Hat Local Security Checks	high
63837	RHEL 3 / 4 : java-1.4.2-ibm (RHSA-2007:0062)	Nessus	Red Hat Local Security Checks	high
29702	Mac OS X : Java for Mac OS X 10.4 Release 6	Nessus	MacOS X Local Security Checks	critical
25341	GLSA-200705-20 : Blackdown Java: Applet privilege escalation	Nessus	Gentoo Local Security Checks	high
24369	GLSA-200702-08 : AMD64 x86 emulation Sun's J2SE Development Kit: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
24320	RHEL 2.1 : IBMJava2 (RHSA-2007:0072)	Nessus	Red Hat Local Security Checks	high
24251	GLSA-200701-15 : Sun JDK/JRE: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
23931	Sun Java JRE Multiple Vulnerabilities (102729 / 102732)	Nessus	Windows	high

Detections

Analytics

CVE-2006-6731

high

Tenable Plugins

high

high

high

critical

high

high

high

high

high