Detections
Analytics
RHEL 5 : java-1.5.0-sun (RHSA-2008:1025)
critical Nessus Plugin ID 40732
Synopsis
The remote Red Hat host is missing one or more security updates for java-1.5.0-sun.Description
The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2008:1025 advisory.- Java Web Start File Inclusion via System Properties Override (CVE-2008-2086)
- JavaWebStart allows unauthorized network connections (CVE-2008-5339)
- Java WebStart privilege escalation (CVE-2008-5340)
- Java Web Start exposes username and the pathname of the JWS cache (CVE-2008-5341)
- Java Web Start BasicService displays local files in the browser (CVE-2008-5342)
- Java WebStart allows hidden code privilege escalation (CVE-2008-5343)
- Java WebStart unprivileged local file and network access (CVE-2008-5344)
- JRE allows unauthorized file access and connections to localhost (CVE-2008-5345)
- JRE allows unauthorized memory read access via a crafted ZIP file (CVE-2008-5346)
- OpenJDK Denial-Of-Service in kerberos authentication (6588160) (CVE-2008-5348)
- OpenJDK RSA public key length denial-of-service (6497740) (CVE-2008-5349)
- OpenJDK allows to list files within the user home directory (6484091) (CVE-2008-5350)
- OpenJDK UTF-8 decoder accepts non-shortest form sequences (4486841) (CVE-2008-5351)
- OpenJDK Jar200 Decompression buffer overflow (6755943) (CVE-2008-5352)
- OpenJDK calendar object deserialization allows privilege escalation (6734167) (CVE-2008-5353)
- OpenJDK Privilege escalation in command line applications (6733959) (CVE-2008-5354)
- OpenJDK Font processing vulnerability (6733336) (CVE-2008-5356)
- OpenJDK Truetype Font processing vulnerability (6751322) (CVE-2008-5357)
- OpenJDK Buffer overflow in image processing (6726779) (CVE-2008-5359)
- OpenJDK temporary files have guessable file names (6721753) (CVE-2008-5360)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update the RHEL java-1.5.0-sun package based on the guidance in RHSA-2008:1025.See Also
http://www.nessus.org/u?62da0971
http://www.nessus.org/u?c8d7aabf
https://access.redhat.com/errata/RHSA-2008:1025
https://access.redhat.com/security/updates/classification/#critical
Plugin Details
Severity: Critical
ID: 40732
File Name: redhat-RHSA-2008-1025.nasl
Version: 1.32
Type: local
Agent: unix
Family: Red Hat Local Security Checks
Published: 8/24/2009
Updated: 4/21/2024
Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Critical
Score: 9.7
Vendor
Vendor Severity: Critical
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 8.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2008-5353
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 9.4
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C
CVSS Score Source: CVE-2008-5354
Vulnerability Information
CPE: p-cpe:/a:redhat:enterprise_linux:java-1.5.0-sun, cpe:/o:redhat:enterprise_linux:5, p-cpe:/a:redhat:enterprise_linux:java-1.5.0-sun-jdbc, p-cpe:/a:redhat:enterprise_linux:java-1.5.0-sun-src, p-cpe:/a:redhat:enterprise_linux:java-1.5.0-sun-demo, p-cpe:/a:redhat:enterprise_linux:java-1.5.0-sun-devel, p-cpe:/a:redhat:enterprise_linux:java-1.5.0-sun-plugin
Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 12/4/2008
Vulnerability Publication Date: 12/4/2008
Reference Information
CVE: CVE-2008-2086, CVE-2008-5339, CVE-2008-5340, CVE-2008-5341, CVE-2008-5342, CVE-2008-5343, CVE-2008-5344, CVE-2008-5345, CVE-2008-5346, CVE-2008-5348, CVE-2008-5349, CVE-2008-5350, CVE-2008-5351, CVE-2008-5352, CVE-2008-5353, CVE-2008-5354, CVE-2008-5356, CVE-2008-5357, CVE-2008-5359, CVE-2008-5360
RHSA: 2008:1025