Unspecified vulnerability in Java Runtime Environment Image Parsing Library in Sun JDK and JRE 6 Update 4 and earlier, and 5.0 Update 14 and earlier, allows remote attackers to gain privileges via an untrusted application.

The version of Sun Java Runtime Environment (JRE) installed on the remote host is affected by one or more security issues :

  - Two vulnerabilities in the JRE VM may independently allow     an untrusted application or applet downloaded from a     website to elevate its privileges (233321).

  - When processing XSLT transformations, an untrusted     application or applet downloaded from a website may     be able to elevate its privileges or cause the JRE to     crash (233322).

  - Three buffer overflows exist in Java Web Start (233323).

  - A vulnerability in the Java Plug-in may allow an applet     downloaded from a website to bypass the same origin     policy and execute local applications (233324).

  - Multiple vulnerabilities in the JRE Image Processing     library may allow an untrusted application or applet     to elevate its privileges or cause the JRE to crash     (233325).

  - A vulnerability in the JRE may allow untrusted     JavaScript code to elevate its privileges through     Java APIs (233326).

  - An as-yet unspecified buffer overflow exists in Java     Web Start (233327).

Updated java-1.6.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 5 Supplementary.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

IBM's 1.6.0 Java release includes the IBM Java 2 Runtime Environment, and the IBM Java 2 Software Development Kit.

A flaw was found in the Java XSLT processing classes. An untrusted application or applet could cause a denial of service, or execute arbitrary code with the permissions of the user running the JRE.
(CVE-2008-1187)

Several buffer overflow flaws were found in Java Web Start (JWS). An untrusted JNLP application could access local files, or execute local applications accessible to the user running the JRE. (CVE-2008-1188, CVE-2008-1189, CVE-2008-1190, CVE-2008-1191, CVE-2008-1196)

A flaw was found in the Java plug-in. A remote attacker could bypass the same origin policy, executing arbitrary code with the permissions of the user running the JRE. (CVE-2008-1192)

A flaw was found in the JRE image parsing libraries. An untrusted application or applet could cause a denial of service, or possibly execute arbitrary code with the permissions of the user running the JRE. (CVE-2008-1193)

A flaw was found in the JRE color management library. An untrusted application or applet could trigger a denial of service (JVM crash).
(CVE-2008-1194)

The JRE allowed untrusted JavaScript code to create local network connections by the use of Java APIs. A remote attacker could use these flaws to access local network services. (CVE-2008-1195)

All users of java-1.6.0-ibm are advised to upgrade to these updated packages, that contain IBM's 1.6.0 SR1 Java release, which resolves these issues.

Updated java-1.6.0-bea packages that correct several security issues are now available for Red Hat Enterprise Linux 5 Supplementary.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The BEA WebLogic JRockit 1.6.0_03 JRE and SDK contain BEA WebLogic JRockit Virtual Machine 1.6.0_03, and are certified for the Java 6 Platform, Standard Edition, v1.6.0.

The Java XML parsing code processed external entity references even when the 'external general entities' property was set to 'FALSE'. This allowed remote attackers to conduct XML External Entity (XXE) attacks, possibly causing a denial of service, or gaining access to restricted resources. (CVE-2008-0628)

A flaw was found in the Java XSLT processing classes. An untrusted application or applet could cause a denial of service, or execute arbitrary code with the permissions of the user running the JRE.
(CVE-2008-1187)

A flaw was found in the JRE image parsing libraries. An untrusted application or applet could cause a denial of service, or possible execute arbitrary code with the permissions of the user running the JRE. (CVE-2008-1193)

A flaw was found in the JRE color management library. An untrusted application or applet could trigger a denial of service (JVM crash).
(CVE-2008-1194)

The vulnerabilities concerning applets listed above can only be triggered in java-1.6.0-bea, by calling the 'appletviewer' application.

Users of java-1.6.0-bea are advised to upgrade to these updated packages, which resolve these issues.

Flaws in the JRE allowed an untrusted application or applet to elevate its privileges. This could be exploited by a remote attacker to access local files or execute local applications accessible to the user running the JRE (CVE-2008-1185, CVE-2008-1186)

A flaw was found in the Java XSLT processing classes. An untrusted application or applet could cause a denial of service, or execute arbitrary code with the permissions of the user running the JRE.
(CVE-2008-1187)

Several buffer overflow flaws were found in Java Web Start (JWS). An untrusted JNLP application could access local files or execute local applications accessible to the user running the JRE. (CVE-2008-1188, CVE-2008-1189, CVE-2008-1190, CVE-2008-1191, CVE-2008-1196)

A flaw was found in the Java Plug-in. A remote attacker could bypass the same origin policy, executing arbitrary code with the permissions of the user running the JRE. (CVE-2008-1192)

A flaw was found in the JRE image parsing libraries. An untrusted application or applet could cause a denial of service, or possible execute arbitrary code with the permissions of the user running the JRE. (CVE-2008-1193)

A flaw was found in the JRE color management library. An untrusted application or applet could trigger a denial of service (JVM crash).
(CVE-2008-1194)

The JRE allowed untrusted JavaScript code to create local network connections by the use of Java APIs. A remote attacker could use these flaws to access local network services. (CVE-2008-1195)

A vulnerability was found in the Java Management Extensions (JMX) management agent, when local monitoring is enabled. This allowed remote attackers to perform illegal operations. (CVE-2008-3103)

Multiple vulnerabilities with unsigned applets were reported. A remote attacker could misuse an unsigned applet to connect to localhost services running on the host running the applet. (CVE-2008-3104)

A Java Runtime Environment (JRE) vulnerability could be triggered by an untrusted application or applet. A remote attacker could grant an untrusted applet extended privileges such as reading and writing local files, or executing local programs. (CVE-2008-3107)

Several buffer overflow vulnerabilities in Java Web Start were reported. These vulnerabilities may allow an untrusted Java Web Start application to elevate its privileges and thereby grant itself permission to read and/or write local files, as well as to execute local applications accessible to the user running the untrusted application. (CVE-2008-3111)

Two file processing vulnerabilities in Java Web Start were found. A remote attacker, by means of an untrusted Java Web Start application, was able to create or delete arbitrary files with the permissions of the user running the untrusted application. (CVE-2008-3112, CVE-2008-3113)

A vulnerability in Java Web Start when processing untrusted applications was reported. An attacker was able to acquire sensitive information, such as the cache location. (CVE-2008-3114)

Updated java-1.5.0-bea packages that correct several security issues are now available for Red Hat Enterprise Linux 4 Extras and 5 Supplementary.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The BEA WebLogic JRockit 1.5.0_14 JRE and SDK contain BEA WebLogic JRockit Virtual Machine 1.5.0_14, and are certified for the Java 5 Platform, Standard Edition, v1.5.0.

A flaw was found in the Java XSLT processing classes. An untrusted application or applet could cause a denial of service, or execute arbitrary code with the permissions of the user running the JRE.
(CVE-2008-1187)

A flaw was found in the JRE image parsing libraries. An untrusted application or applet could cause a denial of service, or possibly execute arbitrary code with the permissions of the user running the JRE. (CVE-2008-1193)

A flaw was found in the JRE color management library. An untrusted application or applet could trigger a denial of service (JVM crash).
(CVE-2008-1194)

The vulnerabilities concerning applets listed above can only be triggered in java-1.5.0-bea, by calling the 'appletviewer' application.

Users of java-1.5.0-bea are advised to upgrade to these updated packages, which resolve these issues.

Updated java-1.5.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 4 Extras and 5 Supplementary.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

IBM's 1.5.0 Java release includes the IBM Java 2 Runtime Environment and the IBM Java 2 Software Development Kit.

Two vulnerabilities in the Java Runtime Environment allowed an untrusted application or applet to elevate the assigned privileges.
This could be misused by a malicious website to read and write local files or execute local applications in the context of the user running the Java process. (CVE-2008-0657)

A flaw was found in the Java XSLT processing classes. An untrusted application or applet could cause a denial of service, or execute arbitrary code with the permissions of the user running the JRE.
(CVE-2008-1187)

Several buffer overflow flaws were found in Java Web Start (JWS). An untrusted JNLP application could access local files or execute local applications accessible to the user running the JRE. (CVE-2008-1188, CVE-2008-1189, CVE-2008-1190, CVE-2008-1196)

A flaw was found in the Java Plug-in. A remote attacker could bypass the same origin policy, executing arbitrary code with the permissions of the user running the JRE. (CVE-2008-1192)

A flaw was found in the JRE image parsing libraries. An untrusted application or applet could cause a denial of service, or possible execute arbitrary code with the permissions of the user running the JRE. (CVE-2008-1193)

A flaw was found in the JRE color management library. An untrusted application or applet could trigger a denial of service (JVM crash).
(CVE-2008-1194)

The JRE allowed untrusted JavaScript code to create local network connections by the use of Java APIs. A remote attacker could use these flaws to access local network services. (CVE-2008-1195)

All users of java-ibm-1.5.0 are advised to upgrade to these updated packages, that contain IBM's 1.5.0 SR7 Java release which resolves these issues.

Updated java-1.5.0-sun packages that correct several security issues are now available for Red Hat Enterprise Linux 4 Extras and 5 Supplementary.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

The Java Runtime Environment (JRE) contains the software and tools that users need to run applets and applications written using the Java programming language.

Flaws in the JRE allowed an untrusted application or applet to elevate its privileges. This could be exploited by a remote attacker to access local files or execute local applications accessible to the user running the JRE (CVE-2008-1185, CVE-2008-1186)

A flaw was found in the Java XSLT processing classes. An untrusted application or applet could cause a denial of service, or execute arbitrary code with the permissions of the user running the JRE.
(CVE-2008-1187)

Several buffer overflow flaws were found in Java Web Start (JWS). An untrusted JNLP application could access local files or execute local applications accessible to the user running the JRE. (CVE-2008-1188, CVE-2008-1189, CVE-2008-1190, CVE-2008-1191, CVE-2008-1196)

A flaw was found in the Java Plug-in. A remote attacker could bypass the same origin policy, executing arbitrary code with the permissions of the user running the JRE. (CVE-2008-1192)

A flaw was found in the JRE image parsing libraries. An untrusted application or applet could cause a denial of service, or possible execute arbitrary code with the permissions of the user running the JRE. (CVE-2008-1193)

A flaw was found in the JRE color management library. An untrusted application or applet could trigger a denial of service (JVM crash).
(CVE-2008-1194)

The JRE allowed untrusted JavaScript code to create local network connections by the use of Java APIs. A remote attacker could use these flaws to access local network services. (CVE-2008-1195)

This update also fixes an issue where the Java Plug-in is not available for browser use after successful installation.

Users of java-1.5.0-sun should upgrade to these updated packages, which correct these issues.

ESX patches and updates for VirtualCenter fix the following application vulnerabilities.

 a. Tomcat Server Security Update

The ESX patches and the updates for VirtualCenter update the Tomcat Server package to version 5.5.26, which addresses multiple security issues that existed in earlier releases of Tomcat Server.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2007-5333, CVE-2007-5342, CVE-2007-5461, CVE-2007-6286 to the security issues fixed in Tomcat 5.5.26.

 b. JRE Security Update

The ESX patches and the updates for VirtualCenter update the JRE package to version 1.5.0_15, which addresses multiple security issues that existed in earlier releases of JRE.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2008-1185, CVE-2008-1186, CVE-2008-1187, CVE-2008-1188, CVE-2008-1189, CVE-2008-1190, CVE-2008-1191, CVE-2008-1192, CVE-2008-1193, CVE-2008-1194, CVE-2008-1195, CVE-2008-1196, CVE-2008-0657, CVE-2007-5689, CVE-2007-5232, CVE-2007-5236, CVE-2007-5237, CVE-2007-5238, CVE-2007-5239, CVE-2007-5240, CVE-2007-5274 to the security issues fixed in JRE 1.5.0_12, JRE 1.5.0_13, JRE 1.5.0_14, JRE 1.5.0_15.

The remote Mac OS X 10.4 host is running a version of Java for Mac OS X that is older than release 7.

The remote version of this software contains several security vulnerabilities which may allow a rogue java applet to execute arbitrary code on the remote host.

To exploit these flaws, an attacker would need to lure an attacker into executing a rogue Java applet.

The remote Mac OS X 10.5 host is running a version of Java for Mac OS X that is missing update 2.

The remote version of this software contains several security vulnerabilities that may allow a rogue Java applet to execute arbitrary code on the remote host.

To exploit these flaws, an attacker would need to lure an attacker into executing a rogue Java applet.

IBM Java 5 was updated to SR7 to fix various security issues :

  - A buffer overflow vulnerability in Java Web Start may     allow an untrusted Java Web Start application that is     downloaded from a website to elevate its privileges. For     example, an untrusted Java Web Start application may     grant itself permissions to read and write local files     or execute local applications that are accessible to the     user running the untrusted application. (CVE-2008-1196)

  - A vulnerability in the Java Runtime Environment may     allow JavaScript(TM) code that is downloaded by a     browser to make connections to network services on the     system that the browser runs on, through Java APIs, This     may allow files (that are accessible through these     network services) or vulnerabilities (that exist on     these network services) which are not otherwise normally     accessible to be accessed or exploited. (CVE-2008-1195)

  - Two buffer overflow vulnerabilities may allow an     untrusted applet or application to cause the Java     Runtime Environment to crash. (CVE-2008-1194)

  - A buffer overflow vulnerability in the Java Runtime     Environment image parsing code may allow an untrusted     applet or application to create a denial-of-service     condition, by causing the Java Runtime Environment to     crash. (CVE-2008-1194)

  - A buffer overflow vulnerability in the Java Runtime     Environment image parsing code allow an untrusted applet     or application to elevate its privileges. For example,     an application may grant itself permissions to read and     write local files or execute local applications that are     accessible to the user running the untrusted     application. (CVE-2008-1193)

  - A vulnerability in the Java Plug-in may an untrusted     applet to bypass same origin policy and leverage this     flaw to execute local applications that are accessible     to the user running the untrusted applet.
    (CVE-2008-1192)

  - A vulnerability in Java Web Start may allow an untrusted     Java Web Start application to elevate its privileges.
    For example, an application may grant itself permissions     to read and write local files or execute local     applications that are accessible to the user running the     untrusted application. (CVE-2008-1190)

  - A buffer overflow vulnerability in the Java Runtime     Environment may allow an untrusted applet or application     to elevate its privileges. For example, an applet may     grant itself permissions to read and write local files     or execute local applications that are accessible to the     user running the untrusted applet. (CVE-2008-1189)

  - Two buffer overflow vulnerabilities in Java Web Start     may independently allow an untrusted Java Web Start     application to elevate its privileges. For example, an     untrusted Java Web Start application may grant itself     permissions to read and write local files or execute     local applications that are accessible to the user     running the untrusted application. (CVE-2008-1188)

  - A vulnerability in the Java Runtime Environment with     parsing XML data may allow an untrusted applet or     application to elevate its privileges. For example, an     applet may read certain URL resources (such as some     files and web pages). (CVE-2008-1187)

  - A vulnerability in the Java Runtime Environment may     allow an untrusted application or applet that is     downloaded from a website to elevate its privileges. For     example, the application or applet may grant itself     permissions to read and write local files or execute     local applications that are accessible to the user     running the untrusted application or applet.
    (CVE-2008-0657)

  - A vulnerability in the Java Runtime Environment (JRE)     with applet caching may allow an untrusted applet that     is downloaded from a malicious website to make network     connections to network services on machines other than     the one that the applet was downloaded from. This may     allow network resources (such as web pages) and     vulnerabilities (that exist on these network services)     which are not otherwise normally accessible to be     accessed or exploited. (CVE-2007-5232)

  - A vulnerability in the Java Runtime Environment (JRE)     may allow malicious JavaScript code that is downloaded     by a browser from a malicious website to make network     connections, through Java APIs, to network services on     machines other than the one that the JavaScript code was     downloaded from. This may allow network resources (such     as web pages) and vulnerabilities (that exist on these     network services) which are not otherwise normally     accessible to be accessed or exploited. (CVE-2007-5274)

  - A second vulnerability in the JRE may allow an untrusted     applet that is downloaded from a malicious website     through a web proxy to make network connections to     network services on machines other than the one that the     applet was downloaded from. This may allow network     resources (such as web pages) and vulnerabilities (that     exist on these network services) which are not otherwise     normally accessible to be accessed or exploited.
    (CVE-2007-5273)

  - An untrusted Java Web Start application may write     arbitrary files with the privileges of the user running     the application. (CVE-2007-5236)

  - Three separate vulnerabilities may allow an untrusted     Java Web Start application to determine the location of     the Java Web Start cache. (CVE-2007-5238)

  - An untrusted Java Web Start application or Java applet     may move or copy arbitrary files by requesting the user     of the application or applet to drag and drop a file     from the Java Web Start application or Java applet     window. (CVE-2007-5239)

  - An untrusted applet may display an over-sized window so     that the applet warning banner is not visible to the     user running the untrusted applet. (CVE-2007-5240)

  - A vulnerability in the font parsing code in the Java     Runtime Environment may allow an untrusted applet to     elevate its privileges. For example, an applet may grant     itself permissions to read and write local files or     execute local applications that are accessible to the     user running the untrusted applet. (CVE-2007-4381)

The remote host is affected by the vulnerability described in GLSA-200804-20 (Sun JDK/JRE: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Sun Java:
    Daniel Soeder discovered that a long codebase attribute string in a     JNLP file will overflow a stack variable when launched by Java WebStart     (CVE-2007-3655).
    Multiple vulnerabilities (CVE-2007-2435, CVE-2007-2788,     CVE-2007-2789) that were previously reported as GLSA 200705-23 and GLSA     200706-08 also affect 1.4 and 1.6 SLOTs, which was not mentioned in the     initial revision of said GLSAs.
    The Zero Day Initiative, TippingPoint and John Heasman reported     multiple buffer overflows and unspecified vulnerabilities in Java Web     Start (CVE-2008-1188, CVE-2008-1189, CVE-2008-1190,     CVE-2008-1191).
    Hisashi Kojima of Fujitsu and JPCERT/CC reported a security issue     when performing XSLT transformations (CVE-2008-1187).
    CERT/CC reported a Stack-based buffer overflow in Java Web Start     when using JNLP files (CVE-2008-1196).
    Azul Systems reported an unspecified vulnerability that allows     applets to escalate their privileges (CVE-2007-5689).
    Billy Rios, Dan Boneh, Collin Jackson, Adam Barth, Andrew Bortz,     Weidong Shao, and David Byrne discovered multiple instances where Java     applets or JavaScript programs run within browsers do not pin DNS     hostnames to a single IP address, allowing for DNS rebinding attacks     (CVE-2007-5232, CVE-2007-5273, CVE-2007-5274).
    Peter Csepely reported that Java Web Start does not properly     enforce access restrictions for untrusted applications (CVE-2007-5237,     CVE-2007-5238).
    Java Web Start does not properly enforce access restrictions for     untrusted Java applications and applets, when handling drag-and-drop     operations (CVE-2007-5239).
    Giorgio Maone discovered that warnings for untrusted code can be     hidden under applications' windows (CVE-2007-5240).
    Fujitsu reported two security issues where security restrictions of     web applets and applications were not properly enforced (CVE-2008-1185,     CVE-2008-1186).
    John Heasman of NGSSoftware discovered that the Java Plug-in does     not properly enforce the same origin policy (CVE-2008-1192).
    Chris Evans of the Google Security Team discovered multiple     unspecified vulnerabilities within the Java Runtime Environment Image     Parsing Library (CVE-2008-1193, CVE-2008-1194).
    Gregory Fleischer reported that web content fetched via the 'jar:'     protocol was not subject to network access restrictions     (CVE-2008-1195).
    Chris Evans and Johannes Henkel of the Google Security Team     reported that the XML parsing code retrieves external entities even     when that feature is disabled (CVE-2008-0628).
    Multiple unspecified vulnerabilities might allow for escalation of     privileges (CVE-2008-0657).
  Impact :

    A remote attacker could entice a user to run a specially crafted applet     on a website or start an application in Java Web Start to execute     arbitrary code outside of the Java sandbox and of the Java security     restrictions with the privileges of the user running Java. The attacker     could also obtain sensitive information, create, modify, rename and     read local files, execute local applications, establish connections in     the local network, bypass the same origin policy, and cause a Denial of     Service via multiple vectors.
  Workaround :

    There is no known workaround at this time.

The version of Sun Java Runtime Environment (JRE) installed on the remote host is affected by one or more security issues :

  - Two vulnerabilities in the JRE VM may independently allow     an untrusted application or applet downloaded from a     website to elevate its privileges (233321).

  - When processing XSLT transformations, an untrusted     application or applet downloaded from a website may     be able to elevate its privileges or cause the JRE to     crash (233322).

  - Three buffer overflows exist in Java Web Start (233323).

  - A vulnerability in the Java Plug-in may allow an applet     download from a website to bypass the same origin policy     and execute local applications (233324).

  - Multiple vulnerabilities in the JRE Image Processing     library may allow an untrusted application or applet     to elevate its privileges or cause the JRE to crash     (233325).

  - A vulnerability in the JRE may allow untrusted     JavaScript code to elevate its privileges through     Java APIs (233326).

  - An as-yet unspecified buffer overflow exists in Java     Web Start (233327).

ID	Name	Product	Family	Severity
64827	Sun Java JRE Multiple Vulnerabilities (233321-233327) (Unix)	Nessus	Misc.	high
63854	RHEL 5 : java-1.6.0-ibm (RHSA-2008:0267)	Nessus	Red Hat Local Security Checks	high
63852	RHEL 5 : java-1.6.0-bea (RHSA-2008:0245)	Nessus	Red Hat Local Security Checks	high
60440	Scientific Linux Security Update : java (jdk 1.5.0) on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	critical
40721	RHEL 4 / 5 : java-1.5.0-bea (RHSA-2008:0244)	Nessus	Red Hat Local Security Checks	high
40718	RHEL 4 / 5 : java-1.5.0-ibm (RHSA-2008:0210)	Nessus	Red Hat Local Security Checks	critical
40717	RHEL 4 / 5 : java-1.5.0-sun (RHSA-2008:0186)	Nessus	Red Hat Local Security Checks	high
40379	VMSA-2008-0010 : Updated Tomcat and Java JRE packages for VMware ESX 3.5 and VirtualCenter	Nessus	VMware ESX Local Security Checks	critical
34291	Mac OS X : Java for Mac OS X 10.4 Release 7	Nessus	MacOS X Local Security Checks	high
34290	Mac OS X : Java for Mac OS X 10.5 Update 2	Nessus	MacOS X Local Security Checks	high
32050	SuSE 10 Security Update : IBM Java 1.5.0 (ZYPP Patch Number 5183)	Nessus	SuSE Local Security Checks	critical
32013	GLSA-200804-20 : Sun JDK/JRE: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
31356	Sun Java JRE Multiple Vulnerabilities (233321-233327)	Nessus	Windows	high

Detections

Analytics

CVE-2008-1193

critical

Tenable Plugins

high

high

high

critical

high

critical

high

critical

high

high

critical

critical

high