Multiple unspecified vulnerabilities in the JRE component in IBM Java 7 SR2 and earlier, Java 6.0.1 SR3 and earlier, Java 6 SR11 and earlier, Java 5 SR14 and earlier, and Java 142 SR13 FP13 and earlier; as used in IBM Rational Host On-Demand, Rational Change, Tivoli Monitoring, Smart Analytics System 5600, Tivoli Remote Control 5.1.2, WebSphere Real Time, Lotus Notes & Domino, Tivoli Storage Productivity Center, and Service Deliver Manager; and other products from other vendors such as Red Hat, allow remote attackers to execute arbitrary code via "insecure use" of the (1) java.lang.Class getDeclaredMethods or nd (2) java.lang.reflect.AccessibleObject setAccessible() methods.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Multiple unspecified vulnerabilities in the JRE component in IBM Java 7 SR2 and earlier, Java 6.0.1 SR3     and earlier, Java 6 SR11 and earlier, Java 5 SR14 and earlier, and Java 142 SR13 FP13 and earlier; as used     in IBM Rational Host On-Demand, Rational Change, Tivoli Monitoring, Smart Analytics System 5600, Tivoli     Remote Control 5.1.2, WebSphere Real Time, Lotus Notes & Domino, Tivoli Storage Productivity Center, and     Service Deliver Manager; and other products from other vendors such as Red Hat, allow remote attackers to     execute arbitrary code via insecure use of the (1) java.lang.Class getDeclaredMethods or nd (2)     java.lang.reflect.AccessibleObject setAccessible() methods. (CVE-2012-4821)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote host has a version of Lotus Notes 8.5.1, 8.5.2, or 8.5.3.x prior to 8.5.3 Fix Pack 3 installed.  It is, therefore, reportedly affected by the following vulnerabilities :

  - The included version of the IBM Java SDK contains a     version of the IBM JRE that contains several errors     that allow Java code execution outside the Java     sandbox. (CVE-2012-4820, CVE-2012-4821, CVE-2012-4822,     CVE-2012-4823)

  - Information disclosure is possible because the     application does not set the 'HttpOnly' flag in the     'Set-Cookie' HTTP header. This can allow client-side     scripts to read or modify HTTP cookie information.
    (CVE-2012-4846)

Note that applying the Java patch (Reference #1616652) alone does not correct the 'HttpOnly' information disclosure vulnerability.

Further note that in the case of version 8.5.3 Fix Pack 2, if the Java patch (Reference #1616652) and the interim fix (853FP2IF3) have been applied, this may be a false positive.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:1467 advisory.

    IBM Java SE version 7 includes the IBM Java Runtime Environment and the IBM     Java Software Development Kit.

    This update fixes several vulnerabilities in the IBM Java Runtime     Environment and the IBM Java Software Development Kit. Detailed     vulnerability descriptions are linked from the IBM Security alerts page,     listed in the References section. (CVE-2012-1531, CVE-2012-1532,     CVE-2012-1533, CVE-2012-1718, CVE-2012-3143, CVE-2012-3159, CVE-2012-3216,     CVE-2012-4820, CVE-2012-4821, CVE-2012-4822, CVE-2012-4823, CVE-2012-5067,     CVE-2012-5069, CVE-2012-5070, CVE-2012-5071, CVE-2012-5072, CVE-2012-5073,     CVE-2012-5074, CVE-2012-5075, CVE-2012-5076, CVE-2012-5077, CVE-2012-5079,     CVE-2012-5081, CVE-2012-5083, CVE-2012-5084, CVE-2012-5086, CVE-2012-5087,     CVE-2012-5088, CVE-2012-5089)

    All users of java-1.7.0-ibm are advised to upgrade to these updated     packages, containing the IBM Java SE 7 SR3 release. All running instances     of IBM Java must be restarted for the update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
217713	Linux Distros Unpatched Vulnerability : CVE-2012-4821	Nessus	Misc.	critical
63281	IBM Lotus Notes 8.5.1 / 8.5.2 / 8.5.3 < 8.5.3 FP3 Multiple Vulnerabilities	Nessus	Windows	high
62932	RHEL 6 : java-1.7.0-ibm (RHSA-2012:1467)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2012-4821

critical

Tenable Plugins

critical

high

critical