Unspecified vulnerability in the HotSpot Server component in Oracle Java SE and Java for Business 6 Update 18, 5.0, Update, and 23 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several third-party components and libraries :

  - Apache Tomcat 
  - Apache Tomcat Manager
  - cURL 
  - Java Runtime Environment (JRE)
  - Kernel 
  - Microsoft SQL Express
  - OpenSSL
  - pam_krb5

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2010-0339 advisory.

    [1:1.6.0.0-1.11.b16.0.1.el5]
    - Add oracle-enterprise.patch

    [1:1.6.0.0-1.11.b16.el5]
    - Remove javaws alternative due to conflict with java-1.6.0-sun's alternatives

    [1:1.6.0-1.10.b16]
    - Update to openjdk build b16
    - Update to icedtea6-1.6
    - Added tzdata-java requirement
    - Added autoconf and automake build requirement
    - Added tzdata-java requirement
    - Added java-1.6.0-openjdk-gcc-stack-markings.patch
    - Added java-1.6.0-openjdk-memory-barriers.patch
    - Added java-1.6.0-openjdk-jar-misc.patch
    - Added java-1.6.0-openjdk-linux-separate-debuginfo.patch
    - Added java-1.6.0-openjdk-securitypatches-20100323.patch
    - Added STRIP_KEEP_SYMTAB=libjvm* to install section, fix bz530402
    - Resolves: rhbz#576124

    [1:1.6.0-1.8.b09]
    - Added java-1.6.0-openjdk-debuginfo.patch
    - Added java-1.6.0-openjdk-elf-debuginfo.patch

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle (formerly Sun) Java Runtime Environment (JRE) installed on the remote host is earlier than 6 Update 19 / 5.0 Update 24 / 1.4.2_26.  Such versions are potentially affected by security issues in the following components :

  - ImageIO
  - Java 2D
  - JRE
  - Java Web Start, Java Plug-in
  - Pack200
  - Sound
  - JSSE
  - HotSpot Server

CVE-2009-3555 TLS: MITM attacks via session renegotiation

CVE-2010-0082 OpenJDK Loader-constraint table allows arrays instead of only the base-classes (6626217)

CVE-2010-0084 OpenJDK Policy/PolicyFile leak dynamic ProtectionDomains. (6633872)

CVE-2010-0085 OpenJDK File TOCTOU deserialization vulnerability (6736390)

CVE-2010-0088 OpenJDK Inflater/Deflater clone issues (6745393)

CVE-2010-0091 OpenJDK Unsigned applet can retrieve the dragged information before drop action occurs(6887703)

CVE-2010-0092 OpenJDK AtomicReferenceArray causes SIGSEGV -> SEGV_MAPERR error (6888149)

CVE-2010-0093 OpenJDK System.arraycopy unable to reference elements beyond Integer.MAX_VALUE bytes (6892265)

CVE-2010-0094 OpenJDK Deserialization of RMIConnectionImpl objects should enforce stricter checks (6893947)

CVE-2010-0095 OpenJDK Subclasses of InetAddress may incorrectly interpret network addresses (6893954)

CVE-2010-0845 OpenJDK No ClassCastException for HashAttributeSet constructors if run with -Xcomp (6894807)

CVE-2010-0838 OpenJDK CMM readMabCurveData Buffer Overflow Vulnerability (6899653)

CVE-2010-0837 OpenJDK JAR 'unpack200' must verify input parameters (6902299)

CVE-2010-0840 OpenJDK Applet Trusted Methods Chaining Privilege Escalation Vulnerability (6904691)

CVE-2010-0841 OpenJDK JPEGImageReader stepX Integer Overflow Vulnerability (6909597)

CVE-2010-0848 OpenJDK AWT Library Invalid Index Vulnerability (6914823)

CVE-2010-0847 OpenJDK ImagingLib arbitrary code execution vulnerability (6914866)

CVE-2010-0846 JDK unspecified vulnerability in ImageIO component

CVE-2010-0849 JDK unspecified vulnerability in Java2D component

CVE-2010-0087 JDK unspecified vulnerability in JWS/Plugin component

CVE-2010-0839 CVE-2010-0842 CVE-2010-0843 CVE-2010-0844 JDK multiple unspecified vulnerabilities

CVE-2010-0090 JDK unspecified vulnerability in JavaWS/Plugin component

CVE-2010-0089 JDK unspecified vulnerability in JavaWS/Plugin component

This update fixes several vulnerabilities in the Sun Java 6 Runtime Environment and the Sun Java 6 Software Development Kit. Further information about these flaws can be found on the 'Oracle Java SE and Java for Business Critical Patch Update Advisory' page, listed in the References section. (CVE-2009-3555, CVE-2010-0082, CVE-2010-0084,

CVE-2010-0085, CVE-2010-0087, CVE-2010-0088, CVE-2010-0089,

CVE-2010-0090, CVE-2010-0091, CVE-2010-0092, CVE-2010-0093,

CVE-2010-0094, CVE-2010-0095, CVE-2010-0837, CVE-2010-0838,

CVE-2010-0839, CVE-2010-0840, CVE-2010-0841, CVE-2010-0842,

CVE-2010-0843, CVE-2010-0844, CVE-2010-0845, CVE-2010-0846,

CVE-2010-0847, CVE-2010-0848, CVE-2010-0849)

For the CVE-2009-3555 issue, this update disables renegotiation in the Java Secure Socket Extension (JSSE) component. Unsafe renegotiation can be re-enabled using the sun.security.ssl.allowUnsafeRenegotiation property.

All running instances of Sun Java must be restarted for the update to take effect.

A flaw was found in the way the TLS/SSL (Transport Layer Security/Secure Sockets Layer) protocols handle session renegotiation.
A man-in-the-middle attacker could use this flaw to prefix arbitrary plain text to a client's session (for example, an HTTPS connection to a website). This could force the server to process an attacker's request as if authenticated using the victim's credentials.
(CVE-2009-3555)

This update disables renegotiation in the Java Secure Socket Extension (JSSE) component. Unsafe renegotiation can be re-enabled using the sun.security.ssl.allowUnsafeRenegotiation property.

A number of flaws have been fixed in the Java Virtual Machine (JVM) and in various Java class implementations. These flaws could allow an unsigned applet or application to bypass intended access restrictions.
(CVE-2010-0082, CVE-2010-0084, CVE-2010-0085, CVE-2010-0088, CVE-2010-0094)

An untrusted applet could access clipboard information if a drag operation was performed over that applet's canvas. This could lead to an information leak. (CVE-2010-0091)

The rawIndex operation incorrectly handled large values, causing the corruption of internal memory structures, resulting in an untrusted applet or application crashing. (CVE-2010-0092)

The System.arraycopy operation incorrectly handled large index values, potentially causing array corruption in an untrusted applet or application. (CVE-2010-0093)

Subclasses of InetAddress may incorrectly interpret network addresses, allowing an untrusted applet or application to bypass network access restrictions. (CVE-2010-0095)

In certain cases, type assignments could result in 'non-exact' interface types. This could be used to bypass type-safety restrictions. (CVE-2010-0845)

A buffer overflow flaw in LittleCMS (embedded in OpenJDK) could cause an untrusted applet or application using color profiles from untrusted sources to crash. (CVE-2010-0838)

An input validation flaw was found in the JRE unpack200 functionality.
An untrusted applet or application could use this flaw to elevate its privileges. (CVE-2010-0837)

Deferred calls to trusted applet methods could be granted incorrect permissions, allowing an untrusted applet or application to extend its privileges. (CVE-2010-0840)

A missing input validation flaw in the JRE could allow an attacker to crash an untrusted applet or application. (CVE-2010-0848)

A flaw in Java2D could allow an attacker to execute arbitrary code with the privileges of a user running an untrusted applet or application that uses Java2D. (CVE-2010-0847)

Note: The flaws concerning applets in this advisory, CVE-2010-0082, CVE-2010-0084, CVE-2010-0085, CVE-2010-0088, CVE-2010-0091, CVE-2010-0092, CVE-2010-0093, CVE-2010-0094, CVE-2010-0095, CVE-2010-0837, CVE-2010-0838, CVE-2010-0840, CVE-2010-0847, and CVE-2010-0848, can only be triggered in java-1.6.0-openjdk by calling the 'appletviewer' application.

This update also provides three defense in depth patches. (BZ#575745, BZ#575861, BZ#575789)

All running instances of OpenJDK Java must be restarted for the update to take effect.

a. vCenter Server and vCenter Update Manager update Microsoft    SQL Server 2005 Express Edition to Service Pack 3

   Microsoft SQL Server 2005 Express Edition (SQL Express)    distributed with vCenter Server 4.1 Update 1 and vCenter Update    Manager 4.1 Update 1 is upgraded from  SQL Express Service Pack 2    to SQL Express Service Pack 3, to address multiple security    issues that exist in the earlier releases of Microsoft SQL Express.

   Customers using other database solutions need not update for    these issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2008-5416, CVE-2008-0085, CVE-2008-0086,    CVE-2008-0107 and CVE-2008-0106 to the issues addressed in MS SQL    Express Service Pack 3.

b. vCenter Apache Tomcat Management Application Credential Disclosure

   The Apache Tomcat Manager application configuration file contains    logon credentials that can be read by unprivileged local users.

   The issue is resolved by removing the Manager application in    vCenter 4.1 Update 1.

   If vCenter 4.1 is updated to vCenter 4.1 Update 1 the logon    credentials are not present in the configuration file after the    update.

   VMware would like to thank Claudio Criscione of Secure Networking    for reporting this issue to us.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2010-2928 to this issue.

c. vCenter Server and ESX, Oracle (Sun) JRE is updated to version    1.6.0_21

   Oracle (Sun) JRE update to version 1.6.0_21, which addresses    multiple security issues that existed in earlier releases of    Oracle (Sun) JRE.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    Oracle (Sun) JRE 1.6.0_19: CVE-2009-3555, CVE-2010-0082,    CVE-2010-0084, CVE-2010-0085, CVE-2010-0087, CVE-2010-0088,    CVE-2010-0089, CVE-2010-0090, CVE-2010-0091, CVE-2010-0092,    CVE-2010-0093, CVE-2010-0094, CVE-2010-0095, CVE-2010-0837,    CVE-2010-0838, CVE-2010-0839, CVE-2010-0840, CVE-2010-0841,    CVE-2010-0842, CVE-2010-0843, CVE-2010-0844, CVE-2010-0845,    CVE-2010-0846, CVE-2010-0847, CVE-2010-0848, CVE-2010-0849,    CVE-2010-0850.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following name to the security issue fixed in    Oracle (Sun) JRE 1.6.0_20: CVE-2010-0886.

d. vCenter Update Manager Oracle (Sun) JRE is updated to version   1.5.0_26

   Oracle (Sun) JRE update to version 1.5.0_26, which addresses    multiple security issues that existed in earlier releases of    Oracle (Sun) JRE.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    Oracle (Sun) JRE 1.5.0_26: CVE-2010-3556, CVE-2010-3566,    CVE-2010-3567, CVE-2010-3550, CVE-2010-3561, CVE-2010-3573,    CVE-2010-3565,CVE-2010-3568, CVE-2010-3569,  CVE-2009-3555,    CVE-2010-1321, CVE-2010-3548, CVE-2010-3551, CVE-2010-3562,    CVE-2010-3571, CVE-2010-3554, CVE-2010-3559, CVE-2010-3572,    CVE-2010-3553, CVE-2010-3549, CVE-2010-3557, CVE-2010-3541,    CVE-2010-3574.

e. vCenter Server and ESX Apache Tomcat updated to version 6.0.28

   Apache Tomcat updated to version 6.0.28, which addresses multiple    security issues that existed in earlier releases of Apache Tomcat

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    Apache Tomcat 6.0.24: CVE-2009-2693, CVE-2009-2901, CVE-2009-2902,i    and CVE-2009-3548.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    Apache Tomcat 6.0.28: CVE-2010-2227, CVE-2010-1157.

f. vCenter Server third-party component OpenSSL updated to version    0.9.8n

   The version of the OpenSSL library in vCenter Server is updated to    0.9.8n.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2010-0740 and CVE-2010-0433 to the    issues addressed in this version of OpenSSL.

g. ESX third-party component OpenSSL updated to version 0.9.8p

   The version of the ESX OpenSSL library is updated to 0.9.8p.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2010-3864 and CVE-2010-2939 to the    issues addressed in this update.

h. ESXi third-party component cURL updated

   The version of cURL library in ESXi is updated.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2010-0734 to the issues addressed in    this update.

i. ESX third-party component pam_krb5 updated

   The version of pam_krb5 library is updated.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2008-3825 and CVE-2009-1384 to the    issues addressed in the update.

j. ESX third-party update for Service Console kernel

   The Service Console kernel is updated to include kernel version    2.6.18-194.11.1.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2010-1084, CVE-2010-2066, CVE-2010-2070,    CVE-2010-2226, CVE-2010-2248, CVE-2010-2521, CVE-2010-2524,    CVE-2010-0008, CVE-2010-0415, CVE-2010-0437, CVE-2009-4308,    CVE-2010-0003, CVE-2010-0007, CVE-2010-0307, CVE-2010-1086,    CVE-2010-0410, CVE-2010-0730, CVE-2010-1085, CVE-2010-0291,    CVE-2010-0622, CVE-2010-1087, CVE-2010-1173, CVE-2010-1437,    CVE-2010-1088, CVE-2010-1187, CVE-2010-1436, CVE-2010-1641, and    CVE-2010-3081 to the issues addressed in the update.

   Notes :
   - The update also addresses the 64-bit compatibility mode    stack pointer underflow issue identified by CVE-2010-3081. This    issue was patched in an ESX 4.1 patch prior to the release of    ESX 4.1 Update 1 and in a previous ESX 4.0 patch release.
   - The update also addresses CVE-2010-2240 for ESX 4.0.

Sun Java 6 was updated to Update 19, fixing a large number of security issues: CVE-2009-3555 / CVE-2010-0082 / CVE-2010-0084 / CVE-2010-0085 / CVE-2010-0087 / CVE-2010-0088 / CVE-2010-0089 / CVE-2010-0090 / CVE-2010-0091 / CVE-2010-0092 / CVE-2010-0093 / CVE-2010-0094 / CVE-2010-0095 / CVE-2010-0837 / CVE-2010-0838 / CVE-2010-0839 / CVE-2010-0840 / CVE-2010-0841 / CVE-2010-0842 / CVE-2010-0843 / CVE-2010-0844 / CVE-2010-0845 / CVE-2010-0846 / CVE-2010-0847 / CVE-2010-0848 / CVE-2010-0849 / CVE-2010-0850.

Add latest security updates.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Add latest security patches.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated java-1.6.0-openjdk packages that fix several security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

These packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Software Development Kit. The Java Runtime Environment (JRE) contains the software and tools that users need to run applications written using the Java programming language.

A flaw was found in the way the TLS/SSL (Transport Layer Security/Secure Sockets Layer) protocols handle session renegotiation.
A man-in-the-middle attacker could use this flaw to prefix arbitrary plain text to a client's session (for example, an HTTPS connection to a website). This could force the server to process an attacker's request as if authenticated using the victim's credentials.
(CVE-2009-3555)

This update disables renegotiation in the Java Secure Socket Extension (JSSE) component. Unsafe renegotiation can be re-enabled using the sun.security.ssl.allowUnsafeRenegotiation property. Refer to the following Knowledgebase article for details:
http://kbase.redhat.com/faq/docs/DOC-20491

A number of flaws have been fixed in the Java Virtual Machine (JVM) and in various Java class implementations. These flaws could allow an unsigned applet or application to bypass intended access restrictions.
(CVE-2010-0082, CVE-2010-0084, CVE-2010-0085, CVE-2010-0088, CVE-2010-0094)

An untrusted applet could access clipboard information if a drag operation was performed over that applet's canvas. This could lead to an information leak. (CVE-2010-0091)

The rawIndex operation incorrectly handled large values, causing the corruption of internal memory structures, resulting in an untrusted applet or application crashing. (CVE-2010-0092)

The System.arraycopy operation incorrectly handled large index values, potentially causing array corruption in an untrusted applet or application. (CVE-2010-0093)

Subclasses of InetAddress may incorrectly interpret network addresses, allowing an untrusted applet or application to bypass network access restrictions. (CVE-2010-0095)

In certain cases, type assignments could result in 'non-exact' interface types. This could be used to bypass type-safety restrictions. (CVE-2010-0845)

A buffer overflow flaw in LittleCMS (embedded in OpenJDK) could cause an untrusted applet or application using color profiles from untrusted sources to crash. (CVE-2010-0838)

An input validation flaw was found in the JRE unpack200 functionality.
An untrusted applet or application could use this flaw to elevate its privileges. (CVE-2010-0837)

Deferred calls to trusted applet methods could be granted incorrect permissions, allowing an untrusted applet or application to extend its privileges. (CVE-2010-0840)

A missing input validation flaw in the JRE could allow an attacker to crash an untrusted applet or application. (CVE-2010-0848)

A flaw in Java2D could allow an attacker to execute arbitrary code with the privileges of a user running an untrusted applet or application that uses Java2D. (CVE-2010-0847)

Note: The flaws concerning applets in this advisory, CVE-2010-0082, CVE-2010-0084, CVE-2010-0085, CVE-2010-0088, CVE-2010-0091, CVE-2010-0092, CVE-2010-0093, CVE-2010-0094, CVE-2010-0095, CVE-2010-0837, CVE-2010-0838, CVE-2010-0840, CVE-2010-0847, and CVE-2010-0848, can only be triggered in java-1.6.0-openjdk by calling the 'appletviewer' application.

This update also provides three defense in depth patches. (BZ#575745, BZ#575861, BZ#575789)

All users of java-1.6.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect.

The remote host is affected by the vulnerability described in GLSA-201006-18 (Oracle JRE/JDK: Multiple vulnerabilities)

    Multiple vulnerabilities have been reported in the Oracle Java     implementation. Please review the CVE identifiers referenced below and     the associated Oracle Critical Patch Update Advisory for details.
  Impact :

    A remote attacker could exploit these vulnerabilities to cause     unspecified impact, possibly including remote execution of arbitrary     code.
  Workaround :

    There is no known workaround at this time.

The java-1.5.0-sun packages as shipped in Red Hat Enterprise Linux 4 Extras and 5 Supplementary contain security flaws and should not be used.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The Sun 1.5.0 Java release includes the Sun Java 5 Runtime Environment and the Sun Java 5 Software Development Kit.

The java-1.5.0-sun packages are vulnerable to a number of security flaws and should no longer be used. (CVE-2009-3555, CVE-2010-0082, CVE-2010-0084, CVE-2010-0085, CVE-2010-0087, CVE-2010-0088, CVE-2010-0089, CVE-2010-0091, CVE-2010-0092, CVE-2010-0093, CVE-2010-0094, CVE-2010-0095, CVE-2010-0837, CVE-2010-0838, CVE-2010-0839, CVE-2010-0840, CVE-2010-0841, CVE-2010-0842, CVE-2010-0843, CVE-2010-0844, CVE-2010-0845, CVE-2010-0846, CVE-2010-0847, CVE-2010-0848, CVE-2010-0849)

The Sun Java SE Release family 5.0 reached its End of Service Life on November 3, 2009. The RHSA-2009:1571 update provided the final publicly available update of version 5.0 (Update 22). Users interested in continuing to receive critical fixes for Sun Java SE 5.0 should contact Oracle :

http://www.sun.com/software/javaforbusiness/index.jsp

An alternative to Sun Java SE 5.0 is the Java 2 Technology Edition of the IBM Developer Kit for Linux, which is available from the Extras and Supplementary channels on the Red Hat Network.

Applications capable of using the Java 6 runtime can be migrated to Java 6 on: OpenJDK (java-1.6.0-openjdk), an open source JDK included in Red Hat Enterprise Linux 5, since 5.3; the IBM JDK, java-1.6.0-ibm;
or the Sun JDK, java-1.6.0-sun.

This update removes the java-1.5.0-sun packages as they have reached their End of Service Life.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2010:0337 advisory.

    The Sun 1.6.0 Java release includes the Sun Java 6 Runtime Environment and     the Sun Java 6 Software Development Kit.

    This update fixes several vulnerabilities in the Sun Java 6 Runtime     Environment and the Sun Java 6 Software Development Kit. Further     information about these flaws can be found on the Oracle Java SE and Java     for Business Critical Patch Update Advisory page, listed in the     References section. (CVE-2009-3555, CVE-2010-0082, CVE-2010-0084,     CVE-2010-0085, CVE-2010-0087, CVE-2010-0088, CVE-2010-0089, CVE-2010-0090,     CVE-2010-0091, CVE-2010-0092, CVE-2010-0093, CVE-2010-0094, CVE-2010-0095,     CVE-2010-0837, CVE-2010-0838, CVE-2010-0839, CVE-2010-0840, CVE-2010-0841,     CVE-2010-0842, CVE-2010-0843, CVE-2010-0844, CVE-2010-0845, CVE-2010-0846,     CVE-2010-0847, CVE-2010-0848, CVE-2010-0849)

    For the CVE-2009-3555 issue, this update disables renegotiation in the Java     Secure Socket Extension (JSSE) component. Unsafe renegotiation can be     re-enabled using the sun.security.ssl.allowUnsafeRenegotiation property.
    Refer to the following Knowledgebase article for details:
    http://kbase.redhat.com/faq/docs/DOC-20491

    Users of java-1.6.0-sun should upgrade to these updated packages, which     correct these issues. All running instances of Sun Java must be restarted     for the update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

java-1_6_0-openjdk version 1.7.3 fixes serveral security issues :

  - CVE-2010-0837: JAR 'unpack200' must verify input     parameters

  - CVE-2010-0845: No ClassCastException for     HashAttributeSet constructors if run with -Xcomp

  - CVE-2010-0838: CMM readMabCurveData Buffer Overflow     Vulnerability

  - CVE-2010-0082: Loader-constraint table allows arrays     instead of only the base-classes

  - CVE-2010-0095: Subclasses of InetAddress may incorrectly     interpret network addresses

  - CVE-2010-0085: File TOCTOU deserialization vulnerability

  - CVE-2010-0091: Unsigned applet can retrieve the dragged     information before drop action occurs

  - CVE-2010-0088: Inflater/Deflater clone issues

  - CVE-2010-0084: Policy/PolicyFile leak dynamic     ProtectionDomains.

  - CVE-2010-0092: AtomicReferenceArray causes SIGSEGV ->     SEGV_MAPERR error

  - CVE-2010-0094: Deserialization of RMIConnectionImpl     objects should enforce stricter checks

  - CVE-2010-0093: System.arraycopy unable to reference     elements beyond Integer.MAX_VALUE bytes

  - CVE-2010-0840: Applet Trusted Methods Chaining Privilege     Escalation Vulnerability

  - CVE-2010-0848: AWT Library Invalid Index Vulnerability

  - CVE-2010-0847: ImagingLib arbitrary code execution     vulnerability

  - CVE-2009-3555: TLS: MITM attacks via session     renegotiation

Multiple Java OpenJDK security vulnerabilities has been identified and fixed :

  - TLS: MITM attacks via session renegotiation     (CVE-2009-3555).

    - Loader-constraint table allows arrays instead of only       the b ase-classes (CVE-2010-0082).

  - Policy/PolicyFile leak dynamic ProtectionDomains.
    (CVE-2010-0084).

    - File TOCTOU deserialization vulnerability       (CVE-2010-0085).

    - Inflater/Deflater clone issues (CVE-2010-0088).

    - Unsigned applet can retrieve the dragged information       before drop action occurs (CVE-2010-0091).

  - AtomicReferenceArray causes SIGSEGV -> SEGV_MAPERR error     (CVE-2010-0092).

  - System.arraycopy unable to reference elements beyond     Integer.MAX_VALUE bytes (CVE-2010-0093).

  - Deserialization of RMIConnectionImpl objects should     enforce stricter checks (CVE-2010-0094).

  - Subclasses of InetAddress may incorrectly interpret     network addresses (CVE-2010-0095).

  - JAR unpack200 must verify input parameters     (CVE-2010-0837).

    - CMM readMabCurveData Buffer Overflow Vulnerability       (CVE-2010-0838).

    - Applet Trusted Methods Chaining Privilege Escalation       Vulnerability (CVE-2010-0840).

  - No ClassCastException for HashAttributeSet constructors     if run with -Xcomp (CVE-2010-0845)

  - ImagingLib arbitrary code execution vulnerability     (CVE-2010-0847).

    - AWT Library Invalid Index Vulnerability       (CVE-2010-0848).

Additional security issues that was fixed with IcedTea6 1.6.2 :

  - deprecate MD2 in SSL cert validation (CVE-2009-2409).

    - ICC_Profile file existence detection information leak       (CVE-2009-3728).

  - JRE AWT setDifflCM stack overflow (CVE-2009-3869).

    - JRE AWT setBytePixels heap overflow (CVE-2009-3871).

    - JPEG Image Writer quantization problem       (CVE-2009-3873).

    - ImageI/O JPEG heap overflow (CVE-2009-3874).

    - MessageDigest.isEqual introduces timing attack       vulnerabilities (CVE-2009-3875).

  - OpenJDK ASN.1/DER input stream parser denial of service     (CVE-2009-3876, CVE-2009-3877)

  - GraphicsConfiguration information leak (CVE-2009-3879).

    - UI logging information leakage (CVE-2009-3880).

    - resurrected classloaders can still have children       (CVE-2009-3881).

    - Numerous static security flaws in Swing (findbugs)       (CVE-2009-3882).

    - Mutable statics in Windows PL&amp;F (findbugs)       (CVE-2009-3883).

    - zoneinfo file existence information leak       (CVE-2009-3884).

    - BMP parsing DoS with UNC ICC links (CVE-2009-3885).

Additionally Paulo Cesar Pereira de Andrade (pcpa) at Mandriva found and fixed a bug in IcedTea6 1.8 that is also applied to the provided packages :

  - plugin/icedteanp/IcedTeaNPPlugin.cc     (plugin_filter_environment): Increment malloc size by     one to account for NULL terminator. Bug# 474.

Packages for 2009.0 are provided due to the Extended Maintenance Program.

Marsh Ray and Steve Dispensa discovered a flaw in the TLS and SSLv3 protocols. If an attacker could perform a man in the middle attack at the start of a TLS connection, the attacker could inject arbitrary content at the beginning of the user's session. (CVE-2009-3555)

It was discovered that Loader-constraint table, Policy/PolicyFile, Inflater/Deflater, drag/drop access, and deserialization did not correctly handle certain sensitive objects. If a user were tricked into running a specially crafted applet, private information could be leaked to a remote attacker, leading to a loss of privacy.
(CVE-2010-0082, CVE-2010-0084, CVE-2010-0085, CVE-2010-0088, CVE-2010-0091, CVE-2010-0094)

It was discovered that AtomicReferenceArray, System.arraycopy, InetAddress, and HashAttributeSet did not correctly handle certain situations. If a remote attacker could trigger specific error conditions, a Java application could crash, leading to a denial of service. (CVE-2010-0092, CVE-2010-0093, CVE-2010-0095, CVE-2010-0845)

It was discovered that Pack200, CMM readMabCurveData, ImagingLib, and the AWT library did not correctly check buffer lengths. If a user or automated system were tricked into handling specially crafted JAR files or images, a remote attacker could crash the Java application or possibly gain user privileges (CVE-2010-0837, CVE-2010-0838, CVE-2010-0847, CVE-2010-0848).

It was discovered that applets did not correctly handle certain trust chains. If a user were tricked into running a specially crafted applet, a remote attacker could possibly run untrusted code with user privileges. (CVE-2010-0840).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Sun Java 6 was updated to Update 19, fixing a large number of security issues.

CVE-2009-3555 CVE-2010-0082 CVE-2010-0084 CVE-2010-0085 CVE-2010-0087 CVE-2010-0088 CVE-2010-0089 CVE-2010-0090 CVE-2010-0091 CVE-2010-0092 CVE-2010-0093 CVE-2010-0094 CVE-2010-0095 CVE-2010-0837 CVE-2010-0838 CVE-2010-0839 CVE-2010-0840 CVE-2010-0841 CVE-2010-0842 CVE-2010-0843 CVE-2010-0844 CVE-2010-0845 CVE-2010-0846 CVE-2010-0847 CVE-2010-0848 CVE-2010-0849 CVE-2010-0850

The version of Oracle (formerly Sun) Java Runtime Environment (JRE) installed on the remote host is earlier than 6 Update 19 / 5.0 Update 24 / 1.4.2_26. Such versions are potentially affected by security issues in the following components :

  - ImageIO
   - Java 2D
   - JRE
   - Java Web Start, Java Plug-in
   - Pack200
   - Sound
   - JSSE
   - HotSpot Server

ID	Name	Product	Family	Severity
89674	VMware ESX / ESXi Third-Party Libraries Multiple Vulnerabilities (VMSA-2011-0003) (remote check)	Nessus	Misc.	high
68028	Oracle Linux 5 : java-1.6.0-openjdk (ELSA-2010-0339)	Nessus	Oracle Linux Local Security Checks	critical
64842	Oracle Java SE Multiple Vulnerabilities (March 2010 CPU) (Unix)	Nessus	Misc.	high
60777	Scientific Linux Security Update : java (jdk 1.6.0) on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
60776	Scientific Linux Security Update : java-1.6.0-openjdk on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
51971	VMSA-2011-0003 : Third-party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX	Nessus	VMware ESX Local Security Checks	high
50917	SuSE 11 Security Update : Sun Java 6 (SAT Patch Number 2225)	Nessus	SuSE Local Security Checks	high
47426	Fedora 13 : java-1.6.0-openjdk-1.6.0.0-37.b17.fc13 (2010-6279)	Nessus	Fedora Local Security Checks	high
47411	Fedora 11 : java-1.6.0-openjdk-1.6.0.0-34.b17.fc11 (2010-6039)	Nessus	Fedora Local Security Checks	high
47410	Fedora 12 : java-1.6.0-openjdk-1.6.0.0-37.b17.fc12 (2010-6025)	Nessus	Fedora Local Security Checks	high
46873	CentOS 5 : java-1.6.0-openjdk (CESA-2010:0339)	Nessus	CentOS Local Security Checks	high
46807	GLSA-201006-18 : Oracle JRE/JDK: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
46295	RHEL 5 : java-1.6.0-openjdk (RHSA-2010:0339)	Nessus	Red Hat Local Security Checks	high
46294	RHEL 4 / 5 : java-1.5.0-sun (RHSA-2010:0338)	Nessus	Red Hat Local Security Checks	high
46293	RHEL 5 : java-1.6.0-sun (RHSA-2010:0337)	Nessus	Red Hat Local Security Checks	critical
46191	openSUSE Security Update : java-1_6_0-openjdk (openSUSE-SU-2010:0182-1)	Nessus	SuSE Local Security Checks	high
46189	openSUSE Security Update : java-1_6_0-openjdk (openSUSE-SU-2010:0182-1)	Nessus	SuSE Local Security Checks	high
46187	openSUSE Security Update : java-1_6_0-openjdk (openSUSE-SU-2010:0182-1)	Nessus	SuSE Local Security Checks	high
46176	Mandriva Linux Security Advisory : java-1.6.0-openjdk (MDVSA-2010:084)	Nessus	Mandriva Local Security Checks	high
45474	Ubuntu 8.04 LTS / 8.10 / 9.04 / 9.10 : openjdk-6 vulnerabilities (USN-923-1)	Nessus	Ubuntu Local Security Checks	high
45465	openSUSE Security Update : java-1_6_0-sun (java-1_6_0-sun-2228)	Nessus	SuSE Local Security Checks	high
45459	openSUSE Security Update : java-1_6_0-sun (java-1_6_0-sun-2228)	Nessus	SuSE Local Security Checks	high
45454	openSUSE Security Update : java-1_6_0-sun (java-1_6_0-sun-2228)	Nessus	SuSE Local Security Checks	high
45379	Oracle Java SE Multiple Vulnerabilities (March 2010 CPU)	Nessus	Windows	high

Detections

Analytics

CVE-2010-0845

critical

Tenable Plugins

high

critical

high

high

high

high

high

high

high

high

high

critical

high

high

critical

high

high

high

high

high

high

high

high

high