IcedTea 1.7.x before 1.7.6, 1.8.x before 1.8.3, and 1.9.x before 1.9.2, as based on OpenJDK 6, declares multiple sensitive variables as public, which allows remote attackers to obtain sensitive information including (1) user.name, (2) user.home, and (3) java.home system properties, and other sensitive information such as installation directories.

The remote host is affected by the vulnerability described in GLSA-201406-32 (IcedTea JDK: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in the IcedTea JDK. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, obtain       sensitive information, bypass intended security policies, or have other       unspecified impact.
  Workaround :

    There is no known workaround at this time.

This update of IcedTea fixes an information leak in System property via public static. (CVE-2010-3860)

From Red Hat Security Advisory 2011:0176 :

Updated java-1.6.0-openjdk packages that fix two security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

These packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Software Development Kit. The javaws command can be used to launch Java Web Start applications.

A public static field declaration allowed untrusted JNLP (Java Network Launching Protocol) applications to read privileged data. A remote attacker could directly or indirectly read the values of restricted system properties, such as 'user.name', 'user.home', and 'java.home', which untrusted applications should not be allowed to read.
(CVE-2010-3860)

It was found that JNLPSecurityManager could silently return without throwing an exception when permission was denied. If the javaws command was used to launch a Java Web Start application that relies on this exception being thrown, it could result in that application being run with elevated privileges, allowing it to bypass security manager restrictions and gain access to privileged functionality.
(CVE-2010-4351)

Note: The RHSA-2010:0339 java-1.6.0-openjdk update installed javaws by mistake. As part of the fixes for CVE-2010-3860 and CVE-2010-4351, this update removes javaws.

Red Hat would like to thank the TippingPoint Zero Day Initiative project for reporting CVE-2010-4351. The original issue reporter wishes to stay anonymous.

This erratum also upgrades the OpenJDK package to IcedTea6 1.7.7.
Refer to the NEWS file, linked to in the References, for further information.

All users of java-1.6.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect.

A public static field declaration allowed untrusted JNLP (Java Network Launching Protocol) applications to read privileged data. A remote attacker could directly or indirectly read the values of restricted system properties, such as 'user.name', 'user.home', and 'java.home', which untrusted applications should not be allowed to read.
(CVE-2010-3860)

It was found that JNLPSecurityManager could silently return without throwing an exception when permission was denied. If the javaws command was used to launch a Java Web Start application that relies on this exception being thrown, it could result in that application being run with elevated privileges, allowing it to bypass security manager restrictions and gain access to privileged functionality.
(CVE-2010-4351)

Note: The previous java-1.6.0-openjdk update installed javaws by mistake. As part of the fixes for CVE-2010-3860 and CVE-2010-4351, this update removes javaws.

This erratum also upgrades the OpenJDK package to IcedTea6 1.7.7.
Refer to the NEWS file, linked to in the References, for further information.

All running instances of OpenJDK Java must be restarted for the update to take effect.

Updated java-1.6.0-openjdk packages that fix two security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

These packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Software Development Kit. The javaws command can be used to launch Java Web Start applications.

A public static field declaration allowed untrusted JNLP (Java Network Launching Protocol) applications to read privileged data. A remote attacker could directly or indirectly read the values of restricted system properties, such as 'user.name', 'user.home', and 'java.home', which untrusted applications should not be allowed to read.
(CVE-2010-3860)

It was found that JNLPSecurityManager could silently return without throwing an exception when permission was denied. If the javaws command was used to launch a Java Web Start application that relies on this exception being thrown, it could result in that application being run with elevated privileges, allowing it to bypass security manager restrictions and gain access to privileged functionality.
(CVE-2010-4351)

Note: The RHSA-2010:0339 java-1.6.0-openjdk update installed javaws by mistake. As part of the fixes for CVE-2010-3860 and CVE-2010-4351, this update removes javaws.

Red Hat would like to thank the TippingPoint Zero Day Initiative project for reporting CVE-2010-4351. The original issue reporter wishes to stay anonymous.

This erratum also upgrades the OpenJDK package to IcedTea6 1.7.7.
Refer to the NEWS file, linked to in the References, for further information.

All users of java-1.6.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:0176 advisory.

  - IcedTea System property information leak via public static (CVE-2010-3860)

  - IcedTea jnlp security manager bypass (CVE-2010-4351)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This package updates IcedTea6 to version 1.9.2 (from 1.9.1). It fixes rhbz# 645843, 647737 and 643674. 

Additionally it updates HotSpot to hs19b09 which includes stability and performance enhancements.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that certain system property information was being leaked, which could allow an attacker to obtain sensitive information.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
76303	GLSA-201406-32 : IcedTea JDK: Multiple vulnerabilities (BEAST) (ROBOT)	Nessus	Gentoo Local Security Checks	critical
75535	openSUSE Security Update : java-1_6_0-openjdk (openSUSE-SU-2010:1017-1)	Nessus	SuSE Local Security Checks	medium
68186	Oracle Linux 5 : java-1.6.0-openjdk (ELSA-2011-0176)	Nessus	Oracle Linux Local Security Checks	medium
60942	Scientific Linux Security Update : java-1.6.0-openjdk on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
53732	openSUSE Security Update : java-1_6_0-openjdk (openSUSE-SU-2010:1017-1)	Nessus	SuSE Local Security Checks	medium
53663	openSUSE Security Update : java-1_6_0-openjdk (openSUSE-SU-2010:1017-1)	Nessus	SuSE Local Security Checks	medium
53415	CentOS 5 : java-1.6.0-openjdk (CESA-2011:0176)	Nessus	CentOS Local Security Checks	medium
51671	RHEL 5 : java-1.6.0-openjdk (RHSA-2011:0176)	Nessus	Red Hat Local Security Checks	high
50866	Fedora 14 : java-1.6.0-openjdk-1.6.0.0-49.1.9.2.fc14 (2010-18393)	Nessus	Fedora Local Security Checks	medium
50857	Ubuntu 8.04 LTS / 9.10 / 10.04 LTS / 10.10 : openjdk-6 vulnerability (USN-1024-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2010-3860

high

Tenable Plugins

critical

medium

medium

medium

medium

medium

medium

high

medium

medium