Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, related to JMX.

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several components and third-party libraries :

  - Java Runtime Environment (JRE)
  - Network File Copy (NFC) Protocol
  - OpenSSL

IBM Java 1.7.0 has been updated to SR3 which fixes bugs and security issues.

More information can be found on :

http://www.ibm.com/developerworks/java/jdk/alerts/

CVEs fixed: CVE-2012-3159, CVE-2012-3216, CVE-2012-5070, CVE-2012-5067, CVE-2012-3143, CVE-2012-5076, CVE-2012-5077, CVE-2012-5073, CVE-2012-5074, CVE-2012-5075, CVE-2012-5083, CVE-2012-5083, CVE-2012-5072, CVE-2012-1531, CVE-2012-5081, CVE-2012-1532, CVE-2012-1533, CVE-2012-5069, CVE-2012-5071, CVE-2012-5084, CVE-2012-5087, CVE-2012-5086, CVE-2012-5079, CVE-2012-5088, CVE-2012-5089

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201406-32 (IcedTea JDK: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in the IcedTea JDK. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, obtain       sensitive information, bypass intended security policies, or have other       unspecified impact.
  Workaround :

    There is no known workaround at this time.

java-1_7_0-opendjk was updated to icedtea-2.3.3 (bnc#785814)

  - Security fixes

  - S6631398, CVE-2012-3216: FilePermission improved path     checking

  - S7093490: adjust package access in rmiregistry

  - S7143535, CVE-2012-5068: ScriptEngine corrected     permissions

  - S7158796, CVE-2012-5070: Tighten properties checking in     EnvHelp

  - S7158807: Revise stack management with volatile call     sites

  - S7163198, CVE-2012-5076: Tightened package accessibility

  - S7167656, CVE-2012-5077: Multiple Seeders are being     created

  - S7169884, CVE-2012-5073: LogManager checks do not work     correctly for sub-types

  - S7169887, CVE-2012-5074: Tightened package accessibility

  - S7169888, CVE-2012-5075: Narrowing resource definitions     in JMX RMI connector

  - S7172522, CVE-2012-5072: Improve DomainCombiner checking

  - S7186286, CVE-2012-5081: TLS implementation to better     adhere to RFC

  - S7189103, CVE-2012-5069: Executors needs to maintain     state

  - S7189490: More improvements to DomainCombiner checking

  - S7189567, CVE-2012-5085: java net obselete protocol

  - S7192975, CVE-2012-5071: Issue with JMX reflection

  - S7195194, CVE-2012-5084: Better data validation for     Swing

  - S7195549, CVE-2012-5087: Better bean object persistence

  - S7195917, CVE-2012-5086: XMLDecoder parsing at     close-time should be improved

  - S7195919, CVE-2012-5079: (sl) ServiceLoader can throw     CCE without needing to create instance

  - S7196190, CVE-2012-5088: Improve method of handling     MethodHandles

  - S7198296, CVE-2012-5089: Refactor classloader usage

  - S7158800: Improve storage of symbol tables

  - S7158801: Improve VM CompileOnly option

  - S7158804: Improve config file parsing

  - S7198606, CVE-2012-4416: Improve VM optimization

  - Bug fixes

  - Remove merge artefact.

The remote host is affected by the vulnerability described in GLSA-201401-30 (Oracle JRE/JDK: Multiple vulnerabilities)

    Multiple vulnerabilities have been reported in the Oracle Java       implementation. Please review the CVE identifiers referenced below for       details.
  Impact :

    An unauthenticated, remote attacker could exploit these vulnerabilities       to execute arbitrary code.
      Furthermore, a local or remote attacker could exploit these       vulnerabilities to cause unspecified impact, possibly including remote       execution of arbitrary code.
  Workaround :

    There is no known workaround at this time.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-1386 advisory.

    [1.7.0.9-2.3.3.0.1.el6_3.1]
    - Update DISTRO_NAME in specfile

    [1.7.0.9-2.3.3.el6.1]
    - Changed permissions of sa-jdi.jar to correct 644
    - Resolves: rhbz#865050

    [1.7.0.9-2.3.3.el6]
    - Updated to 2.3.3
    - Updated java-1.7.0-openjdk-java-access-bridge-security.patch
    - Resolves rhbz#s 856124, 865346, 865348, 865350, 865352, 865354, 865357,       865359, 865363, 865365, 865370, 865428, 865471, 865434, 865511, 865514,       865519, 865531, 865541, 865568

    [1.7.0.5-2.3.2.el6.1]
    - Cleanup before security release
    - Updated to latest IcedTea7-forest 2.3
    - Resolves: rhbz#852299

    [1.7.0.5-2.2.1.1.el6.4]
    - Cleanup before security release
    - Removed patches:
       patch 1001 sec-webrevs-openjdk7-29_aug_2012-7162473.patch        patch 1002 sec-webrevs-openjdk7-29_aug_2012-7162476.patch        patch 1003 sec-webrevs-openjdk7-29_aug_2012-7163201.patch        patch 1004 sec-webrevs-openjdk7-29_aug_2012-7194567.patch        patch 1005 sec-webrevs-openjdk7-29_aug_2012-78e01a6ca8d3.patch
    - Resolves: rhbz#852299

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is earlier than 7 Update 9 / 6 Update 37 / 5.0 Update 38 / 1.4.2_40 and is, therefore, potentially affected by security issues in the following components :

  - 2D
  - Beans
  - Concurrency
  - Deployment
  - Hotspot
  - JAX-WS
  - JMX
  - JSSE
  - Libraries
  - Networking
  - Security
  - Swing

IBM Java 1.7.0 has been updated to SR3 which fixes bugs and security issues.

More information can be found on :

http://www.ibm.com/developerworks/java/jdk/alerts/

CVEs fixed: CVE-2012-3159 / CVE-2012-3216 / CVE-2012-5070 / CVE-2012-5067 / CVE-2012-3143 / CVE-2012-5076 / CVE-2012-5077 / CVE-2012-5073 / CVE-2012-5074 / CVE-2012-5075 / CVE-2012-5083 / CVE-2012-5083 / CVE-2012-5072 / CVE-2012-1531 / CVE-2012-5081 / CVE-2012-1532 / CVE-2012-1533 / CVE-2012-5069 / CVE-2012-5071 / CVE-2012-5084 / CVE-2012-5087 / CVE-2012-5086 / CVE-2012-5079 / CVE-2012-5088 / CVE-2012-5089

java-openjdk was upgraded to version 1.11.5 to fix various security and non-security issues.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:1467 advisory.

    IBM Java SE version 7 includes the IBM Java Runtime Environment and the IBM     Java Software Development Kit.

    This update fixes several vulnerabilities in the IBM Java Runtime     Environment and the IBM Java Software Development Kit. Detailed     vulnerability descriptions are linked from the IBM Security alerts page,     listed in the References section. (CVE-2012-1531, CVE-2012-1532,     CVE-2012-1533, CVE-2012-1718, CVE-2012-3143, CVE-2012-3159, CVE-2012-3216,     CVE-2012-4820, CVE-2012-4821, CVE-2012-4822, CVE-2012-4823, CVE-2012-5067,     CVE-2012-5069, CVE-2012-5070, CVE-2012-5071, CVE-2012-5072, CVE-2012-5073,     CVE-2012-5074, CVE-2012-5075, CVE-2012-5076, CVE-2012-5077, CVE-2012-5079,     CVE-2012-5081, CVE-2012-5083, CVE-2012-5084, CVE-2012-5086, CVE-2012-5087,     CVE-2012-5088, CVE-2012-5089)

    All users of java-1.7.0-ibm are advised to upgrade to these updated     packages, containing the IBM Java SE 7 SR3 release. All running instances     of IBM Java must be restarted for the update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several information disclosure vulnerabilities were discovered in the OpenJDK JRE. (CVE-2012-3216, CVE-2012-5069, CVE-2012-5072, CVE-2012-5075, CVE-2012-5077, CVE-2012-5085)

Vulnerabilities were discovered in the OpenJDK JRE related to information disclosure and data integrity. (CVE-2012-4416, CVE-2012-5071)

Several vulnerabilities were discovered in the OpenJDK JRE related to information disclosure and data integrity. An attacker could exploit these to cause a denial of service. (CVE-2012-1531, CVE-2012-1532, CVE-2012-1533, CVE-2012-3143, CVE-2012-3159, CVE-2012-5068, CVE-2012-5083, CVE-2012-5084, CVE-2012-5086, CVE-2012-5089)

Information disclosure vulnerabilities were discovered in the OpenJDK JRE. These issues only affected Ubuntu 12.10. (CVE-2012-5067, CVE-2012-5070)

Vulnerabilities were discovered in the OpenJDK JRE related to data integrity. (CVE-2012-5073, CVE-2012-5079)

A vulnerability was discovered in the OpenJDK JRE related to information disclosure and data integrity. This issue only affected Ubuntu 12.10. (CVE-2012-5074)

Several vulnerabilities were discovered in the OpenJDK JRE related to information disclosure and data integrity. An attacker could exploit these to cause a denial of service. These issues only affected Ubuntu 12.10. (CVE-2012-5076, CVE-2012-5087, CVE-2012-5088)

A denial of service vulnerability was found in OpenJDK.
(CVE-2012-5081)

Please see the following for more information:
http://www.oracle.com/technetwork/topics/security/javacpuoct2012-15159 24.html.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple improper permission check issues were discovered in the Beans, Libraries, Swing, and JMX components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. (CVE-2012-5086, CVE-2012-5087, CVE-2012-5088, CVE-2012-5084, CVE-2012-5089)

The default Java security properties configuration did not restrict access to certain com.sun.org.glassfish packages. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. This update lists those packages as restricted.
(CVE-2012-5076, CVE-2012-5074)

Multiple improper permission check issues were discovered in the Scripting, JMX, Concurrency, Libraries, and Security components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2012-5068, CVE-2012-5071, CVE-2012-5069, CVE-2012-5073, CVE-2012-5072)

It was discovered that java.util.ServiceLoader could create an instance of an incompatible class while performing provider lookup. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. (CVE-2012-5079)

It was discovered that the Java Secure Socket Extension (JSSE) SSL/TLS implementation did not properly handle handshake records containing an overly large data length value. An unauthenticated, remote attacker could possibly use this flaw to cause an SSL/TLS server to terminate with an exception. (CVE-2012-5081)

It was discovered that the JMX component in OpenJDK could perform certain actions in an insecure manner. An untrusted Java application or applet could possibly use these flaws to disclose sensitive information. (CVE-2012-5070, CVE-2012-5075)

A bug in the Java HotSpot Virtual Machine optimization code could cause it to not perform array initialization in certain cases. An untrusted Java application or applet could use this flaw to disclose portions of the virtual machine's memory. (CVE-2012-4416)

It was discovered that the SecureRandom class did not properly protect against the creation of multiple seeders. An untrusted Java application or applet could possibly use this flaw to disclose sensitive information. (CVE-2012-5077)

It was discovered that the java.io.FilePermission class exposed the hash code of the canonicalized path name. An untrusted Java application or applet could possibly use this flaw to determine certain system paths, such as the current working directory.
(CVE-2012-3216)

This update disables Gopher protocol support in the java.net package by default. Gopher support can be enabled by setting the newly introduced property, 'jdk.net.registerGopherProtocol', to true.
(CVE-2012-5085)

This erratum also upgrades the OpenJDK package to IcedTea7 2.3.3.

All running instances of OpenJDK Java must be restarted for the update to take effect.

Updated java-1.7.0-oracle packages that fix several security issues are now available for Red Hat Enterprise Linux 6 Supplementary.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Oracle Java SE version 7 includes the Oracle Java Runtime Environment and the Oracle Java Software Development Kit.

This update fixes several vulnerabilities in the Oracle Java Runtime Environment and the Oracle Java Software Development Kit. Further information about these flaws can be found on the Oracle Java SE Critical Patch Update Advisory page, listed in the References section.
(CVE-2012-1531, CVE-2012-1532, CVE-2012-1533, CVE-2012-3143, CVE-2012-3159, CVE-2012-3216, CVE-2012-4416, CVE-2012-5067, CVE-2012-5068, CVE-2012-5069, CVE-2012-5070, CVE-2012-5071, CVE-2012-5072, CVE-2012-5073, CVE-2012-5074, CVE-2012-5075, CVE-2012-5076, CVE-2012-5077, CVE-2012-5079, CVE-2012-5081, CVE-2012-5083, CVE-2012-5084, CVE-2012-5085, CVE-2012-5086, CVE-2012-5087, CVE-2012-5088, CVE-2012-5089)

All users of java-1.7.0-oracle are advised to upgrade to these updated packages, which provide Oracle Java 7 Update 9. All running instances of Oracle Java must be restarted for the update to take effect.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:1386 advisory.

  - OpenJDK: java.io.FilePermission information leak (Libraries, 6631398) (CVE-2012-3216)

  - OpenJDK: uninitialized Array JVM memory disclosure (Hotspot, 7198606) (CVE-2012-4416)

  - OpenJDK: RhinoScriptEngine security bypass (Scripting, 7143535) (CVE-2012-5068)

  - OpenJDK: Executors state handling issues (Concurrency, 7189103) (CVE-2012-5069)

  - OpenJDK: EnvHelp information disclosure (JMX, 7158796) (CVE-2012-5070)

  - OpenJDK: DescriptorSupport insufficient package access checks (JMX, 7192975) (CVE-2012-5071)

  - OpenJDK: AccessController.doPrivilegedWithCombiner() information disclosure (Security, 7172522)     (CVE-2012-5072)

  - OpenJDK: LogManager security bypass (Libraries, 7169884) (CVE-2012-5073)

  - OpenJDK: com.sun.org.glassfish.* not restricted packages (JAX-WS, 7169887) (CVE-2012-5074)

  - OpenJDK: RMIConnectionImpl information disclosure (JMX, 7169888) (CVE-2012-5075)

  - OpenJDK: com.sun.org.glassfish.* not restricted packages (JAX-WS, 7163198) (CVE-2012-5076)

  - OpenJDK: SecureRandom mulitple seeders information disclosure (Security, 7167656) (CVE-2012-5077)

  - OpenJDK: ServiceLoader reject not subtype classes without instantiating (Libraries, 7195919)     (CVE-2012-5079)

  - OpenJDK: JSSE denial of service (JSSE, 7186286) (CVE-2012-5081)

  - OpenJDK: DefaultFormatter insufficient data validation (Swing, 7195194) (CVE-2012-5084)

  - OpenJDK: disable Gopher support by default (Gopher, 7189567) (CVE-2012-5085)

  - OpenJDK: XMLDecoder sandbox restriction bypass (Beans, 7195917) (CVE-2012-5086)

  - OpenJDK: PropertyElementHandler insufficient access checks (Beans, 7195549) (CVE-2012-5087)

  - OpenJDK: MethodHandle insufficient access control checks (Libraries, 7196190) (CVE-2012-5088)

  - OpenJDK: RMIConnectionImpl insufficient access control checks (JMX, 7198296) (CVE-2012-5089)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated java-1.7.0-openjdk packages that fix several security issues are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

[Update 13 November 2012] The file list of this advisory was updated to move java-1.7.0-openjdk-devel from the optional repositories to the base repositories. Additionally, java-1.7.0-openjdk for the HPC Node variant was also moved (this package was already in the base repositories for other product variants). No changes have been made to the packages themselves.

These packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Software Development Kit.

Multiple improper permission check issues were discovered in the Beans, Libraries, Swing, and JMX components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. (CVE-2012-5086, CVE-2012-5087, CVE-2012-5088, CVE-2012-5084, CVE-2012-5089)

The default Java security properties configuration did not restrict access to certain com.sun.org.glassfish packages. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. This update lists those packages as restricted.
(CVE-2012-5076, CVE-2012-5074)

Multiple improper permission check issues were discovered in the Scripting, JMX, Concurrency, Libraries, and Security components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2012-5068, CVE-2012-5071, CVE-2012-5069, CVE-2012-5073, CVE-2012-5072)

It was discovered that java.util.ServiceLoader could create an instance of an incompatible class while performing provider lookup. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. (CVE-2012-5079)

It was discovered that the Java Secure Socket Extension (JSSE) SSL/TLS implementation did not properly handle handshake records containing an overly large data length value. An unauthenticated, remote attacker could possibly use this flaw to cause an SSL/TLS server to terminate with an exception. (CVE-2012-5081)

It was discovered that the JMX component in OpenJDK could perform certain actions in an insecure manner. An untrusted Java application or applet could possibly use these flaws to disclose sensitive information. (CVE-2012-5070, CVE-2012-5075)

A bug in the Java HotSpot Virtual Machine optimization code could cause it to not perform array initialization in certain cases. An untrusted Java application or applet could use this flaw to disclose portions of the virtual machine's memory. (CVE-2012-4416)

It was discovered that the SecureRandom class did not properly protect against the creation of multiple seeders. An untrusted Java application or applet could possibly use this flaw to disclose sensitive information. (CVE-2012-5077)

It was discovered that the java.io.FilePermission class exposed the hash code of the canonicalized path name. An untrusted Java application or applet could possibly use this flaw to determine certain system paths, such as the current working directory.
(CVE-2012-3216)

This update disables Gopher protocol support in the java.net package by default. Gopher support can be enabled by setting the newly introduced property, 'jdk.net.registerGopherProtocol', to true.
(CVE-2012-5085)

This erratum also upgrades the OpenJDK package to IcedTea7 2.3.3.
Refer to the NEWS file, linked to in the References, for further information.

All users of java-1.7.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect.

ID	Name	Product	Family	Severity
89663	VMware ESX / ESXi NFC and Third-Party Libraries Multiple Vulnerabilities (VMSA-2013-0003) (remote check)	Nessus	Misc.	critical
83567	SUSE SLES11 Security Update : IBM Java 1.7.0 (SUSE-SU-2012:1489-2)	Nessus	SuSE Local Security Checks	critical
76303	GLSA-201406-32 : IcedTea JDK: Multiple vulnerabilities (BEAST) (ROBOT)	Nessus	Gentoo Local Security Checks	critical
74793	openSUSE Security Update : java-1_7_0-openjdk (openSUSE-SU-2012:1419-1) (ROBOT)	Nessus	SuSE Local Security Checks	critical
72139	GLSA-201401-30 : Oracle JRE/JDK: Multiple vulnerabilities (ROBOT)	Nessus	Gentoo Local Security Checks	critical
68646	Oracle Linux 6 : java-1.7.0-openjdk (ELSA-2012-1386)	Nessus	Oracle Linux Local Security Checks	medium
64849	Oracle Java SE Multiple Vulnerabilities (October 2012 CPU) (Unix)	Nessus	Misc.	critical
64171	SuSE 11.2 Security Update : IBM Java 1.7.0 (SAT Patch Number 7046)	Nessus	SuSE Local Security Checks	critical
64169	SuSE 11.2 Security Update : OpenJDK (SAT Patch Number 6987)	Nessus	SuSE Local Security Checks	critical
62932	RHEL 6 : java-1.7.0-ibm (RHSA-2012:1467)	Nessus	Red Hat Local Security Checks	critical
62709	Ubuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS / 12.10 : openjdk-6, openjdk-7 vulnerabilities (USN-1619-1) (ROBOT)	Nessus	Ubuntu Local Security Checks	critical
62653	Scientific Linux Security Update : java-1.7.0-openjdk on SL6.x i386/x86_64 (20121017) (ROBOT)	Nessus	Scientific Linux Local Security Checks	critical
62635	RHEL 6 : java-1.7.0-oracle (RHSA-2012:1391)	Nessus	Red Hat Local Security Checks	critical
62615	RHEL 6 : java-1.7.0-openjdk (RHSA-2012:1386)	Nessus	Red Hat Local Security Checks	medium
62598	CentOS 6 : java-1.7.0-openjdk (CESA-2012:1386) (ROBOT)	Nessus	CentOS Local Security Checks	critical
62593	Oracle Java SE Multiple Vulnerabilities (October 2012 CPU)	Nessus	Windows	critical

Detections

Analytics

CVE-2012-5070

high

Tenable Plugins

critical

critical

critical

critical

critical

medium

critical

critical

critical

critical

critical

critical

critical

medium

critical

critical