The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:0246 advisory.

    These packages provide the OpenJDK 6 Java Runtime Environment and the     OpenJDK 6 Software Development Kit.

    Multiple improper permission check issues were discovered in the AWT,     CORBA, JMX, and Libraries components in OpenJDK. An untrusted Java     application or applet could use these flaws to bypass Java sandbox     restrictions. (CVE-2013-0442, CVE-2013-0445, CVE-2013-0441, CVE-2013-1475,     CVE-2013-1476, CVE-2013-0429, CVE-2013-0450, CVE-2013-0425, CVE-2013-0426,     CVE-2013-0428)

    Multiple flaws were found in the way image parsers in the 2D and AWT     components handled image raster parameters. A specially-crafted image could     cause Java Virtual Machine memory corruption and, possibly, lead to     arbitrary code execution with the virtual machine privileges.
    (CVE-2013-1478, CVE-2013-1480)

    A flaw was found in the AWT component's clipboard handling code. An     untrusted Java application or applet could use this flaw to access     clipboard data, bypassing Java sandbox restrictions. (CVE-2013-0432)

    The default Java security properties configuration did not restrict access     to certain com.sun.xml.internal packages. An untrusted Java application or     applet could use this flaw to access information, bypassing certain Java     sandbox restrictions. This update lists the whole package as restricted.
    (CVE-2013-0435)

    Multiple improper permission check issues were discovered in the Libraries,     Networking, and JAXP components. An untrusted Java application or applet     could use these flaws to bypass certain Java sandbox restrictions.
    (CVE-2013-0427, CVE-2013-0433, CVE-2013-0434)

    It was discovered that the RMI component's CGIHandler class used user     inputs in error messages without any sanitization. An attacker could use     this flaw to perform a cross-site scripting (XSS) attack. (CVE-2013-0424)

    It was discovered that the SSL/TLS implementation in the JSSE component     did not properly enforce handshake message ordering, allowing an unlimited     number of handshake restarts. A remote attacker could use this flaw to     make an SSL/TLS server using JSSE consume an excessive amount of CPU by     continuously restarting the handshake. (CVE-2013-0440)

    It was discovered that the JSSE component did not properly validate     Diffie-Hellman public keys. An SSL/TLS client could possibly use this flaw     to perform a small subgroup attack. (CVE-2013-0443)

    This erratum also upgrades the OpenJDK package to IcedTea6 1.11.6. Refer to     the NEWS file, linked to in the References, for further information.

    All users of java-1.6.0-openjdk are advised to upgrade to these updated     packages, which resolve these issues. All running instances of OpenJDK Java     must be restarted for the update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 5 : java-1.6.0-openjdk (RHSA-2013:0246)

high Nessus Plugin ID 64519

Version 1.21