Multiple unspecified vulnerabilities in the Java Runtime Environment in Sun JDK and JRE 6 Update 1 and earlier, and 5.0 Update 13 and earlier, allow context-dependent attackers to gain privileges via an untrusted (1) application or (2) applet, as demonstrated by an application or applet that grants itself privileges to (a) read local files, (b) write to local files, or (c) execute local programs.

The version of Sun Java Runtime Environment (JRE) installed on the remote host reportedly contains two vulnerabilities that may independently allow an untrusted application or applet to elevate its privileges by, for example, granting itself permission to read and write local files or execute local applications subject to the privileges of the user running the application or applet.

Updated java-1.5.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 4 Extras and 5 Supplementary.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

IBM's 1.5.0 Java release includes the IBM Java 2 Runtime Environment and the IBM Java 2 Software Development Kit.

Two vulnerabilities in the Java Runtime Environment allowed an untrusted application or applet to elevate the assigned privileges.
This could be misused by a malicious website to read and write local files or execute local applications in the context of the user running the Java process. (CVE-2008-0657)

A flaw was found in the Java XSLT processing classes. An untrusted application or applet could cause a denial of service, or execute arbitrary code with the permissions of the user running the JRE.
(CVE-2008-1187)

Several buffer overflow flaws were found in Java Web Start (JWS). An untrusted JNLP application could access local files or execute local applications accessible to the user running the JRE. (CVE-2008-1188, CVE-2008-1189, CVE-2008-1190, CVE-2008-1196)

A flaw was found in the Java Plug-in. A remote attacker could bypass the same origin policy, executing arbitrary code with the permissions of the user running the JRE. (CVE-2008-1192)

A flaw was found in the JRE image parsing libraries. An untrusted application or applet could cause a denial of service, or possible execute arbitrary code with the permissions of the user running the JRE. (CVE-2008-1193)

A flaw was found in the JRE color management library. An untrusted application or applet could trigger a denial of service (JVM crash).
(CVE-2008-1194)

The JRE allowed untrusted JavaScript code to create local network connections by the use of Java APIs. A remote attacker could use these flaws to access local network services. (CVE-2008-1195)

All users of java-ibm-1.5.0 are advised to upgrade to these updated packages, that contain IBM's 1.5.0 SR7 Java release which resolves these issues.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2008:0156 advisory.

  - Security Vulnerability in Java Runtime Environment With Applet Caching (CVE-2007-5232)

  - Untrusted Application or Applet May Move or Copy Arbitrary Files (CVE-2007-5239)

  - Applets or Applications are allowed to display an oversized window (CVE-2007-5240)

  - Anti-DNS Pinning and Java Applets with HTTP proxy (CVE-2007-5273)

  - java-1.5.0 Privilege escalation via unstrusted applet and application (CVE-2008-0657)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated java-1.5.0-sun packages that correct several security issues are now available for Red Hat Enterprise Linux 4 Extras and 5 Supplementary.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

The Java Runtime Environment (JRE) contains the software and tools that users need to run applets and applications written using the Java programming language.

These updated java-1.5.0-sun packages resolve the following security issues :

Two vulnerabilities in the Java Runtime Environment allowed an untrusted application or applet to elevate the assigned privileges.
This could be misused by a malicious website to read and write local files or execute local applications in the context of the user running the Java process. (CVE-2008-0657)

Users of java-1.5.0-sun should upgrade to these updated packages, which contain backported patches to correct these issues.

ESX patches and updates for VirtualCenter fix the following application vulnerabilities.

 a. Tomcat Server Security Update

The ESX patches and the updates for VirtualCenter update the Tomcat Server package to version 5.5.26, which addresses multiple security issues that existed in earlier releases of Tomcat Server.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2007-5333, CVE-2007-5342, CVE-2007-5461, CVE-2007-6286 to the security issues fixed in Tomcat 5.5.26.

 b. JRE Security Update

The ESX patches and the updates for VirtualCenter update the JRE package to version 1.5.0_15, which addresses multiple security issues that existed in earlier releases of JRE.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2008-1185, CVE-2008-1186, CVE-2008-1187, CVE-2008-1188, CVE-2008-1189, CVE-2008-1190, CVE-2008-1191, CVE-2008-1192, CVE-2008-1193, CVE-2008-1194, CVE-2008-1195, CVE-2008-1196, CVE-2008-0657, CVE-2007-5689, CVE-2007-5232, CVE-2007-5236, CVE-2007-5237, CVE-2007-5238, CVE-2007-5239, CVE-2007-5240, CVE-2007-5274 to the security issues fixed in JRE 1.5.0_12, JRE 1.5.0_13, JRE 1.5.0_14, JRE 1.5.0_15.

IBM Java 5 was updated to SR7 to fix various security issues :

  - A buffer overflow vulnerability in Java Web Start may     allow an untrusted Java Web Start application that is     downloaded from a website to elevate its privileges. For     example, an untrusted Java Web Start application may     grant itself permissions to read and write local files     or execute local applications that are accessible to the     user running the untrusted application. (CVE-2008-1196)

  - A vulnerability in the Java Runtime Environment may     allow JavaScript(TM) code that is downloaded by a     browser to make connections to network services on the     system that the browser runs on, through Java APIs, This     may allow files (that are accessible through these     network services) or vulnerabilities (that exist on     these network services) which are not otherwise normally     accessible to be accessed or exploited. (CVE-2008-1195)

  - Two buffer overflow vulnerabilities may allow an     untrusted applet or application to cause the Java     Runtime Environment to crash. (CVE-2008-1194)

  - A buffer overflow vulnerability in the Java Runtime     Environment image parsing code may allow an untrusted     applet or application to create a denial-of-service     condition, by causing the Java Runtime Environment to     crash. (CVE-2008-1194)

  - A buffer overflow vulnerability in the Java Runtime     Environment image parsing code allow an untrusted applet     or application to elevate its privileges. For example,     an application may grant itself permissions to read and     write local files or execute local applications that are     accessible to the user running the untrusted     application. (CVE-2008-1193)

  - A vulnerability in the Java Plug-in may an untrusted     applet to bypass same origin policy and leverage this     flaw to execute local applications that are accessible     to the user running the untrusted applet.
    (CVE-2008-1192)

  - A vulnerability in Java Web Start may allow an untrusted     Java Web Start application to elevate its privileges.
    For example, an application may grant itself permissions     to read and write local files or execute local     applications that are accessible to the user running the     untrusted application. (CVE-2008-1190)

  - A buffer overflow vulnerability in the Java Runtime     Environment may allow an untrusted applet or application     to elevate its privileges. For example, an applet may     grant itself permissions to read and write local files     or execute local applications that are accessible to the     user running the untrusted applet. (CVE-2008-1189)

  - Two buffer overflow vulnerabilities in Java Web Start     may independently allow an untrusted Java Web Start     application to elevate its privileges. For example, an     untrusted Java Web Start application may grant itself     permissions to read and write local files or execute     local applications that are accessible to the user     running the untrusted application. (CVE-2008-1188)

  - A vulnerability in the Java Runtime Environment with     parsing XML data may allow an untrusted applet or     application to elevate its privileges. For example, an     applet may read certain URL resources (such as some     files and web pages). (CVE-2008-1187)

  - A vulnerability in the Java Runtime Environment may     allow an untrusted application or applet that is     downloaded from a website to elevate its privileges. For     example, the application or applet may grant itself     permissions to read and write local files or execute     local applications that are accessible to the user     running the untrusted application or applet.
    (CVE-2008-0657)

  - A vulnerability in the Java Runtime Environment (JRE)     with applet caching may allow an untrusted applet that     is downloaded from a malicious website to make network     connections to network services on machines other than     the one that the applet was downloaded from. This may     allow network resources (such as web pages) and     vulnerabilities (that exist on these network services)     which are not otherwise normally accessible to be     accessed or exploited. (CVE-2007-5232)

  - A vulnerability in the Java Runtime Environment (JRE)     may allow malicious JavaScript code that is downloaded     by a browser from a malicious website to make network     connections, through Java APIs, to network services on     machines other than the one that the JavaScript code was     downloaded from. This may allow network resources (such     as web pages) and vulnerabilities (that exist on these     network services) which are not otherwise normally     accessible to be accessed or exploited. (CVE-2007-5274)

  - A second vulnerability in the JRE may allow an untrusted     applet that is downloaded from a malicious website     through a web proxy to make network connections to     network services on machines other than the one that the     applet was downloaded from. This may allow network     resources (such as web pages) and vulnerabilities (that     exist on these network services) which are not otherwise     normally accessible to be accessed or exploited.
    (CVE-2007-5273)

  - An untrusted Java Web Start application may write     arbitrary files with the privileges of the user running     the application. (CVE-2007-5236)

  - Three separate vulnerabilities may allow an untrusted     Java Web Start application to determine the location of     the Java Web Start cache. (CVE-2007-5238)

  - An untrusted Java Web Start application or Java applet     may move or copy arbitrary files by requesting the user     of the application or applet to drag and drop a file     from the Java Web Start application or Java applet     window. (CVE-2007-5239)

  - An untrusted applet may display an over-sized window so     that the applet warning banner is not visible to the     user running the untrusted applet. (CVE-2007-5240)

  - A vulnerability in the font parsing code in the Java     Runtime Environment may allow an untrusted applet to     elevate its privileges. For example, an applet may grant     itself permissions to read and write local files or     execute local applications that are accessible to the     user running the untrusted applet. (CVE-2007-4381)

The remote host is affected by the vulnerability described in GLSA-200804-20 (Sun JDK/JRE: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Sun Java:
    Daniel Soeder discovered that a long codebase attribute string in a     JNLP file will overflow a stack variable when launched by Java WebStart     (CVE-2007-3655).
    Multiple vulnerabilities (CVE-2007-2435, CVE-2007-2788,     CVE-2007-2789) that were previously reported as GLSA 200705-23 and GLSA     200706-08 also affect 1.4 and 1.6 SLOTs, which was not mentioned in the     initial revision of said GLSAs.
    The Zero Day Initiative, TippingPoint and John Heasman reported     multiple buffer overflows and unspecified vulnerabilities in Java Web     Start (CVE-2008-1188, CVE-2008-1189, CVE-2008-1190,     CVE-2008-1191).
    Hisashi Kojima of Fujitsu and JPCERT/CC reported a security issue     when performing XSLT transformations (CVE-2008-1187).
    CERT/CC reported a Stack-based buffer overflow in Java Web Start     when using JNLP files (CVE-2008-1196).
    Azul Systems reported an unspecified vulnerability that allows     applets to escalate their privileges (CVE-2007-5689).
    Billy Rios, Dan Boneh, Collin Jackson, Adam Barth, Andrew Bortz,     Weidong Shao, and David Byrne discovered multiple instances where Java     applets or JavaScript programs run within browsers do not pin DNS     hostnames to a single IP address, allowing for DNS rebinding attacks     (CVE-2007-5232, CVE-2007-5273, CVE-2007-5274).
    Peter Csepely reported that Java Web Start does not properly     enforce access restrictions for untrusted applications (CVE-2007-5237,     CVE-2007-5238).
    Java Web Start does not properly enforce access restrictions for     untrusted Java applications and applets, when handling drag-and-drop     operations (CVE-2007-5239).
    Giorgio Maone discovered that warnings for untrusted code can be     hidden under applications' windows (CVE-2007-5240).
    Fujitsu reported two security issues where security restrictions of     web applets and applications were not properly enforced (CVE-2008-1185,     CVE-2008-1186).
    John Heasman of NGSSoftware discovered that the Java Plug-in does     not properly enforce the same origin policy (CVE-2008-1192).
    Chris Evans of the Google Security Team discovered multiple     unspecified vulnerabilities within the Java Runtime Environment Image     Parsing Library (CVE-2008-1193, CVE-2008-1194).
    Gregory Fleischer reported that web content fetched via the 'jar:'     protocol was not subject to network access restrictions     (CVE-2008-1195).
    Chris Evans and Johannes Henkel of the Google Security Team     reported that the XML parsing code retrieves external entities even     when that feature is disabled (CVE-2008-0628).
    Multiple unspecified vulnerabilities might allow for escalation of     privileges (CVE-2008-0657).
  Impact :

    A remote attacker could entice a user to run a specially crafted applet     on a website or start an application in Java Web Start to execute     arbitrary code outside of the Java sandbox and of the Java security     restrictions with the privileges of the user running Java. The attacker     could also obtain sensitive information, create, modify, rename and     read local files, execute local applications, establish connections in     the local network, bypass the same origin policy, and cause a Denial of     Service via multiple vectors.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
64826	Sun Java JRE Applet Handling Privilege Escalation (231261) (Unix)	Nessus	Misc.	critical
40718	RHEL 4 / 5 : java-1.5.0-ibm (RHSA-2008:0210)	Nessus	Red Hat Local Security Checks	critical
40716	RHEL 5 : java-1.5.0-bea (RHSA-2008:0156)	Nessus	Red Hat Local Security Checks	critical
40713	RHEL 4 / 5 : java-1.5.0-sun (RHSA-2008:0123)	Nessus	Red Hat Local Security Checks	critical
40379	VMSA-2008-0010 : Updated Tomcat and Java JRE packages for VMware ESX 3.5 and VirtualCenter	Nessus	VMware ESX Local Security Checks	critical
32050	SuSE 10 Security Update : IBM Java 1.5.0 (ZYPP Patch Number 5183)	Nessus	SuSE Local Security Checks	critical
32013	GLSA-200804-20 : Sun JDK/JRE: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
31344	Sun Java JRE Applet Handling Privilege Escalation (231261)	Nessus	Windows	high

Detections

Analytics

CVE-2008-0657

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

high