Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

Updated java-1.6.0-ibm packages that fix several security issues are now available for Red Hat Network Satellite Server 5.4.

The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

This update corrects several security vulnerabilities in the IBM Java Runtime Environment shipped as part of Red Hat Network Satellite Server 5.4. In a typical operating environment, these are of low security risk as the runtime is not used on untrusted applets.

Several flaws were fixed in the IBM Java 2 Runtime Environment.
(CVE-2011-0802, CVE-2011-0814, CVE-2011-0862, CVE-2011-0863, CVE-2011-0865, CVE-2011-0867, CVE-2011-0868, CVE-2011-0869, CVE-2011-0871, CVE-2011-0873, CVE-2011-3389, CVE-2011-3516, CVE-2011-3521, CVE-2011-3544, CVE-2011-3545, CVE-2011-3546, CVE-2011-3547, CVE-2011-3548, CVE-2011-3549, CVE-2011-3550, CVE-2011-3551, CVE-2011-3552, CVE-2011-3553, CVE-2011-3554, CVE-2011-3556, CVE-2011-3557, CVE-2011-3560, CVE-2011-3561, CVE-2011-3563, CVE-2011-5035, CVE-2012-0497, CVE-2012-0498, CVE-2012-0499, CVE-2012-0500, CVE-2012-0501, CVE-2012-0502, CVE-2012-0503, CVE-2012-0505, CVE-2012-0506, CVE-2012-0507, CVE-2012-0547, CVE-2012-0551, CVE-2012-1531, CVE-2012-1532, CVE-2012-1533, CVE-2012-1541, CVE-2012-1682, CVE-2012-1713, CVE-2012-1716, CVE-2012-1717, CVE-2012-1718, CVE-2012-1719, CVE-2012-1721, CVE-2012-1722, CVE-2012-1725, CVE-2012-3143, CVE-2012-3159, CVE-2012-3213, CVE-2012-3216, CVE-2012-3342, CVE-2012-4820, CVE-2012-4822, CVE-2012-4823, CVE-2012-5068, CVE-2012-5069, CVE-2012-5071, CVE-2012-5072, CVE-2012-5073, CVE-2012-5075, CVE-2012-5079, CVE-2012-5081, CVE-2012-5083, CVE-2012-5084, CVE-2012-5089, CVE-2013-0169, CVE-2013-0351, CVE-2013-0401, CVE-2013-0409, CVE-2013-0419, CVE-2013-0423, CVE-2013-0424, CVE-2013-0425, CVE-2013-0426, CVE-2013-0427, CVE-2013-0428, CVE-2013-0432, CVE-2013-0433, CVE-2013-0434, CVE-2013-0435, CVE-2013-0438, CVE-2013-0440, CVE-2013-0441, CVE-2013-0442, CVE-2013-0443, CVE-2013-0445, CVE-2013-0446, CVE-2013-0450, CVE-2013-0809, CVE-2013-1473, CVE-2013-1476, CVE-2013-1478, CVE-2013-1480, CVE-2013-1481, CVE-2013-1486, CVE-2013-1487, CVE-2013-1491, CVE-2013-1493, CVE-2013-1500, CVE-2013-1537, CVE-2013-1540, CVE-2013-1557, CVE-2013-1563, CVE-2013-1569, CVE-2013-1571, CVE-2013-2383, CVE-2013-2384, CVE-2013-2394, CVE-2013-2407, CVE-2013-2412, CVE-2013-2417, CVE-2013-2418, CVE-2013-2419, CVE-2013-2420, CVE-2013-2422, CVE-2013-2424, CVE-2013-2429, CVE-2013-2430, CVE-2013-2432, CVE-2013-2433, CVE-2013-2435, CVE-2013-2437, CVE-2013-2440, CVE-2013-2442, CVE-2013-2443, CVE-2013-2444, CVE-2013-2446, CVE-2013-2447, CVE-2013-2448, CVE-2013-2450, CVE-2013-2451, CVE-2013-2452, CVE-2013-2453, CVE-2013-2454, CVE-2013-2455, CVE-2013-2456, CVE-2013-2457, CVE-2013-2459, CVE-2013-2463, CVE-2013-2464, CVE-2013-2465, CVE-2013-2466, CVE-2013-2468, CVE-2013-2469, CVE-2013-2470, CVE-2013-2471, CVE-2013-2472, CVE-2013-2473, CVE-2013-3743)

Users of Red Hat Network Satellite Server 5.4 are advised to upgrade to these updated packages, which contain the IBM Java SE 6 SR14 release. For this update to take effect, Red Hat Network Satellite Server must be restarted ('/usr/sbin/rhn-satellite restart'), as well as all running instances of IBM Java.

The remote host has a version of Oracle JRockit that is affected by multiple vulnerabilities that could allow a remote attacker to compromise system confidentiality and integrity via unspecified vectors.

The remote host is affected by the vulnerability described in GLSA-201401-30 (Oracle JRE/JDK: Multiple vulnerabilities)

    Multiple vulnerabilities have been reported in the Oracle Java       implementation. Please review the CVE identifiers referenced below for       details.
  Impact :

    An unauthenticated, remote attacker could exploit these vulnerabilities       to execute arbitrary code.
      Furthermore, a local or remote attacker could exploit these       vulnerabilities to cause unspecified impact, possibly including remote       execution of arbitrary code.
  Workaround :

    There is no known workaround at this time.

The version of VMware vCenter installed on the remote host is 4.0 earlier than Update 4a, 4.1 earlier than Update 3, or 5.0 earlier than Update 2.  As such, it is potentially affected by multiple vulnerabilities in the included Oracle (Sun) Java Runtime Environment.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is earlier than 7 Update 3 / 6 Update 31 / 5.0 Update 34 / 1.4.2_36 and is, therefore, potentially affected by security issues in the following components :

  - 2D
  - AWT
  - CORBA
  - Concurrency
  - Deployment
  - I18n
  - Install
  - Java Runtime Environment
  - Lightweight HTTP Server
  - Serialization
  - Sound

IBM Java 1.6.0 was updated to SR10-FP1, fixing various security issues.

More information can be found on :

http://www.ibm.com/developerworks/java/jdk/alerts/

This update fixes several vulnerabilities in the Sun Java 6 Runtime Environment and the Sun Java 6 Software Development Kit. Further information about these flaws can be found on the Oracle Java SE Critical Patch page. (CVE-2011-3563, CVE-2011-3571, CVE-2011-5035, CVE-2012-0498, CVE-2012-0499, CVE-2012-0500, CVE-2012-0501, CVE-2012-0502, CVE-2012-0503, CVE-2012-0505, CVE-2012-0506)

All users of java-1.6.0-sun are advised to upgrade to these updated packages, which provide JDK and JRE 6 Update 31 and resolve these issues. All running instances of Sun Java must be restarted for the update to take effect.

IBM Java 1.6.0 has been updated to SR10-FP1, fixing various security issues.

More information can be found on :

http://www.ibm.com/developerworks/java/jdk/alerts/

IBM Java 1.5.0 has been updated to SR13-FP1, fixing various security issues.

More information can be found on :

http://www.ibm.com/developerworks/java/jdk/alerts/

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:0514 advisory.

  - OpenJDK: JavaSound incorrect bounds check (Sound, 7088367) (CVE-2011-3563)

  - GlassFish: hash table collisions CPU usage DoS (oCERT-2011-003) (CVE-2011-5035)

  - OpenJDK: insufficient checking of the graphics rendering object (2D, 7112642) (CVE-2012-0497)

  - Oracle JDK: unspecified vulnerability fixed in 6u31 and 7u3 (2D) (CVE-2012-0498, CVE-2012-0499)

  - Oracle JDK: unspecified vulnerability fixed in 6u31 and 7u3 (Deployment) (CVE-2012-0500)

  - OpenJDK: off-by-one bug in ZIP reading code (JRE, 7118283) (CVE-2012-0501)

  - OpenJDK: KeyboardFocusManager focus stealing (AWT, 7110683) (CVE-2012-0502)

  - OpenJDK: unrestricted use of TimeZone.setDefault() (i18n, 7110687) (CVE-2012-0503)

  - OpenJDK: incomplete info in the deserialization exception (Serialization, 7110700) (CVE-2012-0505)

  - OpenJDK: mutable repository identifiers (CORBA, 7110704) (CVE-2012-0506)

  - OpenJDK: AtomicReferenceArray insufficient array type check (Concurrency, 7082299) (CVE-2012-0507)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:0508 advisory.

  - HTTPS: block-wise chosen-plaintext attack against SSL/TLS (BEAST) (CVE-2011-3389)

  - OpenJDK: RMI registry privileged code execution (RMI, 7083012) (CVE-2011-3557)

  - OpenJDK: missing checkSetFactory calls in HttpsURLConnection (JSSE, 7096936) (CVE-2011-3560)

  - OpenJDK: JavaSound incorrect bounds check (Sound, 7088367) (CVE-2011-3563)

  - Oracle JDK: unspecified vulnerability fixed in 6u31 and 7u3 (2D) (CVE-2012-0498, CVE-2012-0499)

  - OpenJDK: off-by-one bug in ZIP reading code (JRE, 7118283) (CVE-2012-0501)

  - OpenJDK: KeyboardFocusManager focus stealing (AWT, 7110683) (CVE-2012-0502)

  - OpenJDK: unrestricted use of TimeZone.setDefault() (i18n, 7110687) (CVE-2012-0503)

  - OpenJDK: incomplete info in the deserialization exception (Serialization, 7110700) (CVE-2012-0505)

  - OpenJDK: mutable repository identifiers (CORBA, 7110704) (CVE-2012-0506)

  - OpenJDK: AtomicReferenceArray insufficient array type check (Concurrency, 7082299) (CVE-2012-0507)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Mac OS X host is running a version of Java for Mac OS X 10.7 that is missing update 2012-001, which updates the Java version to 1.6.0_31.  As such, it is affected by several security vulnerabilities, the most serious of which may allow an untrusted Java applet to execute arbitrary code with the privileges of the current user outside the Java sandbox.

The remote Mac OS X host is running a version of Java for Mac OS X 10.6 that is missing Update 7, which updates the Java version to 1.6.0_31.  As such, it is affected by several security vulnerabilities, the most serious of which may allow an untrusted Java applet to execute arbitrary code with the privileges of the current user outside the Java sandbox.

Multiple security issues were identified and fixed in OpenJDK (icedtea6) :

Fix issues in java sound (CVE-2011-3563).

Fix in AtomicReferenceArray (CVE-2011-3571).

Add property to limit number of request headers to the HTTP Server (CVE-2011-5035).

Incorect checking for graphics rendering object (CVE-2012-0497).

Multiple unspecified vulnerabilities allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors (CVE-2012-0498. CVE-2012-0499, CVE-2012-0500).

Better input parameter checking in zip file processing (CVE-2012-0501).

Issues with some KeyboardFocusManager method (CVE-2012-0502).

Issues with TimeZone class (CVE-2012-0503).

Enhance exception throwing mechanism in ObjectStreamClass (CVE-2012-0505).

Issues with some method in corba (CVE-2012-0506).

The updated packages provides icedtea6-1.10.6 which is not vulnerable to these issues.

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:0139 advisory.

  - OpenJDK: JavaSound incorrect bounds check (Sound, 7088367) (CVE-2011-3563)

  - OpenJDK: AtomicReferenceArray insufficient array type check (Concurrency, 7082299) (CVE-2011-3571,     CVE-2012-0507)

  - GlassFish: hash table collisions CPU usage DoS (oCERT-2011-003) (CVE-2011-5035)

  - Oracle JDK: unspecified vulnerability fixed in 6u31 and 7u3 (2D) (CVE-2012-0498, CVE-2012-0499)

  - Oracle JDK: unspecified vulnerability fixed in 6u31 and 7u3 (Deployment) (CVE-2012-0500)

  - OpenJDK: off-by-one bug in ZIP reading code (JRE, 7118283) (CVE-2012-0501)

  - OpenJDK: KeyboardFocusManager focus stealing (AWT, 7110683) (CVE-2012-0502)

  - OpenJDK: unrestricted use of TimeZone.setDefault() (i18n, 7110687) (CVE-2012-0503)

  - OpenJDK: incomplete info in the deserialization exception (Serialization, 7110700) (CVE-2012-0505)

  - OpenJDK: mutable repository identifiers (CORBA, 7110704) (CVE-2012-0506)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
78975	RHEL 5 / 6 : IBM Java Runtime in Satellite Server (RHSA-2013:1455) (BEAST) (ROBOT)	Nessus	Red Hat Local Security Checks	critical
76683	Oracle JRockit R27 < R27.7.2.5 / R28 < R28.2.3.13 Multiple Vulnerabilities (April 2012 CPU)	Nessus	Windows	critical
72139	GLSA-201401-30 : Oracle JRE/JDK: Multiple vulnerabilities (ROBOT)	Nessus	Gentoo Local Security Checks	critical
66806	VMware vCenter Multiple Vulnerabilities (VMSA-2012-0013)	Nessus	Misc.	critical
64847	Oracle Java SE Multiple Vulnerabilities (February 2012 CPU) (Unix)	Nessus	Misc.	critical
64164	SuSE 11.1 Security Update : IBM Java 1.6.0 (SAT Patch Number 6225)	Nessus	SuSE Local Security Checks	critical
61252	Scientific Linux Security Update : java-1.6.0-sun on SL4.x, SL5.x i386/x86_64 (20120216)	Nessus	Scientific Linux Local Security Checks	critical
59065	SuSE 10 Security Update : IBM Java 1.6.0 (ZYPP Patch Number 8094)	Nessus	SuSE Local Security Checks	critical
59064	SuSE 10 Security Update : IBM Java 1.6.0 (ZYPP Patch Number 8100)	Nessus	SuSE Local Security Checks	critical
58866	RHEL 5 / 6 : java-1.6.0-ibm (RHSA-2012:0514)	Nessus	Red Hat Local Security Checks	critical
58840	RHEL 5 / 6 : java-1.5.0-ibm (RHSA-2012:0508)	Nessus	Red Hat Local Security Checks	high
58606	Mac OS X : Java for OS X Lion 2012-001	Nessus	MacOS X Local Security Checks	critical
58605	Mac OS X : Java for Mac OS X 10.6 Update 7	Nessus	MacOS X Local Security Checks	critical
58026	Mandriva Linux Security Advisory : java-1.6.0-openjdk (MDVSA-2012:021)	Nessus	Mandriva Local Security Checks	critical
57991	RHEL 5 / 6 : java-1.6.0-sun (RHSA-2012:0139)	Nessus	Red Hat Local Security Checks	critical
57959	Oracle Java SE Multiple Vulnerabilities (February 2012 CPU)	Nessus	Windows	critical

Detections

Analytics

CVE-2012-0498

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

critical

critical

critical

critical

critical