The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3824-1 advisory.

    It was discovered that the Security component of OpenJDK did not properly ensure that manifest elements     were signed before use. An attacker could possibly use this to specially construct an untrusted Java     application or applet that could escape sandbox restrictions. (CVE-2018-3136)

    Artem Smotrakov discovered that the HTTP client redirection handler implementation in OpenJDK did not     clear potentially sensitive information in HTTP headers when following redirections to different hosts. An     attacker could use this to expose sensitive information. (CVE-2018-3139)

    It was discovered that the Java Naming and Directory Interface (JNDI) implementation in OpenJDK did not     properly enforce restrictions specified by system properties in some situations. An attacker could     potentially use this to execute arbitrary code. (CVE-2018-3149)

    It was discovered that the Hotspot component of OpenJDK did not properly perform access checks in certain     cases when performing field link resolution. An attacker could use this to specially construct an     untrusted Java application or applet that could escape sandbox restrictions. (CVE-2018-3169)

    Felix Drre discovered that the Java Secure Socket Extension (JSSE) implementation in OpenJDK did not     ensure that the same endpoint identification algorithm was used during TLS session resumption as during     initial session setup. An attacker could use this to expose sensitive information. (CVE-2018-3180)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 14.04 LTS : OpenJDK 7 vulnerabilities (USN-3824-1)

high Nessus Plugin ID 119014

Version 1.9

Version 1.8

Version 1.9 Aug 28, 2024, 11:02 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202408282302
Version 1.8 Oct 21, 2023, 5:06 AM CVSSv3 score source (set to "CVE-2018-3169") Detection Exploit attributes ("Exploit available" set to "False") Plugin metadata Plugin Feed: 202310210506