The Java Management Extensions (JMX) implementation in Sun Java SE 6 before Update 15, and OpenJDK, does not properly enforce OpenType checks, which allows context-dependent attackers to bypass intended access restrictions by leveraging finalizer resurrection to obtain a reference to a privileged object.

JavaSE 6_x86: update 75 patch (equivalent to JDK 6u75), 64bit.
Date this patch was last updated by Sun : Apr/14/14

JavaSE 6_x86: update 71 patch (equivalent to JDK 6u71), 64bit.
Date this patch was last updated by Sun : Jan/14/14

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2009-1201 advisory.

    [1:1.6.0.0-1.2.b09.0.1.el5]
    - Add oracle-enterprise.patch

    [1:1.6.0.0-1.2.b09]
    - Updated release.
    - Moved java-1.6.0-openjdk-securitypatches.patch to     java-1.6.0-openjdk-march24-securitypatches.patch.
    - Created new java-1.6.0-openjdk-july28-securitypatches.patch.
    - Updated release.
    - Resolves: rhbz#513391

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

CVE-2009-0217 xmlsec1, mono, xml-security-c, xml-security-1.3.0-1jpp.ep1.*: XMLDsig HMAC-based signatures spoofing and authentication bypass

CVE-2009-2670 OpenJDK Untrusted applet System properties access (6738524)

CVE-2009-2671 CVE-2009-2672 OpenJDK Proxy mechanism information leaks (6801071)

CVE-2009-2673 OpenJDK proxy mechanism allows non-authorized socket connections (6801497)

CVE-2009-2674 Java Web Start Buffer JPEG processing integer overflow (6823373)

CVE-2009-2675 Java Web Start Buffer unpack200 processing integer overflow (6830335)

CVE-2009-2625 OpenJDK XML parsing Denial-Of-Service (6845701)

CVE-2009-2475 OpenJDK information leaks in mutable variables (6588003,6656586,6656610,6656625,6657133,6657619,6657625,6657695,66600 49,6660539,6813167)

CVE-2009-2476 OpenJDK OpenType checks can be bypassed (6736293)

CVE-2009-2690 OpenJDK private variable information disclosure (6777487)

CVE-2009-2676 JRE applet launcher vulnerability

All running instances of Sun Java must be restarted for the update to take effect.

CVE-2009-0217 xmlsec1, mono, xml-security-c, xml-security-1.3.0-1jpp.ep1.*: XMLDsig HMAC-based signatures spoofing and authentication bypass

CVE-2009-2670 OpenJDK Untrusted applet System properties access (6738524)

CVE-2009-2671 CVE-2009-2672 OpenJDK Proxy mechanism information leaks (6801071)

CVE-2009-2673 OpenJDK proxy mechanism allows non-authorized socket connections (6801497)

CVE-2009-2674 Java Web Start Buffer JPEG processing integer overflow (6823373)

CVE-2009-2675 Java Web Start Buffer unpack200 processing integer overflow (6830335)

CVE-2009-2625 OpenJDK XML parsing Denial-Of-Service (6845701)

CVE-2009-2475 OpenJDK information leaks in mutable variables (6588003,6656586,6656610,6656625,6657133,6657619,6657625,6657695,66600 49,6660539,6813167)

CVE-2009-2476 OpenJDK OpenType checks can be bypassed (6736293)

CVE-2009-2689 OpenJDK JDK13Services grants unnecessary privileges (6777448)

CVE-2009-2690 OpenJDK private variable information disclosure (6777487)

A flaw was found in the way the XML Digital Signature implementation in the JRE handled HMAC-based XML signatures. An attacker could use this flaw to create a crafted signature that could allow them to bypass authentication, or trick a user, applet, or application into accepting untrusted content. (CVE-2009-0217)

Several potential information leaks were found in various mutable static variables. These could be exploited in application scenarios that execute untrusted scripting code. (CVE-2009-2475)

It was discovered that OpenType checks can be bypassed. This could allow a rogue application to bypass access restrictions by acquiring references to privileged objects through finalizer resurrection.
(CVE-2009-2476)

A denial of service flaw was found in the way the JRE processes XML. A remote attacker could use this flaw to supply crafted XML that would lead to a denial of service. (CVE-2009-2625)

A flaw was found in the JRE audio system. An untrusted applet or application could use this flaw to gain read access to restricted System properties. (CVE-2009-2670)

Two flaws were found in the JRE proxy implementation. An untrusted applet or application could use these flaws to discover the usernames of users running applets and applications, or obtain web browser cookies and use them for session hijacking attacks. (CVE-2009-2671, CVE-2009-2672)

An additional flaw was found in the proxy mechanism implementation.
This flaw allowed an untrusted applet or application to bypass access restrictions and communicate using non-authorized socket or URL connections to hosts other than the origin host. (CVE-2009-2673)

An integer overflow flaw was found in the way the JRE processes JPEG images. An untrusted application could use this flaw to extend its privileges, allowing it to read and write local files, as well as to execute local applications with the privileges of the user running the application. (CVE-2009-2674)

An integer overflow flaw was found in the JRE unpack200 functionality.
An untrusted applet or application could extend its privileges, allowing it to read and write local files, as well as to execute local applications with the privileges of the user running the applet or application. (CVE-2009-2675)

It was discovered that JDK13Services grants unnecessary privileges to certain object types. This could be misused by an untrusted applet or application to use otherwise restricted functionality. (CVE-2009-2689)

An information disclosure flaw was found in the way private Java variables were handled. An untrusted applet or application could use this flaw to obtain information from variables that would otherwise be private. (CVE-2009-2690)

Note: The flaws concerning applets in this advisory, CVE-2009-2475,

CVE-2009-2670, CVE-2009-2671, CVE-2009-2672, CVE-2009-2673,

CVE-2009-2675, CVE-2009-2689, and CVE-2009-2690, can only be triggered in java-1.6.0-openjdk by calling the 'appletviewer' application.

All running instances of OpenJDK Java must be restarted for the update to take effect.

Updated java-1.6.0-openjdk packages that fix several security issues and a bug are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

These packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Software Development Kit. The Java Runtime Environment (JRE) contains the software and tools that users need to run applications written using the Java programming language.

A flaw was found in the way the XML Digital Signature implementation in the JRE handled HMAC-based XML signatures. An attacker could use this flaw to create a crafted signature that could allow them to bypass authentication, or trick a user, applet, or application into accepting untrusted content. (CVE-2009-0217)

Several potential information leaks were found in various mutable static variables. These could be exploited in application scenarios that execute untrusted scripting code. (CVE-2009-2475)

It was discovered that OpenType checks can be bypassed. This could allow a rogue application to bypass access restrictions by acquiring references to privileged objects through finalizer resurrection.
(CVE-2009-2476)

A denial of service flaw was found in the way the JRE processes XML. A remote attacker could use this flaw to supply crafted XML that would lead to a denial of service. (CVE-2009-2625)

A flaw was found in the JRE audio system. An untrusted applet or application could use this flaw to gain read access to restricted System properties. (CVE-2009-2670)

Two flaws were found in the JRE proxy implementation. An untrusted applet or application could use these flaws to discover the usernames of users running applets and applications, or obtain web browser cookies and use them for session hijacking attacks. (CVE-2009-2671, CVE-2009-2672)

An additional flaw was found in the proxy mechanism implementation.
This flaw allowed an untrusted applet or application to bypass access restrictions and communicate using non-authorized socket or URL connections to hosts other than the origin host. (CVE-2009-2673)

An integer overflow flaw was found in the way the JRE processes JPEG images. An untrusted application could use this flaw to extend its privileges, allowing it to read and write local files, as well as to execute local applications with the privileges of the user running the application. (CVE-2009-2674)

An integer overflow flaw was found in the JRE unpack200 functionality.
An untrusted applet or application could extend its privileges, allowing it to read and write local files, as well as to execute local applications with the privileges of the user running the applet or application. (CVE-2009-2675)

It was discovered that JDK13Services grants unnecessary privileges to certain object types. This could be misused by an untrusted applet or application to use otherwise restricted functionality. (CVE-2009-2689)

An information disclosure flaw was found in the way private Java variables were handled. An untrusted applet or application could use this flaw to obtain information from variables that would otherwise be private. (CVE-2009-2690)

Note: The flaws concerning applets in this advisory, CVE-2009-2475, CVE-2009-2670, CVE-2009-2671, CVE-2009-2672, CVE-2009-2673, CVE-2009-2675, CVE-2009-2689, and CVE-2009-2690, can only be triggered in java-1.6.0-openjdk by calling the 'appletviewer' application.

This update also fixes the following bug :

* the EVR in the java-1.6.0-openjdk package as shipped with Red Hat Enterprise Linux allowed the java-1.6.0-openjdk package from the EPEL repository to take precedence (appear newer). Users using java-1.6.0-openjdk from EPEL would not have received security updates since October 2008. This update prevents the packages from EPEL from taking precedence. (BZ#499079)

All users of java-1.6.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect.

The remote host is affected by the vulnerability described in GLSA-200911-02 (Sun JDK/JRE: Multiple vulnerabilities)

    Multiple vulnerabilities have been reported in the Sun Java     implementation. Please review the CVE identifiers referenced below and     the associated Sun Alerts for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted JAR     archive, applet, or Java Web Start application, possibly resulting in     the execution of arbitrary code with the privileges of the user running     the application. Furthermore, a remote attacker could cause a Denial of     Service affecting multiple services via several vectors, disclose     information and memory contents, write or execute local files, conduct     session hijacking attacks via GIFAR files, steal cookies, bypass the     same-origin policy, load untrusted JAR files, establish network     connections to arbitrary hosts and posts via several vectors, modify     the list of supported graphics configurations, bypass HMAC-based     authentication systems, escalate privileges via several vectors and     cause applet code to be executed with older, possibly vulnerable     versions of the JRE.
    NOTE: Some vulnerabilities require a trusted environment, user     interaction, a DNS Man-in-the-Middle or Cross-Site-Scripting attack.
  Workaround :

    There is no known workaround at this time.

This update of java-1_6_0-openjdk fixes the following issues :

  - CVE-2009-2670: OpenJDK Untrusted applet System     properties access

  - CVE-2009-2671,CVE-2009-2672: OpenJDK Proxy mechanism     information leaks

  - CVE-2009-2673: OpenJDK proxy mechanism allows     non-authorized socket connections

  - CVE-2009-2674: Java Web Start Buffer JPEG processing     integer overflow

  - CVE-2009-2675: Java Web Start Buffer unpack200     processing integer overflow

  - CVE-2009-2625: OpenJDK XML parsing Denial-Of-Service

  - CVE-2009-2475: OpenJDK information leaks in mutable     variables

  - CVE-2009-2476: OpenJDK OpenType checks can be bypassed

  - CVE-2009-2689: OpenJDK JDK13Services grants unnecessary     privileges

  - CVE-2009-2690: OpenJDK private variable information     disclosure

The remote Mac OS X host is running a version of Java for Mac OS X 10.5 that is missing Update 5.

The remote version of this software contains several security vulnerabilities, including some that may allow untrusted Java applets to obtain elevated privileges and lead to execution of arbitrary code with the privileges of the current user.

Updated java-1.6.0-sun packages that correct several security issues are now available for Red Hat Enterprise Linux 4 Extras and 5 Supplementary.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

The Sun 1.6.0 Java release includes the Sun Java 6 Runtime Environment and the Sun Java 6 Software Development Kit.

This update fixes several vulnerabilities in the Sun Java 6 Runtime Environment and the Sun Java 6 Software Development Kit. These vulnerabilities are summarized on the 'Advance notification of Security Updates for Java SE' page from Sun Microsystems, listed in the References section. (CVE-2009-0217, CVE-2009-2475, CVE-2009-2476, CVE-2009-2625, CVE-2009-2670, CVE-2009-2671, CVE-2009-2672, CVE-2009-2673, CVE-2009-2674, CVE-2009-2675, CVE-2009-2676, CVE-2009-2690)

Users of java-1.6.0-sun should upgrade to these updated packages, which correct these issues. All running instances of Sun Java must be restarted for the update to take effect.

Multiple Java OpenJDK security vulnerabilities has been identified and fixed :

The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation specifies an HMAC truncation length (HMACOutputLength) but does not require a minimum for its length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits (CVE-2009-0217).

The Java Web Start framework does not properly check all application jar files trust and this allows context-dependent attackers to execute arbitrary code via a crafted application, related to NetX (CVE-2009-1896).

Some variables and data structures without the final keyword definition allows context-depend attackers to obtain sensitive information. The target variables and data structures are stated as follow: (1) LayoutQueue, (2) Cursor.predefined, (3) AccessibleResourceBundle.getContents, (4) ImageReaderSpi.STANDARD_INPUT_TYPE, (5) ImageWriterSpi.STANDARD_OUTPUT_TYPE, (6) the imageio plugins, (7) DnsContext.debug, (8) RmfFileReader/StandardMidiFileWriter.types, (9) AbstractSaslImpl.logger, (10) Synth.Region.uiToRegionMap/lowerCaseNameMap, (11) the Introspector class and a cache of BeanInfo, and (12) JAX-WS (CVE-2009-2475).

The Java Management Extensions (JMX) implementation does not properly enforce OpenType checks, which allows context-dependent attackers to bypass intended access restrictions by leveraging finalizer resurrection to obtain a reference to a privileged object (CVE-2009-2476).

A flaw in the Xerces2 as used in OpenJDK allows remote attackers to cause denial of service via a malformed XML input (CVE-2009-2625).

The audio system does not prevent access to java.lang.System properties either by untrusted applets and Java Web Start applications, which allows context-dependent attackers to obtain sensitive information by reading these properties (CVE-2009-2670).

A flaw in the SOCKS proxy implementation allows remote attackers to discover the user name of the account that invoked either an untrusted applet or Java Web Start application via unspecified vectors (CVE-2009-2671).

A flaw in the proxy mechanism implementation allows remote attackers to bypass intended access restrictions and connect to arbitrary sites via unspecified vectors, related to a declaration that lacks the final keyword (CVE-2009-2673).

An integer overflow in the JPEG images parsing allows context-dependent attackers to gain privileges via an untrusted Java Web Start application that grants permissions to itself (CVE-2009-2674).

An integer overflow in the unpack200 utility decompression allows context-dependent attackers to gain privileges via vectors involving either an untrusted applet or Java Web Start application that grants permissions to itself (CVE-2009-2675).

A flaw in the JDK13Services.getProviders grants full privileges to instances of unspecified object types, which allows context-dependent attackers to bypass intended access restrictions either via an untrusted applet or application (CVE-2009-2689).

A flaw in the OpenJDK's encoder, grants read access to private variables with unspecified names, which allows context-dependent attackers to obtain sensitive information either via an untrusted applet or application (CVE-2009-2690).

It was discovered that the XML HMAC signature system did not correctly check certain lengths. If an attacker sent a truncated HMAC, it could bypass authentication, leading to potential privilege escalation.
(CVE-2009-0217)

It was discovered that JAR bundles would appear signed if only one element was signed. If a user were tricked into running a malicious Java applet, a remote attacker could exploit this to gain access to private information and potentially run untrusted code.
(CVE-2009-1896)

It was discovered that certain variables could leak information. If a user were tricked into running a malicious Java applet, a remote attacker could exploit this to gain access to private information and potentially run untrusted code. (CVE-2009-2475, CVE-2009-2690)

A flaw was discovered the OpenType checking. If a user were tricked into running a malicious Java applet, a remote attacker could bypass access restrictions. (CVE-2009-2476)

It was discovered that the XML processor did not correctly check recursion. If a user or automated system were tricked into processing a specially crafted XML, the system could crash, leading to a denial of service. (CVE-2009-2625)

It was discovered that the Java audio subsystem did not correctly validate certain parameters. If a user were tricked into running an untrusted applet, a remote attacker could read system properties.
(CVE-2009-2670)

Multiple flaws were discovered in the proxy subsystem. If a user were tricked into running an untrusted applet, a remote attacker could discover local user names, obtain access to sensitive information, or bypass socket restrictions, leading to a loss of privacy.
(CVE-2009-2671, CVE-2009-2672, CVE-2009-2673)

Flaws were discovered in the handling of JPEG images, Unpack200 archives, and JDK13Services. If a user were tricked into running an untrusted applet, a remote attacker could load a specially crafted file that would bypass local file access protections and run arbitrary code with user privileges. (CVE-2009-2674, CVE-2009-2675, CVE-2009-2676, CVE-2009-2689).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Urgent security fixes have been included.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Urgent security updates have been included

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

JavaSE 6_x86: update 101 patch (equivalent.
Date this patch was last updated by Sun : Jul/13/15

ID	Name	Product	Family	Severity
107921	Solaris 10 (x86) : 125139-75	Nessus	Solaris Local Security Checks	critical
107920	Solaris 10 (x86) : 125139-71	Nessus	Solaris Local Security Checks	critical
67905	Oracle Linux 5 : java-1.6.0-openjdk (ELSA-2009-1201)	Nessus	Oracle Linux Local Security Checks	medium
60645	Scientific Linux Security Update : java (jdk 1.6.0) on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	critical
60633	Scientific Linux Security Update : java-1.6.0-openjdk on SL5.3 i386/x86_64	Nessus	Scientific Linux Local Security Checks	critical
43774	CentOS 5 : java-1.6.0-openjdk (CESA-2009:1201)	Nessus	CentOS Local Security Checks	critical
42834	GLSA-200911-02 : Sun JDK/JRE: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
41623	openSUSE Security Update : java-1_6_0-openjdk (java-1_6_0-openjdk-1330)	Nessus	SuSE Local Security Checks	critical
41622	openSUSE Security Update : java-1_6_0-openjdk (java-1_6_0-openjdk-1330)	Nessus	SuSE Local Security Checks	critical
40873	Mac OS X : Java for Mac OS X 10.5 Update 5	Nessus	MacOS X Local Security Checks	high
40749	RHEL 4 / 5 : java-1.6.0-sun (RHSA-2009:1200)	Nessus	Red Hat Local Security Checks	critical
40694	Mandriva Linux Security Advisory : java-1.6.0-openjdk (MDVSA-2009:209)	Nessus	Mandriva Local Security Checks	critical
40547	Ubuntu 8.10 / 9.04 : openjdk-6 vulnerabilities (USN-814-1)	Nessus	Ubuntu Local Security Checks	critical
40515	Fedora 10 : java-1.6.0-openjdk-1.6.0.0-20.b16.fc10 (2009-8337)	Nessus	Fedora Local Security Checks	critical
40510	RHEL 5 : java-1.6.0-openjdk (RHSA-2009:1201)	Nessus	Red Hat Local Security Checks	critical
40507	Fedora 11 : java-1.6.0-openjdk-1.6.0.0-27.b16.fc11 (2009-8329)	Nessus	Fedora Local Security Checks	critical
27034	Solaris 9 (x86) : 125139-97	Nessus	Solaris Local Security Checks	critical
27016	Solaris 8 (x86) : 125139-97	Nessus	Solaris Local Security Checks	critical

Detections

Analytics

CVE-2009-2476

critical

Tenable Plugins

critical

critical

medium

critical

critical

critical

critical

critical

critical

high

critical

critical

critical

critical

critical

critical

critical

critical