Detections
Analytics
AIX Java Advisory : java_apr2019_advisory.asc (April 2019 CPU)
high Nessus Plugin ID 126924
Language:
Synopsis
The version of Java SDK installed on the remote AIX host is affected by multiple vulnerabilities.Description
The version of Java SDK installed on the remote AIX host is affected by multiple vulnerabilities in the following subcomponents :- A flaw exists in Libraries that allows an unauthenticated, remote attacker to cause denial of service. (CVE-2019-2602)
- A flaw exists in the RMI component that allows an unauthenticated, remote attacker to cause unspecified integrity impact.
(CVE-2019-2684)
- Flaws exist in the 2D component that allows an unauthenticated, remote attacker to take control of the system via unspecified means. (CVE-2019-2697, CVE-2019-2698)
- A flaw exists in Eclipse OpenJ9 that allows an unauthenticated, remote attacker to cause denial of service. (CVE-2019-10245)
Solution
Fixes are available by version and can be downloaded from the IBM AIX website.See Also
http://www.nessus.org/u?7cd5eba2
http://www.nessus.org/u?4918cb7e
http://www.nessus.org/u?6763c01c
http://www.nessus.org/u?816ae152
http://www.nessus.org/u?38db0cea
Plugin Details
Severity: High
ID: 126924
File Name: aix_java_apr2019_advisory.nasl
Version: 1.2
Type: local
Family: AIX Local Security Checks
Published: 7/22/2019
Updated: 8/12/2019
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: High
Score: 7.4
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 5.3
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2019-2697
CVSS v3
Risk Factor: High
Base Score: 8.1
Temporal Score: 7.3
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:oracle:jdk, cpe:/a:oracle:jre, cpe:/o:ibm:aix
Required KB Items: Host/AIX/lslpp, Host/local_checks_enabled, Host/AIX/version, Host/AIX/oslevelsp
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 4/23/2019
Vulnerability Publication Date: 4/23/2019
Reference Information
CVE: CVE-2019-10245, CVE-2019-2602, CVE-2019-2684, CVE-2019-2697, CVE-2019-2698