RHEL 6 : eclipse (RHSA-2011:0568)

medium Nessus Plugin ID 54595

Language:

Synopsis

The remote Red Hat host is missing a security update.

Description

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2011:0568 advisory.

The Eclipse software development environment provides a set of tools for C/C++ and Java development.

A cross-site scripting (XSS) flaw was found in the Eclipse Help Contents web application. An attacker could use this flaw to perform a cross-site scripting attack against victims by tricking them into visiting a specially-crafted Eclipse Help URL. (CVE-2010-4647)

The following Eclipse packages have been upgraded to the versions found in the official upstream Eclipse Helios SR1 release, providing a number of bug fixes and enhancements over the previous versions:

* eclipse to 3.6.1. (BZ#656329)
* eclipse-cdt to 7.0.1. (BZ#656333)
* eclipse-birt to 2.6.0. (BZ#656391)
* eclipse-emf to 2.6.0. (BZ#656344)
* eclipse-gef to 3.6.1. (BZ#656347)
* eclipse-mylyn to 3.4.2. (BZ#656337)
* eclipse-rse to 3.2. (BZ#656338)
* eclipse-dtp to 1.8.1. (BZ#656397)
* eclipse-changelog to 2.7.0. (BZ#669499)
* eclipse-valgrind to 0.6.1. (BZ#669460)
* eclipse-callgraph to 0.6.1. (BZ#669462)
* eclipse-oprofile to 0.6.1. (BZ#670228)
* eclipse-linuxprofilingframework to 0.6.1. (BZ#669461)

In addition, the following updates were made to the dependencies of the Eclipse packages above:

* icu4j to 4.2.1. (BZ#656342)
* sat4j to 2.2.0. (BZ#661842)
* objectweb-asm to 3.2. (BZ#664019)
* jetty-eclipse to 6.1.24. (BZ#661845)

This update includes numerous upstream bug fixes and enhancements, such as:

* The Eclipse IDE and Java Development Tools (JDT):

- projects and folders can filter out resources in the workspace.
- new virtual folder and linked files support.
- the full set of UNIX file permissions is now supported.
- addition of the stop button to cancel long-running wizard tasks.
- Java editor now shows multiple quick-fixes via problem hover.
- new support for running JUnit version 4 tests.
- over 200 upstream bug fixes.

* The Eclipse C/C++ Development Tooling (CDT):

- new Codan framework has been added for static code analysis.
- refactoring improvements such as stored refactoring history.
- compile and build errors now highlighted in the build console.
- switch to the new DSF debugger framework.
- new template view support.
- over 600 upstream bug fixes.

This update also fixes the following bugs:

* Incorrect URIs for GNU Tools in the Help Contents window have been fixed. (BZ#622713)

* The profiling of binaries did not work if an Eclipse project was not in an Eclipse workspace. This update adds an automated test for external project profiling, which corrects this issue. (BZ#622867)

* Running a C/C++ application in Eclipse successfully terminated, but returned an I/O exception not related to the application itself in the Error Log window. With this update, the exception is no longer returned.
(BZ#668890)

* The eclipse-mylyn package showed a 20100916-0100-e3x qualifier. The qualifier has been modified to v20100902-0100-e3x to match the upstream version of eclipse-mylyn. (BZ#669819)

* Installing the eclipse-mylyn package failed and returned a Resource temporarily unavailable error message due to a bug in the packaging. This update fixes this bug and installation now works as expected. (BZ#673174)

* Building the eclipse-cdt package could fail due to an incorrect interaction with the local file system. Interaction with the local file system is now prevented and the build no longer fails. (BZ#678364)

* The libhover plug-in, provided by the eclipse-cdt package, used binary data to search for hover topics. The data location was specified externally as a URL which could cause an exception to occur on a system with no Internet access. This update modifies the plug-in so that it pulls the needed data from a local location. (BZ#679543)

Users of eclipse should upgrade to these updated packages, which correct these issues and add these enhancements.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Plugin Details

Severity: Medium

ID: 54595

File Name: redhat-RHSA-2011-0568.nasl

Version: 1.20

Type: local

Agent: unix

Family: Red Hat Local Security Checks

Published: 5/20/2011

Updated: 3/20/2025

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.8

Vendor

Vendor Severity: Low

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.4

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2010-4647

CVSS v3

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 5.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:eclipse-cdt, p-cpe:/a:redhat:enterprise_linux:eclipse-emf, p-cpe:/a:redhat:enterprise_linux:icu4j-javadoc, p-cpe:/a:redhat:enterprise_linux:eclipse-gef-examples, p-cpe:/a:redhat:enterprise_linux:eclipse-rse, p-cpe:/a:redhat:enterprise_linux:eclipse-emf-xsd-sdk, p-cpe:/a:redhat:enterprise_linux:eclipse-mylyn-wikitext, p-cpe:/a:redhat:enterprise_linux:icu4j, cpe:/o:redhat:enterprise_linux:6, p-cpe:/a:redhat:enterprise_linux:eclipse-mylyn-trac, p-cpe:/a:redhat:enterprise_linux:eclipse-mylyn-pde, p-cpe:/a:redhat:enterprise_linux:sat4j, p-cpe:/a:redhat:enterprise_linux:eclipse-emf-examples, p-cpe:/a:redhat:enterprise_linux:eclipse-emf-xsd, p-cpe:/a:redhat:enterprise_linux:eclipse, p-cpe:/a:redhat:enterprise_linux:eclipse-swt, p-cpe:/a:redhat:enterprise_linux:eclipse-mylyn-webtasks, p-cpe:/a:redhat:enterprise_linux:objectweb-asm, p-cpe:/a:redhat:enterprise_linux:eclipse-changelog, p-cpe:/a:redhat:enterprise_linux:eclipse-jdt, p-cpe:/a:redhat:enterprise_linux:icu4j-eclipse, p-cpe:/a:redhat:enterprise_linux:eclipse-oprofile, p-cpe:/a:redhat:enterprise_linux:jetty-eclipse, p-cpe:/a:redhat:enterprise_linux:eclipse-dtp, p-cpe:/a:redhat:enterprise_linux:eclipse-rcp, p-cpe:/a:redhat:enterprise_linux:eclipse-gef-sdk, p-cpe:/a:redhat:enterprise_linux:eclipse-gef, p-cpe:/a:redhat:enterprise_linux:eclipse-callgraph, p-cpe:/a:redhat:enterprise_linux:eclipse-cdt-parsers, p-cpe:/a:redhat:enterprise_linux:eclipse-mylyn, p-cpe:/a:redhat:enterprise_linux:eclipse-birt, p-cpe:/a:redhat:enterprise_linux:eclipse-emf-sdk, p-cpe:/a:redhat:enterprise_linux:eclipse-mylyn-cdt, p-cpe:/a:redhat:enterprise_linux:eclipse-platform, p-cpe:/a:redhat:enterprise_linux:eclipse-cdt-sdk, p-cpe:/a:redhat:enterprise_linux:eclipse-mylyn-java, p-cpe:/a:redhat:enterprise_linux:eclipse-pde, p-cpe:/a:redhat:enterprise_linux:eclipse-valgrind, p-cpe:/a:redhat:enterprise_linux:objectweb-asm-javadoc, p-cpe:/a:redhat:enterprise_linux:eclipse-linuxprofilingframework

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 5/19/2011

Vulnerability Publication Date: 1/13/2011

Reference Information

CVE: CVE-2010-4647

BID: 44883

CWE: 79

RHSA: 2011:0568

Detections

Analytics