A flaw in the IBM J9 VM class verifier allows untrusted code to disable the security manager and elevate its privileges. IBM X-Force ID: 126873.

The version of IBM Java installed on the remote host is prior to 6.1 < 6.1.8.50 / 7.0 < 7.0.10.10 / 7.1 < 7.1.4.10 / 8.0 < 8.0.4.7. It is, therefore, affected by a vulnerability as referenced in the IBM Security Update August 2017 advisory.

  - A flaw in the IBM J9 VM class verifier allows untrusted code to disable the security manager and elevate     its privileges. IBM X-Force ID: 126873. (CVE-2017-1376)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Java SDK installed on the remote AIX host is affected by multiple vulnerabilities in the following subcomponents :

  - A flaw exists in the J9 VM class verifier component that     allows an unauthenticated, remote attacker to cause an     escalation of privileges. (CVE-2017-1376)

  - A flaw exists in the installp and updatep packages that     prevents security updates from being correctly applied.
    (CVE-2017-1541)

  - An unspecified flaw exists in the 2D component that     allows an unauthenticated, remote attacker to cause a     denial of service condition. (CVE-2017-10053)

  - Multiple unspecified flaws exist in the Security     component that allow an unauthenticated, remote attacker     to execute arbitrary code. (CVE-2017-10067,     CVE-2017-10116)

  - An unspecified flaw exists in the Scripting component     that allows an authenticated, remote attacker to impact     confidentiality and integrity. (CVE-2017-10078)

  - Multiple unspecified flaws exist in the Libraries     component that allow an unauthenticated, remote attacker     to execute arbitrary code. (CVE-2017-10087,     CVE-2017-10090)

  - An unspecified flaw exists in the ImageIO component that     allows an unauthenticated, remote attacker to execute     arbitrary code. (CVE-2017-10089)

  - Multiple unspecified flaws exist in the JAXP component     that allow an unauthenticated, remote attacker to     execute arbitrary code. (CVE-2017-10096, CVE-2017-10101)

  - Multiple unspecified flaws exist in the RMI component     that allow an unauthenticated, remote attacker to     execute arbitrary code. (CVE-2017-10102, CVE-2017-10107)

  - An unspecified flaw exists in the Deployment component     that allows an unauthenticated, remote attacker to     impact integrity. (CVE-2017-10105)

  - Multiple unspecified flaws exist in the Serialization     component that allow an unauthenticated, remote attacker     to exhaust available memory, resulting in a denial of     service condition. (CVE-2017-10108, CVE-2017-10109)

  - An unspecified flaw exists in the AWT component that     allows an unauthenticated, remote attacker to execute     arbitrary code. (CVE-2017-10110)

  - Multiple unspecified flaws exist in the JCE component     that allow an unauthenticated, remote attacker to     disclose sensitive information. (CVE-2017-10115)

  - An unspecified flaw exists in the Deployment component     that allows a local attacker to impact confidentiality,     integrity, and availability. (CVE-2017-10125)

  - An unspecified flaw exists in the JAX-WS component that     allows an unauthenticated, remote attacker to impact     confidentiality and availability. (CVE-2017-10243)

An update for java-1.7.1-ibm is now available for Red Hat Enterprise Linux 6 Supplementary and Red Hat Enterprise Linux 7 Supplementary.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

This update upgrades IBM Java SE 7 to version 7R1 SR4-FP10.

Security Fix(es) :

* This update fixes multiple vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Further information about these flaws can be found on the IBM Java Security Vulnerabilities page listed in the References section.
(CVE-2017-10053, CVE-2017-10067, CVE-2017-10087, CVE-2017-10089, CVE-2017-10090, CVE-2017-10096, CVE-2017-10101, CVE-2017-10102, CVE-2017-10105, CVE-2017-10107, CVE-2017-10108, CVE-2017-10109, CVE-2017-10110, CVE-2017-10115, CVE-2017-10116, CVE-2017-10243)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:2469 advisory.

  - IBM JDK: class verifier allowing Security Manager bypass (CVE-2017-1376)

  - OpenJDK: reading of unprocessed image data in JPEGImageReader (2D, 8169209) (CVE-2017-10053)

  - OpenJDK: JAR verifier incorrect handling of missing digest (Security, 8169392) (CVE-2017-10067)

  - OpenJDK: Nashorn incompletely blocking access to Java APIs (Scripting, 8171539) (CVE-2017-10078)

  - OpenJDK: insufficient access control checks in ThreadPoolExecutor (Libraries, 8172204) (CVE-2017-10087)

  - OpenJDK: insufficient access control checks in ServiceRegistry (ImageIO, 8172461) (CVE-2017-10089)

  - OpenJDK: insufficient access control checks in AsynchronousChannelGroupImpl (8172465, Libraries)     (CVE-2017-10090)

  - OpenJDK: insufficient access control checks in XML transformations (JAXP, 8172469) (CVE-2017-10096)

  - OpenJDK: unrestricted access to com.sun.org.apache.xml.internal.resolver (JAXP, 8173286) (CVE-2017-10101)

  - OpenJDK: incorrect handling of references in DGC (RMI, 8163958) (CVE-2017-10102)

  - Oracle JDK: unspecified vulnerability fixed in 6u161, 7u151, and 8u141 (Deployment) (CVE-2017-10105)

  - OpenJDK: insufficient access control checks in ActivationID (RMI, 8173697) (CVE-2017-10107)

  - OpenJDK: unbounded memory allocation in BasicAttribute deserialization (Serialization, 8174105)     (CVE-2017-10108)

  - OpenJDK: unbounded memory allocation in CodeSource deserialization (Serialization, 8174113)     (CVE-2017-10109)

  - OpenJDK: insufficient access control checks in ImageWatched (AWT, 8174098) (CVE-2017-10110)

  - OpenJDK: DSA implementation timing attack (JCE, 8175106) (CVE-2017-10115)

  - OpenJDK: LDAPCertStore following referrals to non-LDAP URLs (Security, 8176067) (CVE-2017-10116)

  - OpenJDK: insecure XML parsing in wsdlimport (JAX-WS, 8182054) (CVE-2017-10243)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
160366	IBM Java 6.1 < 6.1.8.50 / 7.0 < 7.0.10.10 / 7.1 < 7.1.4.10 / 8.0 < 8.0.4.7	Nessus	Misc.	critical
103191	AIX Java Advisory : java_july2017_advisory.asc (July 2017 CPU)	Nessus	AIX Local Security Checks	critical
102536	RHEL 6 / 7 : java-1.7.1-ibm (RHSA-2017:2481)	Nessus	Red Hat Local Security Checks	critical
102492	RHEL 6 / 7 : java-1.8.0-ibm (RHSA-2017:2469)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2017-1376

critical

Tenable Plugins

critical

critical

critical

critical