Multiple unspecified vulnerabilities in Sun Java Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 7 and earlier, and Java System Development Kit (SDK) and JRE 1.4.2_12 and earlier 1.4.x versions, allow attackers to develop Java applets or applications that are able to gain privileges, related to serialization in JRE.

According to its version number, the Sun JRE installed on the remote host has two buffer overflow issues that may allow an untrusted applet to elevate its privileges to, for example, read or write local files or to execute local applications subject to the privileges of the user running the applet.

In addition, another set of vulnerabilities may allow an untrusted applet to access data in other applets.

java-1.5.0-ibm packages that correct several security issues are available for Red Hat Enterprise Linux 4 Extras.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

IBM's 1.5.0 Java release includes the IBM Java 2 Runtime Environment and the IBM Java 2 Software Development Kit.

Vulnerabilities were discovered in the Java Runtime Environment. An untrusted applet could use these vulnerabilities to access data from other applets. (CVE-2006-6736, CVE-2006-6737)

Serialization flaws were discovered in the Java Runtime Environment.
An untrusted applet or application could use these flaws to elevate its privileges. (CVE-2006-6745)

Buffer overflow vulnerabilities were discovered in the Java Runtime Environment. An untrusted applet could use these flaws to elevate its privileges, possibly reading and writing local files or executing local applications. (CVE-2006-6731)

Daniel Bleichenbacher discovered an attack on PKCS #1 v1.5 signatures.
Where an RSA key with exponent 3 is used it may be possible for an attacker to forge a PKCS #1 v1.5 signature that would be incorrectly verified by implementations that do not check for excess data in the RSA exponentiation result of the signature. (CVE-2006-4339)

All users of java-ibm-1.5.0 should upgrade to these packages, which contain IBM's 1.5.0 SR3 Java release which resolves these issues.

Please note that the packages in this erratum are identical to those we released on January 24th 2007 in advisory RHEA-2007:0027. We have issued this security update because when we released RHEA-2007:0027 we were not aware that it contained fixes for security issues. If you have already updated to those packages you will not need to apply this update.

Updated java-1.4.2-ibm packages to correct several security issues are now available for Red Hat Enterprise Linux 3 and 4 Extras.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

IBM's 1.4.2 SR7 Java release includes the IBM Java 2 Runtime Environment and the IBM Java 2 Software Development Kit.

A number of security issues were found :

Vulnerabilities were discovered in the Java Runtime Environment. An untrusted applet could use these vulnerabilities to access data from other applets. (CVE-2006-6736, CVE-2006-6737)

Serialization flaws were discovered in the Java Runtime Environment.
An untrusted applet or application could use these flaws to elevate its privileges. (CVE-2006-6745)

Buffer overflow vulnerabilities were discovered in the Java Runtime Environment. An untrusted applet could use these flaws to elevate its privileges, possibly reading and writing local files or executing local applications. (CVE-2006-6731)

Daniel Bleichenbacher discovered an attack on PKCS #1 v1.5 signatures.
Where an RSA key with exponent 3 is used it may be possible for an attacker to forge a PKCS #1 v1.5 signature that would be incorrectly verified by implementations that do not check for excess data in the RSA exponentiation result of the signature. (CVE-2006-4339)

All users of java-1.4.2-ibm should upgrade to these updated packages, which contain IBM's 1.4.2 SR7 Java release which resolves these issues.

The remote Mac OS X 10.4 host is running a version of Java for Mac OS X that is older than release 6.

The remote version of this software contains several security vulnerabilities that may allow a rogue Java applet to escalate its privileges and to add or remove arbitrary items from the user's KeyChain.

To exploit these flaws, an attacker would need to lure an attacker into executing a rogue Java applet.

The IBM Java JRE/SDK has been brought to release 1.4.2 SR8, containing several bugfixes, including the following security fixes :

  - A buffer overflow vulnerability in the Java(TM) Runtime     Environment may allow an untrusted applet to elevate its     privileges. For example, an applet may grant itself     permissions to read and write local files or execute     local applications that are accessible to the user     running the untrusted applet. (CVE-2007-0243)

  - Two vulnerabilities in the Java Runtime Environment may     independently allow an untrusted applet to access data     in other applets. (CVE-2006-6737 / CVE-2006-6736)

  - Two vulnerabilities in the Java(TM) Runtime Environment     with serialization may independently allow an untrusted     applet or application to elevate its privileges.
    (CVE-2006-6745)

The IBM Java JRE/SDK has been brought to release 1.4.2 SR containing several bugfixes, including following security fixes :

  - A buffer overflow vulnerability in the Java(TM) Runtime     Environment may allow an untrusted applet to elevate its     privileges. For example, an applet may grant itself     permissions to read and write local files or execute     local applications that are accessible to the user     running the untrusted applet. (CVE-2007-0243)

  - Two vulnerabilities in the Java Runtime Environment may     independently allow an untrusted applet to access data     in other applets. (CVE-2006-6737 / CVE-2006-6736)

  - Two vulnerabilities in the Java(TM) Runtime Environment     with serialization may independently allow an untrusted     applet or application to elevate its privileges.
    (CVE-2006-6745)

The remote host is affected by the vulnerability described in GLSA-200705-20 (Blackdown Java: Applet privilege escalation)

    Chris Evans has discovered multiple buffer overflows in the Sun JDK and     the Sun JRE possibly related to various AWT and font layout functions.
    Tom Hawtin has discovered an unspecified vulnerability in the Sun JDK     and the Sun JRE relating to unintended applet data access. He has also     discovered multiple other unspecified vulnerabilities in the Sun JDK     and the Sun JRE allowing unintended Java applet or application resource     acquisition. Additionally, a memory corruption error has been found in     the handling of GIF images with zero width field blocks.
  Impact :

    An attacker could entice a user to run a specially crafted Java applet     or application that could read, write, or execute local files with the     privileges of the user running the JVM, access data maintained in other     Java applets, or escalate the privileges of the currently running Java     applet or application allowing for unauthorized access to system     resources.
  Workaround :

    Disable the 'nsplugin' USE flag in order to prevent web applets from     being run.

The remote host is affected by the vulnerability described in GLSA-200702-08 (AMD64 x86 emulation Sun's J2SE Development Kit: Multiple vulnerabilities)

    Chris Evans has discovered multiple buffer overflows in Sun JDK and Sun     JRE possibly related to various AWT or font layout functions. Tom     Hawtin has discovered an unspecified vulnerability in Sun JDK and Sun     JRE relating to unintended applet data access. He has also discovered     multiple other unspecified vulnerabilities in Sun JDK and Sun JRE     allowing unintended Java applet or application resource acquisition.
    Additionally, a memory corruption error has been found in the handling     of GIF images with zero width field blocks.
  Impact :

    An attacker could entice a user to run a specially crafted Java applet     or application that could read, write, or execute local files with the     privileges of the user running the JVM, access data maintained in other     Java applets, or escalate the privileges of the currently running Java     applet or application allowing for unauthorized access to system     resources.
  Workaround :

    There is no known workaround at this time.

The remote host is affected by the vulnerability described in GLSA-200701-15 (Sun JDK/JRE: Multiple vulnerabilities)

    Chris Evans has discovered multiple buffer overflows in Sun JDK and Sun     JRE possibly related to various AWT or font layout functions. Tom     Hawtin has discovered an unspecified vulnerability in Sun JDK and Sun     JRE relating to unintended applet data access. He has also discovered     multiple other unspecified vulnerabilities in Sun JDK and Sun JRE     allowing unintended Java applet or application resource acquisition.
  Impact :

    An attacker could entice a user to run a specially crafted Java applet     or application that could read, write, or execute local files with the     privileges of the user running the JVM; access data maintained in other     Java applets; or escalate the privileges of the currently running Java     applet or application allowing for unauthorized access to system     resources.
  Workaround :

    There is no known workaround at this time.

According to its version number, the Sun JRE installed on the remote host has two buffer overflow issues that may allow an untrusted applet to elevate its privileges to, for example, read or write local files or to execute local applications subject to the privileges of the user running the applet. 

In addition, another set of vulnerabilities may allow an untrusted applet to access data in other applets.

ID	Name	Product	Family	Severity
64818	Sun Java JRE Multiple Vulnerabilities (102729 / 102732) (Unix)	Nessus	Misc.	high
63839	RHEL 4 : java-1.5.0-ibm (RHSA-2007:0073)	Nessus	Red Hat Local Security Checks	high
63837	RHEL 3 / 4 : java-1.4.2-ibm (RHSA-2007:0062)	Nessus	Red Hat Local Security Checks	high
29702	Mac OS X : Java for Mac OS X 10.4 Release 6	Nessus	MacOS X Local Security Checks	critical
29474	SuSE 10 Security Update : Java (ZYPP Patch Number 3891)	Nessus	SuSE Local Security Checks	high
29469	SuSE 10 Security Update : IBM Java (ZYPP Patch Number 3851)	Nessus	SuSE Local Security Checks	high
25341	GLSA-200705-20 : Blackdown Java: Applet privilege escalation	Nessus	Gentoo Local Security Checks	high
24369	GLSA-200702-08 : AMD64 x86 emulation Sun's J2SE Development Kit: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
24251	GLSA-200701-15 : Sun JDK/JRE: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
23931	Sun Java JRE Multiple Vulnerabilities (102729 / 102732)	Nessus	Windows	high

Detections

Analytics

CVE-2006-6745

critical

Tenable Plugins

high

high

high

critical

high

high

high

high

high

high