The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:0752 advisory.

    These packages provide the OpenJDK 7 Java Runtime Environment and the     OpenJDK 7 Software Development Kit.

    Multiple flaws were discovered in the font layout engine in the 2D     component. An untrusted Java application or applet could possibly use these     flaws to trigger Java Virtual Machine memory corruption. (CVE-2013-1569,     CVE-2013-2383, CVE-2013-2384)

    Multiple improper permission check issues were discovered in the Beans,     Libraries, JAXP, and RMI components in OpenJDK. An untrusted Java     application or applet could use these flaws to bypass Java sandbox     restrictions. (CVE-2013-1558, CVE-2013-2422, CVE-2013-2436, CVE-2013-1518,     CVE-2013-1557)

    The previous default value of the java.rmi.server.useCodebaseOnly property     permitted the RMI implementation to automatically load classes from     remotely specified locations. An attacker able to connect to an application     using RMI could use this flaw to make the application execute arbitrary     code. (CVE-2013-1537)

    Note: The fix for CVE-2013-1537 changes the default value of the property     to true, restricting class loading to the local CLASSPATH and locations     specified in the java.rmi.server.codebase property. Refer to Red Hat     Bugzilla bug 952387 for additional details.

    The 2D component did not properly process certain images. An untrusted Java     application or applet could possibly use this flaw to trigger Java Virtual     Machine memory corruption. (CVE-2013-2420)

    It was discovered that the Hotspot component did not properly handle     certain intrinsic frames, and did not correctly perform access checks and     MethodHandle lookups. An untrusted Java application or applet could     use these flaws to bypass Java sandbox restrictions. (CVE-2013-2431,     CVE-2013-2421, CVE-2013-2423)

    It was discovered that JPEGImageReader and JPEGImageWriter in the ImageIO     component did not protect against modification of their state while     performing certain native code operations. An untrusted Java application or     applet could possibly use these flaws to trigger Java Virtual Machine     memory corruption. (CVE-2013-2429, CVE-2013-2430)

    The JDBC driver manager could incorrectly call the toString() method in     JDBC drivers, and the ConcurrentHashMap class could incorrectly call the     defaultReadObject() method. An untrusted Java application or applet could     possibly use these flaws to bypass Java sandbox restrictions.
    (CVE-2013-1488, CVE-2013-2426)

    The sun.awt.datatransfer.ClassLoaderObjectInputStream class may incorrectly     invoke the system class loader. An untrusted Java application or applet     could possibly use this flaw to bypass certain Java sandbox restrictions.
    (CVE-2013-0401)

    Flaws were discovered in the Network component's InetAddress serialization,     and the 2D component's font handling. An untrusted Java application or     applet could possibly use these flaws to crash the Java Virtual Machine.
    (CVE-2013-2417, CVE-2013-2419)

    The MBeanInstantiator class implementation in the OpenJDK JMX component did     not properly check class access before creating new instances. An untrusted     Java application or applet could use this flaw to create instances of     non-public classes. (CVE-2013-2424)

    It was discovered that JAX-WS could possibly create temporary files with     insecure permissions. A local attacker could use this flaw to access     temporary files created by an application using JAX-WS. (CVE-2013-2415)

    This erratum also upgrades the OpenJDK package to IcedTea7 2.3.9. Refer to     the NEWS file, linked to in the References, for further information.

    All users of java-1.7.0-openjdk are advised to upgrade to these updated     packages, which resolve these issues. All running instances of OpenJDK Java     must be restarted for the update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 5 : java-1.7.0-openjdk (RHSA-2013:0752)

critical Nessus Plugin ID 66014

Version 1.29