Unspecified vulnerability in the Virtual Machine in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12 and earlier allows remote attackers to access files and execute arbitrary code via unknown vectors related to "code generation."

The remote VMware ESX host is missing a security-related patch. It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in the bundled version of the Java Runtime Environment (JRE).

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in the following components :

  - Apache Geronimo
  - Apache Tomcat
  - Apache Xerces2
  - cURL/libcURL
  - ISC BIND
  - Libxml2
  - Linux kernel
  - Linux kernel 64-bit
  - Linux kernel Common Internet File System
  - Linux kernel eCryptfs
  - NTP
  - Python
  - Java Runtime Environment (JRE)
  - Java SE Development Kit (JDK)
  - Java SE Abstract Window Toolkit (AWT)
  - Java SE Plugin
  - Java SE Provider
  - Java SE Swing
  - Java SE Web Start

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in the following components :

  - ISC DHCP dhclient
  - Integrated Services Digital Network (ISDN) subsystem
  - Java Runtime Environment (JRE)
  - Java SE Development Kit (JDK)
  - Java SE Web Start
  - Linux kernel
  - Linux kernel 32-bit and 64-bit emulation
  - Linux kernel Simple Internet Transition INET6
  - Linux kernel tty
  - Linux kernel virtual file system (VFS)
  - Red Hat dhcpd init script for DHCP
  - SBNI WAN driver

From Red Hat Security Advisory 2009:0377 :

Updated java-1.6.0-openjdk packages that fix several security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

These packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Software Development Kit. The Java Runtime Environment (JRE) contains the software and tools that users need to run applications written using the Java programming language.

A flaw was found in the way that the Java Virtual Machine (JVM) handled temporary font files. A malicious applet could use this flaw to use large amounts of disk space, causing a denial of service.
(CVE-2006-2426)

A memory leak flaw was found in LittleCMS (embedded in OpenJDK). An application using color profiles could use excessive amounts of memory, and possibly crash after using all available memory, if used to open specially crafted images. (CVE-2009-0581)

Multiple integer overflow flaws which could lead to heap-based buffer overflows, as well as multiple insufficient input validation flaws, were found in the way LittleCMS handled color profiles. An attacker could use these flaws to create a specially crafted image file which could cause a Java application to crash or, possibly, execute arbitrary code when opened. (CVE-2009-0723, CVE-2009-0733)

A NULL pointer dereference flaw was found in LittleCMS. An application using color profiles could crash while converting a specially crafted image file. (CVE-2009-0793)

A flaw in the Java API for XML Web Services (JAX-WS) service endpoint handling could allow a remote attacker to cause a denial of service on the server application hosting the JAX-WS service endpoint.
(CVE-2009-1101)

A flaw in the way the Java Runtime Environment initialized LDAP connections could allow a remote, authenticated user to cause a denial of service on the LDAP service. (CVE-2009-1093)

A flaw in the Java Runtime Environment LDAP client could allow malicious data from an LDAP server to cause arbitrary code to be loaded and then run on an LDAP client. (CVE-2009-1094)

Several buffer overflow flaws were found in the Java Runtime Environment unpack200 functionality. An untrusted applet could extend its privileges, allowing it to read and write local files, as well as to execute local applications with the privileges of the user running the applet. (CVE-2009-1095, CVE-2009-1096)

A flaw in the Java Runtime Environment Virtual Machine code generation functionality could allow untrusted applets to extend their privileges. An untrusted applet could extend its privileges, allowing it to read and write local files, as well as execute local applications with the privileges of the user running the applet.
(CVE-2009-1102)

A buffer overflow flaw was found in the splash screen processing. A remote attacker could extend privileges to read and write local files, as well as to execute local applications with the privileges of the user running the java process. (CVE-2009-1097)

A buffer overflow flaw was found in how GIF images were processed. A remote attacker could extend privileges to read and write local files, as well as execute local applications with the privileges of the user running the java process. (CVE-2009-1098)

Note: The flaws concerning applets in this advisory, CVE-2009-1095, CVE-2009-1096, and CVE-2009-1102, can only be triggered in java-1.6.0-openjdk by calling the 'appletviewer' application.

All users of java-1.6.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect.

The version of Sun Java Runtime Environment (JRE) installed on the remote host is earlier than 6 Update 13 / 5.0 Update 18 / 1.4.2_20 / 1.3.1_25.  Such versions are potentially affected by the following security issues :

  - A denial of service vulnerability affects the JRE LDAP     implementation. (254569).

  - A remote code execution vulnerability in the JRE LDAP     implementation may allow for arbitrary code to be run in     the context of the affected LDAP client. (254569)

  - There are multiple integer and buffer overflow     vulnerabilities when unpacking applets and Java Web     Start applications using the 'unpack2000' utility.
    (254570)

  - There are multiple denial of service vulnerabilities     related to the storing and processing of temporary font     files. (254608)

  - A privilege escalation vulnerability affects the Java     Plug-in when deserializing applets. (254611)

  - A weakness in the Java Plug-in allows JavaScript loaded     from the localhost to connect to arbitrary ports on the     local system. (254611)

  - A vulnerability in the Java Plug-in allows malicious     JavaScript code to exploit vulnerabilities in earlier     versions of the JRE that have been loaded by an applet     located on the same web page. (254611)

  - An issue exists in the Java Plug-in when parsing     'crossdomain.xml' allows an untrusted applet to connect     to an arbitrary site hosting a 'crossdomain.xml' file.
    (254611)

  - The Java Plug-in allows a malicious signed applet to     obscure the contents of a security dialog. (254611)

  - The JRE Virtual Machine is affected by a     privilege escalation vulnerability. (254610)

  - There are multiple buffer overflow vulnerabilities     involving the JRE's processing of PNG and GIF images.
    (254571)

  - There are multiple buffer overflow vulnerabilities     involving the JRE's processing of fonts. (254571)

  - A denial of service vulnerability affected the JRE HTTP     server implementation, which could be used to cause a     denial of service on a JAX-WS service endpoint. (254609)

This update fixes several vulnerabilities in the Sun Java 6 Runtime Environment and the Sun Java 6 Software Development Kit. These vulnerabilities are summarized on the 'Advance notification of Security Updates for Java SE' page from Sun Microsystems, listed in the References section.

All running instances of Sun Java must be restarted for the update to take effect.

Note: jdk-1.6.0_13-fcs.x86_64.rpm could not be signed. All other rpm's are signed with the usual signature.

a. Java JRE Security Update

  JRE update to version 1.5.0_22, which addresses multiple security   issues that existed in earlier releases of JRE.

  The Common Vulnerabilities and Exposures project (cve.mitre.org) has   assigned the following names to the security issues fixed in   JRE 1.5.0_18: CVE-2009-1093, CVE-2009-1094, CVE-2009-1095,   CVE-2009-1096, CVE-2009-1097, CVE-2009-1098, CVE-2009-1099,   CVE-2009-1100, CVE-2009-1101, CVE-2009-1102, CVE-2009-1103,   CVE-2009-1104, CVE-2009-1105, CVE-2009-1106, and CVE-2009-1107.

  The Common Vulnerabilities and Exposures project (cve.mitre.org) has   assigned the following names to the security issues fixed in   JRE 1.5.0_20: CVE-2009-2625, CVE-2009-2670, CVE-2009-2671,   CVE-2009-2672, CVE-2009-2673, CVE-2009-2675, CVE-2009-2676,   CVE-2009-2716, CVE-2009-2718, CVE-2009-2719, CVE-2009-2720,   CVE-2009-2721, CVE-2009-2722, CVE-2009-2723, CVE-2009-2724.

  The Common Vulnerabilities and Exposures project (cve.mitre.org) has   assigned the following names to the security issues fixed in   JRE 1.5.0_22: CVE-2009-3728, CVE-2009-3729, CVE-2009-3864,   CVE-2009-3865, CVE-2009-3866, CVE-2009-3867, CVE-2009-3868,   CVE-2009-3869, CVE-2009-3871, CVE-2009-3872, CVE-2009-3873,   CVE-2009-3874, CVE-2009-3875, CVE-2009-3876, CVE-2009-3877,   CVE-2009-3879, CVE-2009-3880, CVE-2009-3881, CVE-2009-3882,   CVE-2009-3883, CVE-2009-3884, CVE-2009-3886, CVE-2009-3885.

Updated java-1.6.0-openjdk packages that fix several security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

These packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Software Development Kit. The Java Runtime Environment (JRE) contains the software and tools that users need to run applications written using the Java programming language.

A flaw was found in the way that the Java Virtual Machine (JVM) handled temporary font files. A malicious applet could use this flaw to use large amounts of disk space, causing a denial of service.
(CVE-2006-2426)

A memory leak flaw was found in LittleCMS (embedded in OpenJDK). An application using color profiles could use excessive amounts of memory, and possibly crash after using all available memory, if used to open specially crafted images. (CVE-2009-0581)

Multiple integer overflow flaws which could lead to heap-based buffer overflows, as well as multiple insufficient input validation flaws, were found in the way LittleCMS handled color profiles. An attacker could use these flaws to create a specially crafted image file which could cause a Java application to crash or, possibly, execute arbitrary code when opened. (CVE-2009-0723, CVE-2009-0733)

A NULL pointer dereference flaw was found in LittleCMS. An application using color profiles could crash while converting a specially crafted image file. (CVE-2009-0793)

A flaw in the Java API for XML Web Services (JAX-WS) service endpoint handling could allow a remote attacker to cause a denial of service on the server application hosting the JAX-WS service endpoint.
(CVE-2009-1101)

A flaw in the way the Java Runtime Environment initialized LDAP connections could allow a remote, authenticated user to cause a denial of service on the LDAP service. (CVE-2009-1093)

A flaw in the Java Runtime Environment LDAP client could allow malicious data from an LDAP server to cause arbitrary code to be loaded and then run on an LDAP client. (CVE-2009-1094)

Several buffer overflow flaws were found in the Java Runtime Environment unpack200 functionality. An untrusted applet could extend its privileges, allowing it to read and write local files, as well as to execute local applications with the privileges of the user running the applet. (CVE-2009-1095, CVE-2009-1096)

A flaw in the Java Runtime Environment Virtual Machine code generation functionality could allow untrusted applets to extend their privileges. An untrusted applet could extend its privileges, allowing it to read and write local files, as well as execute local applications with the privileges of the user running the applet.
(CVE-2009-1102)

A buffer overflow flaw was found in the splash screen processing. A remote attacker could extend privileges to read and write local files, as well as to execute local applications with the privileges of the user running the java process. (CVE-2009-1097)

A buffer overflow flaw was found in how GIF images were processed. A remote attacker could extend privileges to read and write local files, as well as execute local applications with the privileges of the user running the java process. (CVE-2009-1098)

Note: The flaws concerning applets in this advisory, CVE-2009-1095, CVE-2009-1096, and CVE-2009-1102, can only be triggered in java-1.6.0-openjdk by calling the 'appletviewer' application.

All users of java-1.6.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect.

a. JRE Security Update

  JRE update to version 1.5.0_20, which addresses multiple security   issues that existed in earlier releases of JRE.

  The Common Vulnerabilities and Exposures project (cve.mitre.org) has   assigned the following names to the security issues fixed in   JRE 1.5.0_18: CVE-2009-1093, CVE-2009-1094, CVE-2009-1095,   CVE-2009-1096, CVE-2009-1097, CVE-2009-1098, CVE-2009-1099,   CVE-2009-1100, CVE-2009-1101, CVE-2009-1102, CVE-2009-1103,   CVE-2009-1104, CVE-2009-1105, CVE-2009-1106, and CVE-2009-1107.

  The Common Vulnerabilities and Exposures project (cve.mitre.org) has   assigned the following names to the security issues fixed in   JRE 1.5.0_20: CVE-2009-2625, CVE-2009-2670, CVE-2009-2671,   CVE-2009-2672, CVE-2009-2673, CVE-2009-2675, CVE-2009-2676,   CVE-2009-2716, CVE-2009-2718, CVE-2009-2719, CVE-2009-2720,   CVE-2009-2721, CVE-2009-2722, CVE-2009-2723, CVE-2009-2724.

b. Update Apache Tomcat version

  Update for VirtualCenter and ESX patch update the Tomcat package to   version 6.0.20 (vSphere 4.0) or version 5.5.28 (VirtualCenter 2.5)   which addresses multiple security issues that existed   in the previous version of Apache Tomcat.

  The Common Vulnerabilities and Exposures project (cve.mitre.org) has   assigned the following names to the security issues fixed in   Apache Tomcat 6.0.20 and Tomcat 5.5.28: CVE-2008-5515,   CVE-2009-0033, CVE-2009-0580, CVE-2009-0781, CVE-2009-0783.

  The Common Vulnerabilities and Exposures project (cve.mitre.org) has   assigned the following names to the security issues fixed in   Apache Tomcat 6.0.18:  CVE-2008-1232, CVE-2008-1947, CVE-2008-2370.

  The Common Vulnerabilities and Exposures project (cve.mitre.org) has   assigned the following names to the security issues fixed in   Apache Tomcat 6.0.16:  CVE-2007-5333, CVE-2007-5342, CVE-2007-5461,   CVE-2007-6286, CVE-2008-0002.
  c. Third-party library update for ntp.
   The Network Time Protocol (NTP) is used to synchronize a computer's   time with a referenced time source.
   ESXi 3.5 and ESXi 4.0 have a ntp client that is affected by the   following security issue. Note that the same security issue is   present in the ESX Service Console as described in section d. of   this advisory.
   A buffer overflow flaw was discovered in the ntpd daemon's NTPv4   authentication code. If ntpd was configured to use public key   cryptography for NTP packet authentication, a remote attacker could   use this flaw to send a specially crafted request packet that could   crash ntpd or, potentially, execute arbitrary code with the   privileges of the 'ntp' user.
   The Common Vulnerabilities and Exposures Project (cve.mitre.org)   has assigned the name CVE-2009-1252 to this issue.
   The NTP security issue identified by CVE-2009-0159 is not relevant   for ESXi 3.5 and ESXi 4.0.
 d. Service Console update for ntp

  Service Console package ntp updated to version ntp-4.2.2pl-9el5_3.2    The Network Time Protocol (NTP) is used to synchronize a computer's   time with a referenced time source.
   The Service Console present in ESX is affected by the following   security issues.
   A buffer overflow flaw was discovered in the ntpd daemon's NTPv4   authentication code. If ntpd was configured to use public key   cryptography for NTP packet authentication, a remote attacker could   use this flaw to send a specially crafted request packet that could   crash ntpd or, potentially, execute arbitrary code with the   privileges of the 'ntp' user.
   NTP authentication is not enabled by default on the Service Console.
   The Common Vulnerabilities and Exposures Project (cve.mitre.org)   has assigned the name CVE-2009-1252 to this issue.
   A buffer overflow flaw was found in the ntpq diagnostic command. A   malicious, remote server could send a specially crafted reply to an   ntpq request that could crash ntpq or, potentially, execute   arbitrary code with the privileges of the user running the ntpq   command.
   The Common Vulnerabilities and Exposures Project (cve.mitre.org)   has assigned the name CVE-2009-0159 to this issue.
  e. Updated Service Console package kernel

  Updated Service Console package kernel addresses the security   issues listed below.

  The Common Vulnerabilities and Exposures project (cve.mitre.org)   has assigned the names CVE-2008-3528, CVE-2008-5700, CVE-2009-0028,   CVE-2009-0269, CVE-2009-0322, CVE-2009-0675, CVE-2009-0676,   CVE-2009-0778 to the security issues fixed in kernel   2.6.18-128.1.6.

  The Common Vulnerabilities and Exposures project (cve.mitre.org)   has assigned the names CVE-2008-4307, CVE-2009-0834, CVE-2009-1337,   CVE-2009-0787, CVE-2009-1336 to the security issues fixed in   kernel 2.6.18-128.1.10.

  The Common Vulnerabilities and Exposures project (cve.mitre.org)   has assigned the names CVE-2009-1439, CVE-2009-1633, CVE-2009-1072,   CVE-2009-1630, CVE-2009-1192 to the security issues fixed in   kernel 2.6.18-128.1.14.

  The Common Vulnerabilities and Exposures project (cve.mitre.org)   has assigned the names CVE-2007-5966, CVE-2009-1385, CVE-2009-1388,   CVE-2009-1389, CVE-2009-1895, CVE-2009-2406, CVE-2009-2407 to the   security issues fixed in kernel 2.6.18-128.4.1.

  The Common Vulnerabilities and Exposures project (cve.mitre.org)   has assigned the names CVE-2009-2692, CVE-2009-2698 to the   security issues fixed in kernel 2.6.18-128.7.1.

  The Common Vulnerabilities and Exposures project (cve.mitre.org)   has assigned the names CVE-2009-0745, CVE-2009-0746, CVE-2009-0747,   CVE-2009-0748, CVE-2009-2847, CVE-2009-2848 to the security issues   fixed in kernel 2.6.18-164.

 f. Updated Service Console package python

  Service Console package Python update to version 2.4.3-24.el5.

  When the assert() system call was disabled, an input sanitization   flaw was revealed in the Python string object implementation that   led to a buffer overflow. The missing check for negative size values   meant the Python memory allocator could allocate less memory than   expected. This could result in arbitrary code execution with the   Python interpreter's privileges.

  Multiple buffer and integer overflow flaws were found in the Python   Unicode string processing and in the Python Unicode and string   object implementations. An attacker could use these flaws to cause   a denial of service.

  Multiple integer overflow flaws were found in the Python imageop   module. If a Python application used the imageop module to   process untrusted images, it could cause the application to   disclose sensitive information, crash or, potentially, execute   arbitrary code with the Python interpreter's privileges.

  Multiple integer underflow and overflow flaws were found in the   Python snprintf() wrapper implementation. An attacker could use   these flaws to cause a denial of service (memory corruption).

  Multiple integer overflow flaws were found in various Python   modules. An attacker could use these flaws to cause a denial of   service.

  An integer signedness error, leading to a buffer overflow, was   found in the Python zlib extension module. If a Python application   requested the negative byte count be flushed for a decompression   stream, it could cause the application to crash or, potentially,   execute arbitrary code with the Python interpreter's privileges.

  A flaw was discovered in the strxfrm() function of the Python   locale module. Strings generated by this function were not properly   NULL-terminated, which could possibly cause disclosure of data   stored in the memory of a Python application using this function.

  The Common Vulnerabilities and Exposures project (cve.mitre.org)   has assigned the names CVE-2007-2052 CVE-2007-4965 CVE-2008-1721   CVE-2008-1887 CVE-2008-2315 CVE-2008-3142 CVE-2008-3143   CVE-2008-3144 CVE-2008-4864 CVE-2008-5031 to these issues.

 g. Updated Service Console package bind

  Service Console package bind updated to version 9.3.6-4.P1.el5

  The Berkeley Internet Name Domain (BIND) is an implementation of the   Domain Name System (DNS) protocols. BIND includes a DNS server   (named); a resolver library (routines for applications to use when   interfacing with DNS); and tools for verifying that the DNS server   is operating correctly.

  A flaw was found in the way BIND handles dynamic update message   packets containing the 'ANY' record type. A remote attacker could   use this flaw to send a specially crafted dynamic update packet   that could cause named to exit with an assertion failure.

  The Common Vulnerabilities and Exposures project (cve.mitre.org)   has assigned the name CVE-2009-0696 to this issue.

 h. Updated Service Console package libxml2

  Service Console package libxml2 updated to version 2.6.26-2.1.2.8.

  libxml is a library for parsing and manipulating XML files. A   Document Type Definition (DTD) defines the legal syntax (and also   which elements can be used) for certain types of files, such as XML   files.

  A stack overflow flaw was found in the way libxml processes the   root XML document element definition in a DTD. A remote attacker   could provide a specially crafted XML file, which once opened by a   local, unsuspecting user, would lead to denial of service.

  Multiple use-after-free flaws were found in the way libxml parses   the Notation and Enumeration attribute types. A remote attacker   could provide a specially crafted XML file, which once opened by a   local, unsuspecting user, would lead to denial of service.

  The Common Vulnerabilities and Exposures project (cve.mitre.org)   has assigned the names CVE-2009-2414 and CVE-2009-2416 to these   issues.

 i. Updated Service Console package curl

  Service Console package curl updated to version 7.15.5-2.1.el5_3.5

  A cURL is affected by the previously published 'null prefix attack',   caused by incorrect handling of NULL characters in X.509   certificates. If an attacker is able to get a carefully-crafted   certificate signed by a trusted Certificate Authority, the attacker   could use the certificate during a man-in-the-middle attack and   potentially confuse cURL into accepting it by mistake.

  The Common Vulnerabilities and Exposures project (cve.mitre.org)   has assigned the name CVE-2009-2417 to this issue

 j. Updated Service Console package gnutls

  Service Console package gnutil updated to version 1.4.1-3.el5_3.5

  A flaw was discovered in the way GnuTLS handles NULL characters in   certain fields of X.509 certificates. If an attacker is able to get   a carefully-crafted certificate signed by a Certificate Authority   trusted by an application using GnuTLS, the attacker could use the   certificate during a man-in-the-middle attack and potentially   confuse the application into accepting it by mistake.

  The Common Vulnerabilities and Exposures project (cve.mitre.org)   has assigned the name CVE-2009-2730 to this issue

The remote host is affected by the vulnerability described in GLSA-200911-02 (Sun JDK/JRE: Multiple vulnerabilities)

    Multiple vulnerabilities have been reported in the Sun Java     implementation. Please review the CVE identifiers referenced below and     the associated Sun Alerts for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted JAR     archive, applet, or Java Web Start application, possibly resulting in     the execution of arbitrary code with the privileges of the user running     the application. Furthermore, a remote attacker could cause a Denial of     Service affecting multiple services via several vectors, disclose     information and memory contents, write or execute local files, conduct     session hijacking attacks via GIFAR files, steal cookies, bypass the     same-origin policy, load untrusted JAR files, establish network     connections to arbitrary hosts and posts via several vectors, modify     the list of supported graphics configurations, bypass HMAC-based     authentication systems, escalate privileges via several vectors and     cause applet code to be executed with older, possibly vulnerable     versions of the JRE.
    NOTE: Some vulnerabilities require a trusted environment, user     interaction, a DNS Man-in-the-Middle or Cross-Site-Scripting attack.
  Workaround :

    There is no known workaround at this time.

a. Service Console update for DHCP and third-party library update    for DHCP client.

   DHCP is an Internet-standard protocol by which a computer can be    connected to a local network, ask to be given configuration    information, and receive from a server enough information to    configure itself as a member of that network.

   A stack-based buffer overflow in the script_write_params method in    ISC DHCP dhclient allows remote DHCP servers to execute arbitrary    code via a crafted subnet-mask option.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-0692 to this issue.

   An insecure temporary file use flaw was discovered in the DHCP    daemon's init script ('/etc/init.d/dhcpd'). A local attacker could    use this flaw to overwrite an arbitrary file with the output of the    'dhcpd -t' command via a symbolic link attack, if a system    administrator executed the DHCP init script with the 'configtest',    'restart', or 'reload' option.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-1893 to this issue.

b. Updated Service Console package kernel

   Service Console package kernel update to version    kernel-2.4.21-58.EL.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2008-4210, CVE-2008-3275, CVE-2008-0598,    CVE-2008-2136, CVE-2008-2812, CVE-2007-6063, CVE-2008-3525 to the    security issues fixed in kernel-2.4.21-58.EL

c. JRE Security Update

   JRE update to version 1.5.0_18, which addresses multiple security    issues that existed in earlier releases of JRE.

   The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the following names to the security issues fixed in    JRE 1.5.0_17: CVE-2008-2086, CVE-2008-5347, CVE-2008-5348,    CVE-2008-5349, CVE-2008-5350, CVE-2008-5351, CVE-2008-5352,    CVE-2008-5353, CVE-2008-5354, CVE-2008-5356, CVE-2008-5357,    CVE-2008-5358, CVE-2008-5359, CVE-2008-5360, CVE-2008-5339,    CVE-2008-5342, CVE-2008-5344, CVE-2008-5345, CVE-2008-5346,    CVE-2008-5340, CVE-2008-5341, CVE-2008-5343, and CVE-2008-5355.

   The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the following names to the security issues fixed in    JRE 1.5.0_18: CVE-2009-1093, CVE-2009-1094, CVE-2009-1095,    CVE-2009-1096, CVE-2009-1097, CVE-2009-1098, CVE-2009-1099,    CVE-2009-1100, CVE-2009-1101, CVE-2009-1102, CVE-2009-1103,    CVE-2009-1104, CVE-2009-1105, CVE-2009-1106, and CVE-2009-1107.

The Sun JDK 6 was updated to Update13 to fix various bugs and security issues.

  - LdapCtx in the LDAP service in Java SE Development Kit     (JDK) and Java Runtime Environment (JRE) 5.0 Update 17     and earlier; 6 Update 12 and earlier; SDK and JRE     1.3.1_24 and earlier; and 1.4.2_19 and earlier does not     close the connection when initialization fails, which     allows remote attackers to cause a denial of service     (LDAP service hang). (CVE-2009-1093)

  - Unspecified vulnerability in the LDAP implementation in     Java SE Development Kit (JDK) and Java Runtime     Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12     and earlier; SDK and JRE 1.3.1_24 and earlier; and     1.4.2_19 and earlier allows remote LDAP servers to     execute arbitrary code via unknown vectors related to     serialized data. (CVE-2009-1094)

  - Integer overflow in unpack200 in Java SE Development Kit     (JDK) and Java Runtime Environment (JRE) 5.0 Update 17     and earlier, and 6 Update 12 and earlier, allows remote     attackers to access files or execute arbitrary code via     a JAR file with crafted Pack200 headers. (CVE-2009-1095)

  - Buffer overflow in unpack200 in Java SE Development Kit     (JDK) and Java Runtime Environment (JRE) 5.0 Update 17     and earlier, and 6 Update 12 and earlier, allows remote     attackers to access files or execute arbitrary code via     a JAR file with crafted Pack200 headers. (CVE-2009-1096)

  - Multiple buffer overflows in Java SE Development Kit     (JDK) and Java Runtime Environment (JRE) 6 Update 12 and     earlier allow remote attackers to access files or     execute arbitrary code via a crafted (1) PNG image, aka     CR 6804996, and (2) GIF image, aka CR 6804997.
    (CVE-2009-1097)

  - Buffer overflow in Java SE Development Kit (JDK) and     Java Runtime Environment (JRE) 5.0 Update 17 and     earlier; 6 Update 12 and earlier; 1.4.2_19 and earlier;
    and 1.3.1_24 and earlier allows remote attackers to     access files or execute arbitrary code via a crafted GIF     image, aka CR 6804998. (CVE-2009-1098)

  - Integer signedness error in Java SE Development Kit     (JDK) and Java Runtime Environment (JRE) 5.0 Update 17     and earlier, and 6 Update 12 and earlier, allows remote     attackers to access files or execute arbitrary code via     a crafted Type1 font, which triggers a buffer overflow.
    (CVE-2009-1099)

  - Multiple unspecified vulnerabilities in Java SE     Development Kit (JDK) and Java Runtime Environment (JRE)     5.0 Update 17 and earlier, and 6 Update 12 and earlier,     allow remote attackers to cause a denial of service     (disk consumption) via vectors related to temporary font     files and (1) 'limits on Font creation,' aka CR 6522586,     and (2) another unspecified vector, aka CR 6632886.
    (CVE-2009-1100)

  - Unspecified vulnerability in the lightweight HTTP server     implementation in Java SE Development Kit (JDK) and Java     Runtime Environment (JRE) 6 Update 12 and earlier allows     remote attackers to cause a denial of service (probably     resource consumption) for a JAX-WS service endpoint via     a connection without any data, which triggers a file     descriptor 'leak.'. (CVE-2009-1101)

  - Unspecified vulnerability in the Virtual Machine in Java     SE Development Kit (JDK) and Java Runtime Environment     (JRE) 6 Update 12 and earlier allows remote attackers to     access files and execute arbitrary code via unknown     vectors related to 'code generation.'. (CVE-2009-1102)

  - Unspecified vulnerability in the Java Plug-in in Java SE     Development Kit (JDK) and Java Runtime Environment (JRE)     5.0 Update 17 and earlier; 6 Update 12 and earlier;
    1.4.2_19 and earlier; and 1.3.1_24 and earlier allows     remote attackers to access files and execute arbitrary     code via unknown vectors related to 'deserializing     applets,' aka CR 6646860. (CVE-2009-1103)

  - The Java Plug-in in Java SE Development Kit (JDK) and     Java Runtime Environment (JRE) 5.0 Update 17 and     earlier; 6 Update 12 and earlier; and 1.4.2_19 and     earlier does not prevent JavaScript that is loaded from     the localhost from connecting to other ports on the     system, which allows user-assisted attackers to bypass     intended access restrictions via LiveConnect, aka CR     6724331. NOTE: this vulnerability can be leveraged with     separate cross-site scripting (XSS) vulnerabilities for     remote attack vectors. (CVE-2009-1104)

  - The Java Plug-in in Java SE Development Kit (JDK) and     Java Runtime Environment (JRE) 6 Update 12, 11, and 10     allows user-assisted remote attackers to cause a trusted     applet to run in an older JRE version, which can be used     to exploit vulnerabilities in that older version, aka CR     6706490. (CVE-2009-1105)

  - The Java Plug-in in Java SE Development Kit (JDK) and     Java Runtime Environment (JRE) 6 Update 12, 11, and 10     does not properly parse crossdomain.xml files, which     allows remote attackers to bypass intended access     restrictions and connect to arbitrary sites via unknown     vectors, aka CR 6798948. (CVE-2009-1106)

  - The Java Plug-in in Java SE Development Kit (JDK) and     Java Runtime Environment (JRE) 6 Update 12 and earlier,     and 5.0 Update 17 and earlier, allows remote attackers     to trick a user into trusting a signed applet via     unknown vectors that misrepresent the security warning     dialog, related to a 'Swing JLabel HTML parsing     vulnerability,' aka CR 6782871. (CVE-2009-1107)

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2009:0392 advisory.

    The Sun 1.6.0 Java release includes the Sun Java 6 Runtime Environment and     the Sun Java 6 Software Development Kit.

    This update fixes several vulnerabilities in the Sun Java 6 Runtime     Environment and the Sun Java 6 Software Development Kit. These     vulnerabilities are summarized on the Advance notification of Security     Updates for Java SE page from Sun Microsystems, listed in the References     section. (CVE-2006-2426, CVE-2009-1093, CVE-2009-1094, CVE-2009-1095,     CVE-2009-1096, CVE-2009-1097, CVE-2009-1098, CVE-2009-1099, CVE-2009-1100,     CVE-2009-1101, CVE-2009-1102, CVE-2009-1103, CVE-2009-1104, CVE-2009-1105,     CVE-2009-1106, CVE-2009-1107)

    Users of java-1.6.0-sun should upgrade to these updated packages, which     correct these issues. All running instances of Sun Java must be restarted     for the update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Sun JDK 6 was updated to Update13 to fix various bugs and security issues.

CVE-2009-1093: LdapCtx in the LDAP service in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; SDK and JRE 1.3.1_24 and earlier; and 1.4.2_19 and earlier does not close the connection when initialization fails, which allows remote attackers to cause a denial of service (LDAP service hang).

CVE-2009-1094: Unspecified vulnerability in the LDAP implementation in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; SDK and JRE 1.3.1_24 and earlier; and 1.4.2_19 and earlier allows remote LDAP servers to execute arbitrary code via unknown vectors related to serialized data.

CVE-2009-1095: Integer overflow in unpack200 in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier, and 6 Update 12 and earlier, allows remote attackers to access files or execute arbitrary code via a JAR file with crafted Pack200 headers.

CVE-2009-1096: Buffer overflow in unpack200 in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier, and 6 Update 12 and earlier, allows remote attackers to access files or execute arbitrary code via a JAR file with crafted Pack200 headers.

CVE-2009-1097: Multiple buffer overflows in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12 and earlier allow remote attackers to access files or execute arbitrary code via a crafted (1) PNG image, aka CR 6804996, and (2) GIF image, aka CR 6804997.

CVE-2009-1098: Buffer overflow in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; 1.4.2_19 and earlier; and 1.3.1_24 and earlier allows remote attackers to access files or execute arbitrary code via a crafted GIF image, aka CR 6804998.

CVE-2009-1099: Integer signedness error in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier, and 6 Update 12 and earlier, allows remote attackers to access files or execute arbitrary code via a crafted Type1 font, which triggers a buffer overflow.

CVE-2009-1100: Multiple unspecified vulnerabilities in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier, and 6 Update 12 and earlier, allow remote attackers to cause a denial of service (disk consumption) via vectors related to temporary font files and (1) 'limits on Font creation,' aka CR 6522586, and (2) another unspecified vector, aka CR 6632886.

CVE-2009-1101: Unspecified vulnerability in the lightweight HTTP server implementation in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12 and earlier allows remote attackers to cause a denial of service (probably resource consumption) for a JAX-WS service endpoint via a connection without any data, which triggers a file descriptor 'leak.'

CVE-2009-1102: Unspecified vulnerability in the Virtual Machine in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12 and earlier allows remote attackers to access files and execute arbitrary code via unknown vectors related to 'code generation.'

CVE-2009-1103: Unspecified vulnerability in the Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; 1.4.2_19 and earlier; and 1.3.1_24 and earlier allows remote attackers to access files and execute arbitrary code via unknown vectors related to 'deserializing applets,' aka CR 6646860.

CVE-2009-1104: The Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; and 1.4.2_19 and earlier does not prevent JavaScript that is loaded from the localhost from connecting to other ports on the system, which allows user-assisted attackers to bypass intended access restrictions via LiveConnect, aka CR 6724331. NOTE: this vulnerability can be leveraged with separate cross-site scripting (XSS) vulnerabilities for remote attack vectors.

CVE-2009-1105: The Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12, 11, and 10 allows user-assisted remote attackers to cause a trusted applet to run in an older JRE version, which can be used to exploit vulnerabilities in that older version, aka CR 6706490.

CVE-2009-1106: The Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12, 11, and 10 does not properly parse crossdomain.xml files, which allows remote attackers to bypass intended access restrictions and connect to arbitrary sites via unknown vectors, aka CR 6798948.

CVE-2009-1107: The Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12 and earlier, and 5.0 Update 17 and earlier, allows remote attackers to trick a user into trusting a signed applet via unknown vectors that misrepresent the security warning dialog, related to a 'Swing JLabel HTML parsing vulnerability,' aka CR 6782871.

Multiple security vulnerabilities has been identified and fixed in Little cms library embedded in OpenJDK :

A memory leak flaw allows remote attackers to cause a denial of service (memory consumption and application crash) via a crafted image file (CVE-2009-0581).

Multiple integer overflows allow remote attackers to execute arbitrary code via a crafted image file that triggers a heap-based buffer overflow (CVE-2009-0723).

Multiple stack-based buffer overflows allow remote attackers to execute arbitrary code via a crafted image file associated with a large integer value for the (1) input or (2) output channel (CVE-2009-0733).

A flaw in the transformations of monochrome profiles allows remote attackers to cause denial of service triggered by a NULL pointer dereference via a crafted image file (CVE-2009-0793).

Further security fixes in the JRE and in the Java API of OpenJDK :

A flaw in handling temporary font files by the Java Virtual Machine (JVM) allows remote attackers to cause denial of service (CVE-2006-2426).

An integer overflow flaw was found in Pulse-Java when handling Pulse audio source data lines. An attacker could use this flaw to cause an applet to crash, leading to a denial of service (CVE-2009-0794).

A flaw in Java Runtime Environment initialized LDAP connections allows authenticated remote users to cause denial of service on the LDAP service (CVE-2009-1093).

A flaw in the Java Runtime Environment LDAP client in handling server LDAP responses allows remote attackers to execute arbitrary code on the client side via malicious server response (CVE-2009-1094).

Buffer overflows in the the Java Runtime Environment unpack200 utility allow remote attackers to execute arbitrary code via an crafted applet (CVE-2009-1095, CVE-2009-1096).

A buffer overflow in the splash screen processing allows a attackers to execute arbitrary code (CVE-2009-1097).

A buffer overflow in GIF images handling allows remote attackers to execute arbitrary code via an crafted GIF image (CVE-2009-1098).

A flaw in the Java API for XML Web Services (JAX-WS) service endpoint handling allows remote attackers to cause a denial of service on the service endpoint's server side (CVE-2009-1101).

A flaw in the Java Runtime Environment Virtual Machine code generation allows remote attackers to execute arbitrary code via a crafted applet (CVE-2009-1102).

This update provides fixes for these issues.

Update :

java-1.6.0-openjdk requires rhino packages and these has been further updated.

It was discovered that font creation could leak temporary files. If a user were tricked into loading a malicious program or applet, a remote attacker could consume disk space, leading to a denial of service.
(CVE-2006-2426, CVE-2009-1100)

It was discovered that the lightweight HttpServer did not correctly close files on dataless connections. A remote attacker could send specially crafted requests, leading to a denial of service.
(CVE-2009-1101)

The Java Runtime Environment did not correctly validate certain generated code. If a user were tricked into running a malicious applet a remote attacker could execute arbitrary code. (CVE-2009-1102)

It was discovered that LDAP connections did not close correctly. A remote attacker could send specially crafted requests, leading to a denial of service. (CVE-2009-1093)

Java LDAP routines did not unserialize certain data correctly. A remote attacker could send specially crafted requests that could lead to arbitrary code execution. (CVE-2009-1094)

Java did not correctly check certain JAR headers. If a user or automated system were tricked into processing a malicious JAR file, a remote attacker could crash the application, leading to a denial of service. (CVE-2009-1095, CVE-2009-1096)

It was discovered that PNG and GIF decoding in Java could lead to memory corruption. If a user or automated system were tricked into processing a specially crafted image, a remote attacker could crash the application, leading to a denial of service. (CVE-2009-1097, CVE-2009-1098).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Sun Java Runtime Environment (JRE) installed on the remote host is earlier than 6 Update 13 / 5.0 Update 18 / 1.4.2_20 / 1.3.1_25. Such versions are potentially affected by the following security issues :

  - A denial of service vulnerability affects the JRE LDAP     implementation. (254569).

  - A remote code execution vulnerability in the JRE LDAP     implementation may allow for arbitrary code to be run in     the context of the affected LDAP client. (254569)

  - There are multiple integer and buffer overflow     vulnerabilities when unpacking applets and Java Web     Start applications using the 'unpack2000' utility.
    (254570)

  - There are multiple denial of service vulnerabilities     related to the storing and processing of temporary font     files. (254608)

  - A privilege-escalation vulnerability affects the Java     Plug-in when deserializing applets. (254611)

  - A weakness in the Java Plug-in allows JavaScript loaded     from the localhost to connect to arbitrary ports on the     local system. (254611)

  - A vulnerability in the Java Plug-in allows malicious     JavaScript code to exploit vulnerabilities in earlier     versions of the JRE that have been loaded by an applet     located on the same web page. (254611)

  - An issue exists in the Java Plug-in when parsing     'crossdomain.xml' allows an untrusted applet to connect     to an arbitrary site hosting a 'crossdomain.xml' file.
    (254611)

  - The Java Plug-in allows a malicious signed applet to     obscure the contents of a security dialog. (254611)

  - The JRE Virtual Machine is affected by a     privilege-escalation vulnerability. (254610)

  - There are multiple buffer overflow vulnerabilities     involving the JRE's processing of PNG and GIF images.
    (254571)

  - There are multiple buffer overflow vulnerabilities     involving the JRE's processing of fonts. (254571)

  - A denial of service vulnerability affects the JRE HTTP     server implementation, which could be used to cause a     denial of service on a JAX-WS service endpoint. (254609)

ID	Name	Product	Family	Severity
89736	VMware ESX Java Runtime Environment (JRE) Multiple Vulnerabilities (VMSA-2010-0002) (remote check)	Nessus	VMware ESX Local Security Checks	critical
89117	VMware ESX / ESXi Multiple Vulnerabilities (VMSA-2009-0016) (remote check)	Nessus	Misc.	critical
89116	VMware ESX / ESXi Multiple Vulnerabilities (VMSA-2009-0014) (remote check)	Nessus	Misc.	critical
67831	Oracle Linux 5 : java-1.6.0-openjdk (ELSA-2009-0377)	Nessus	Oracle Linux Local Security Checks	critical
64829	Sun Java JRE Multiple Vulnerabilities (254569 / 254611 / 254608 ..) (Unix)	Nessus	Misc.	critical
60555	Scientific Linux Security Update : java (jdk 1.6.0) on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	critical
45386	VMSA-2010-0002 : VMware vCenter update release addresses multiple security issues in Java JRE	Nessus	VMware ESX Local Security Checks	critical
43736	CentOS 5 : java-1.6.0-openjdk (CESA-2009:0377)	Nessus	CentOS Local Security Checks	critical
42870	VMSA-2009-0016 : VMware vCenter and ESX update release and vMA patch release address multiple security issues in third party components.	Nessus	VMware ESX Local Security Checks	medium
42834	GLSA-200911-02 : Sun JDK/JRE: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
42179	VMSA-2009-0014 : VMware ESX patches for DHCP, Service Console kernel, and JRE resolve multiple security issues	Nessus	VMware ESX Local Security Checks	high
41407	SuSE 11 Security Update : Sun JDK 6 (SAT Patch Number 699)	Nessus	SuSE Local Security Checks	critical
40741	RHEL 5 : java-1.6.0-sun (RHSA-2009:0392)	Nessus	Red Hat Local Security Checks	high
40242	openSUSE Security Update : java-1_6_0-sun (java-1_6_0-sun-705)	Nessus	SuSE Local Security Checks	critical
40003	openSUSE Security Update : java-1_6_0-sun (java-1_6_0-sun-705)	Nessus	SuSE Local Security Checks	critical
39478	Mandriva Linux Security Advisory : java-1.6.0-openjdk (MDVSA-2009:137)	Nessus	Mandriva Local Security Checks	critical
36366	Ubuntu 8.10 : openjdk-6 vulnerabilities (USN-748-1)	Nessus	Ubuntu Local Security Checks	critical
36111	RHEL 5 : java-1.6.0-openjdk (RHSA-2009:0377)	Nessus	Red Hat Local Security Checks	critical
36071	openSUSE 10 Security Update : java-1_6_0-sun (java-1_6_0-sun-6128)	Nessus	SuSE Local Security Checks	critical
36034	Sun Java JRE Multiple Vulnerabilities (254569 / 254611 / 254608 ..)	Nessus	Windows	high

Detections

Analytics

CVE-2009-1102

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

medium

critical

high

critical

high

critical

critical

critical

critical

critical

critical

high