The web browser plug-in in IcedTea-Web 1.0.x before 1.0.6 and 1.1.x before 1.1.4 allows remote attackers to bypass the Same Origin Policy (SOP) and execute arbitrary script or establish network connections to unintended hosts via an applet whose origin has the same second-level domain, but a different sub-domain than the targeted domain.

Update to version 1.1.4 of icedtea-web to fix the following issues :

  - CVE-2011-3377: IcedTea-Web: second-level domain     subdomains and suffix domain SOP bypass

  - PR778: Jar download and server certificate verification     deadlock

- update to 1.2

  - New features :

  - Signed JNLP support

  - Support for client authentication certificates

  - Cache size enforcement now supported via itweb-settings

  - Applet parameter passing through JNLP files now     supported

  - Better icons for access warning dialog

  - Security Dialog UI revamped to make it look less     threatening when appropriate

  - Fixes (plugin, webstart, common)

  - PR618: Can't install OpenDJ, JavaWebStart fails with     Input stream is null error

  - PR765: JNLP file with all resource jars marked as 'lazy'     fails to validate signature and stops the launch of     application

  - PR788: Elluminate Live! is not working

  - PR804: javaws launcher incorrectly handles file names     with spaces

  - PR820, bnc#746895: IcedTea-Web 1.1.3 crashing Firefox     when loading Citrix XenApp

  - PR838: IcedTea plugin crashes with chrome browser when     JavaScript is executed

  - PR852: Classloader not being flushed after last applet     from a site is closed

  - RH586194: Unable to connect to connect with Juniper VPN     client

  - PR771: IcedTea-Web certificate verification code does     not use the right API

  - PR742: IcedTea-Web checks certs only upto 1 level deep     before declaring them untrusted.

  - PR789: typo in jrunscript.sh

  - PR808: javaws is unable to start, when missing jars are     enumerated before main jar

  - RH738814: Access denied at ssl handshake

  - Support for authenticating using client certificates

  - fix bnc#737105/FATE#313084: add Supplements:
    packageand(broswer(npapi):java-openjdk) ensures the web     plugin is pulled in when openjdk and capable browser is     installed

  - enable make check in respective section

  - update to 1.1.4 (fixes bnc#729870)

  - RH742515, CVE-2011-3377: IcedTea-Web: second-level     domain subdomains and suffix domain SOP bypass

  - PR778: Jar download and server certificate verification     deadlock

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2011-1441 advisory.

    [1.0.6-1]
    - Updated to 1.0.6
    - Resolves: rhbz#744738
    - Resolves: rhbz#745414

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The IcedTea-Web project provides a Java web browser plug-in and an implementation of Java Web Start, which is based on the Netx project.
It also contains a configuration tool for managing deployment settings for the plug-in and Web Start implementations.

A flaw was found in the same-origin policy implementation in the IcedTea-Web browser plug-in. A malicious Java applet could use this flaw to open network connections to hosts other than the originating host, violating the same-origin policy. (CVE-2011-3377)

All IcedTea-Web users should upgrade to these updated packages, which upgrade IcedTea-Web to version 1.0.6 to correct this issue. Web browsers using the IcedTea-Web browser plug-in must be restarted for this update to take effect.

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform.

  - CVE-2011-3377     The IcedTea browser plugin included in the openjdk-6     package does not properly enforce the Same Origin Policy     on web content served under a domain name which has a     common suffix with the required domain name.

  - CVE-2011-3563     The Java Sound component did not properly check for     array boundaries. A malicious input or an untrusted Java     application or applet could use this flaw to cause Java     Virtual Machine to crash or disclose portion of its     memory.

  - CVE-2011-5035     The OpenJDK embedded web server did not guard against an     excessive number of a request parameters, leading to a     denial of service vulnerability involving hash     collisions.

  - CVE-2012-0497     It was discovered that Java2D did not properly check     graphics rendering objects before passing them to the     native renderer. This could lead to JVM crash or Java     sandbox bypass.

  - CVE-2012-0501     The ZIP central directory parser used by     java.util.zip.ZipFile entered an infinite recursion in     native code when processing a crafted ZIP file, leading     to a denial of service.

  - CVE-2012-0502     A flaw was found in the AWT KeyboardFocusManager class     that could allow untrusted Java applets to acquire     keyboard focus and possibly steal sensitive information.

  - CVE-2012-0503     The java.util.TimeZone.setDefault() method lacked a     security manager invocation, allowing an untrusted Java     application or applet to set a new default time zone.

  - CVE-2012-0505     The Java serialization code leaked references to     serialization exceptions, possibly leaking critical     objects to untrusted code in Java applets and     applications.

  - CVE-2012-0506     It was discovered that CORBA implementation in Java did     not properly protect repository identifiers (that can be     obtained using _ids() method) on certain Corba objects.
    This could have been used to perform modification of the     data that should have been immutable.

  - CVE-2012-0507     The AtomicReferenceArray class implementation did not     properly check if the array is of an expected Object[]     type. A malicious Java application or applet could use     this flaw to cause Java Virtual Machine to crash or     bypass Java sandbox restrictions.

USN-1263-1 fixed vulnerabilities in OpenJDK 6. The upstream patch for the chosen plaintext attack on the block-wise AES encryption algorithm (CVE-2011-3389) introduced a regression that caused TLS/SSL connections to fail when using certain algorithms. This update fixes the problem.

We apologize for the inconvenience.

Deepak Bhole discovered a flaw in the Same Origin Policy (SOP) implementation in the IcedTea web browser plugin. This could allow a remote attacker to open connections to certain hosts that should not be permitted. (CVE-2011-3377)

Juliano Rizzo and Thai Duong discovered that the block-wise AES encryption algorithm block-wise as used in TLS/SSL was vulnerable to a chosen-plaintext attack. This could allow a remote attacker to view confidential data. (CVE-2011-3389)

It was discovered that a type confusion flaw existed in the in the Internet Inter-Orb Protocol (IIOP) deserialization code. A remote attacker could use this to cause an untrusted application or applet to execute arbitrary code by deserializing malicious input. (CVE-2011-3521)

It was discovered that the Java scripting engine did not perform SecurityManager checks. This could allow a remote attacker to cause an untrusted application or applet to execute arbitrary code with the full privileges of the JVM.
(CVE-2011-3544)

It was discovered that the InputStream class used a global buffer to store input bytes skipped. An attacker could possibly use this to gain access to sensitive information.
(CVE-2011-3547)

It was discovered that a vulnerability existed in the AWTKeyStroke class. A remote attacker could cause an untrusted application or applet to execute arbitrary code.
(CVE-2011-3548)

It was discovered that an integer overflow vulnerability existed in the TransformHelper class in the Java2D implementation. A remote attacker could use this cause a denial of service via an application or applet crash or possibly execute arbitrary code. (CVE-2011-3551)

It was discovered that the default number of available UDP sockets for applications running under SecurityManager restrictions was set too high. A remote attacker could use this with a malicious application or applet exhaust the number of available UDP sockets to cause a denial of service for other applets or applications running within the same JVM. (CVE-2011-3552)

It was discovered that Java API for XML Web Services (JAX-WS) could incorrectly expose a stack trace. A remote attacker could potentially use this to gain access to sensitive information. (CVE-2011-3553)

It was discovered that the unpacker for pack200 JAR files did not sufficiently check for errors. An attacker could cause a denial of service or possibly execute arbitrary code through a specially crafted pack200 JAR file.
(CVE-2011-3554)

It was discovered that the RMI registration implementation did not properly restrict privileges of remotely executed code. A remote attacker could use this to execute code with elevated privileges. (CVE-2011-3556, CVE-2011-3557)

It was discovered that the HotSpot VM could be made to crash, allowing an attacker to cause a denial of service or possibly leak sensitive information. (CVE-2011-3558)

It was discovered that the HttpsURLConnection class did not properly perform SecurityManager checks in certain situations. This could allow a remote attacker to bypass restrictions on HTTPS connections. (CVE-2011-3560).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Deepak Bhole discovered a flaw in the Same Origin Policy (SOP) implementation in the IcedTea web browser plugin. This could allow a remote attacker to open connections to certain hosts that should not be permitted. (CVE-2011-3377)

Juliano Rizzo and Thai Duong discovered that the block-wise AES encryption algorithm block-wise as used in TLS/SSL was vulnerable to a chosen-plaintext attack. This could allow a remote attacker to view confidential data. (CVE-2011-3389)

It was discovered that a type confusion flaw existed in the in the Internet Inter-Orb Protocol (IIOP) deserialization code. A remote attacker could use this to cause an untrusted application or applet to execute arbitrary code by deserializing malicious input.
(CVE-2011-3521)

It was discovered that the Java scripting engine did not perform SecurityManager checks. This could allow a remote attacker to cause an untrusted application or applet to execute arbitrary code with the full privileges of the JVM. (CVE-2011-3544)

It was discovered that the InputStream class used a global buffer to store input bytes skipped. An attacker could possibly use this to gain access to sensitive information. (CVE-2011-3547)

It was discovered that a vulnerability existed in the AWTKeyStroke class. A remote attacker could cause an untrusted application or applet to execute arbitrary code. (CVE-2011-3548)

It was discovered that an integer overflow vulnerability existed in the TransformHelper class in the Java2D implementation. A remote attacker could use this cause a denial of service via an application or applet crash or possibly execute arbitrary code. (CVE-2011-3551)

It was discovered that the default number of available UDP sockets for applications running under SecurityManager restrictions was set too high. A remote attacker could use this with a malicious application or applet exhaust the number of available UDP sockets to cause a denial of service for other applets or applications running within the same JVM. (CVE-2011-3552)

It was discovered that Java API for XML Web Services (JAX-WS) could incorrectly expose a stack trace. A remote attacker could potentially use this to gain access to sensitive information. (CVE-2011-3553)

It was discovered that the unpacker for pack200 JAR files did not sufficiently check for errors. An attacker could cause a denial of service or possibly execute arbitrary code through a specially crafted pack200 JAR file. (CVE-2011-3554)

It was discovered that the RMI registration implementation did not properly restrict privileges of remotely executed code. A remote attacker could use this to execute code with elevated privileges.
(CVE-2011-3556, CVE-2011-3557)

It was discovered that the HotSpot VM could be made to crash, allowing an attacker to cause a denial of service or possibly leak sensitive information. (CVE-2011-3558)

It was discovered that the HttpsURLConnection class did not properly perform SecurityManager checks in certain situations. This could allow a remote attacker to bypass restrictions on HTTPS connections.
(CVE-2011-3560).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security issues were identified and fixed in openjdk (icedtea6) and icedtea-web :

IcedTea6 prior to 1.10.4 allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality via unknown vectors related to Networking (CVE-2011-3547).

IcedTea6 prior to 1.10.4 allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability, related to AWT (CVE-2011-3548).

IcedTea6 prior to 1.10.4 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D (CVE-2011-3551).

IcedTea6 prior to 1.10.4 allows remote attackers to affect integrity via unknown vectors related to Networking (CVE-2011-3552).

IcedTea6 prior to 1.10.4 allows remote authenticated users to affect confidentiality, related to JAXWS (CVE-2011-3553).

IcedTea6 prior to 1.10.4 allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Scripting (CVE-2011-3544).

IcedTea6 prior to 1.10.4 allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Deserialization (CVE-2011-3521).

IcedTea6 prior to 1.10.4 allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors (CVE-2011-3554).

A flaw was found in the way the SSL 3 and TLS 1.0 protocols used block ciphers in cipher-block chaining (CBC) mode. An attacker able to perform a chosen plain text attack against a connection mixing trusted and untrusted data could use this flaw to recover portions of the trusted data sent over the connection (CVE-2011-3389).

Note: This update mitigates the CVE-2011-3389 issue by splitting the first application data record byte to a separate SSL/TLS protocol record. This mitigation may cause compatibility issues with some SSL/TLS implementations and can be disabled using the jsse.enableCBCProtection boolean property. This can be done on the command line by appending the flag -Djsse.enableCBCProtection=false to the java command.

IcedTea6 prior to 1.10.4 allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality via unknown vectors related to HotSpot (CVE-2011-3558).

IcedTea6 prior to 1.10.4 allows remote attackers to affect confidentiality, integrity, and availability, related to RMI (CVE-2011-3556).

IcedTea6 prior to 1.10.4 allows remote attackers to affect confidentiality, integrity, and availability, related to RMI (CVE-2011-3557).

IcedTea6 prior to 1.10.4 allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality and integrity, related to JSSE (CVE-2011-3560).

Deepak Bhole discovered a flaw in the Same Origin Policy (SOP) implementation in the IcedTea project Web browser plugin. A malicious applet could use this flaw to bypass SOP protection and open connections to any sub-domain of the second-level domain of the applet's origin, as well as any sub-domain of the domain that is the suffix of the origin second-level domain. For example, IcedTea-Web plugin allowed applet from some.host.example.com to connect to other.host.example.com, www.example.com, and example.com, as well as www.ample.com or ample.com. (CVE-2011-3377).

Updated icedtea-web packages that fix one security issue are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The IcedTea-Web project provides a Java web browser plug-in and an implementation of Java Web Start, which is based on the Netx project.
It also contains a configuration tool for managing deployment settings for the plug-in and Web Start implementations.

A flaw was found in the same-origin policy implementation in the IcedTea-Web browser plug-in. A malicious Java applet could use this flaw to open network connections to hosts other than the originating host, violating the same-origin policy. (CVE-2011-3377)

All IcedTea-Web users should upgrade to these updated packages, which upgrade IcedTea-Web to version 1.0.6 to correct this issue. Web browsers using the IcedTea-Web browser plug-in must be restarted for this update to take effect.

ID	Name	Product	Family	Severity
75865	openSUSE Security Update : icedtea-web (openSUSE-SU-2011:1251-1)	Nessus	SuSE Local Security Checks	medium
75529	openSUSE Security Update : icedtea-web (openSUSE-SU-2011:1251-1)	Nessus	SuSE Local Security Checks	medium
74568	openSUSE Security Update : icedtea-web (openSUSE-SU-2012:0371-1)	Nessus	SuSE Local Security Checks	medium
68388	Oracle Linux 6 : icedtea-web (ELSA-2011-1441)	Nessus	Oracle Linux Local Security Checks	critical
61171	Scientific Linux Security Update : icedtea-web on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
58148	Debian DSA-2420-1 : openjdk-6 - several vulnerabilities	Nessus	Debian Local Security Checks	critical
57685	Ubuntu 10.04 LTS / 10.10 / 11.04 / 11.10 : openjdk-6, openjdk-6b18 regression (USN-1263-2) (BEAST)	Nessus	Ubuntu Local Security Checks	critical
56860	Ubuntu 10.04 LTS / 10.10 / 11.04 / 11.10 : icedtea-web, openjdk-6, openjdk-6b18 vulnerabilities (USN-1263-1) (BEAST)	Nessus	Ubuntu Local Security Checks	critical
56809	Mandriva Linux Security Advisory : java-1.6.0-openjdk (MDVSA-2011:170)	Nessus	Mandriva Local Security Checks	critical
56745	RHEL 6 : icedtea-web (RHSA-2011:1441)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2011-3377

critical

Tenable Plugins

medium

medium

medium

critical

medium

critical

critical

critical

critical

medium