Detections
Analytics
Scientific Linux Security Update : java-1.6.0-openjdk on SL5.x, SL6.x i386/srpm/x86_64 (20140721)
high Nessus Plugin ID 76681
Language:
Synopsis
The remote Scientific Linux host is missing one or more security updates.Description
It was discovered that the Hotspot component in OpenJDK did not properly verify bytecode from the class files. An untrusted Java application or applet could possibly use these flaws to bypass Java sandbox restrictions. (CVE-2014-4216, CVE-2014-4219)A format string flaw was discovered in the Hotspot component event logger in OpenJDK. An untrusted Java application or applet could use this flaw to crash the Java Virtual Machine or, potentially, execute arbitrary code with the privileges of the Java Virtual Machine.
(CVE-2014-2490)
An improper permission check issue was discovered in the Libraries component in OpenJDK. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. (CVE-2014-4262)
Multiple flaws were discovered in the JMX, Libraries, Security, and Serviceability components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2014-4209, CVE-2014-4218, CVE-2014-4252, CVE-2014-4266)
It was discovered that the RSA algorithm in the Security component in OpenJDK did not sufficiently perform blinding while performing operations that were using private keys. An attacker able to measure timing differences of those operations could possibly leak information about the used keys. (CVE-2014-4244)
The Diffie-Hellman (DH) key exchange algorithm implementation in the Security component in OpenJDK failed to validate public DH parameters properly. This could cause OpenJDK to accept and use weak parameters, allowing an attacker to recover the negotiated key. (CVE-2014-4263)
This update also fixes the following bug :
- Prior to this update, an application accessing an unsynchronized HashMap could potentially enter an infinite loop and consume an excessive amount of CPU resources. This update resolves this issue.
All running instances of OpenJDK Java must be restarted for the update to take effect.
Solution
Update the affected packages.See Also
Plugin Details
Severity: High
ID: 76681
File Name: sl_20140721_java_1_6_0_openjdk_on_SL5_x.nasl
Version: 1.10
Type: local
Agent: unix
Published: 7/22/2014
Updated: 1/14/2021
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.5
CVSS v2
Risk Factor: High
Base Score: 9.3
Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C
Vulnerability Information
CPE: p-cpe:/a:fermilab:scientific_linux:java-1.6.0-openjdk, p-cpe:/a:fermilab:scientific_linux:java-1.6.0-openjdk-debuginfo, p-cpe:/a:fermilab:scientific_linux:java-1.6.0-openjdk-demo, p-cpe:/a:fermilab:scientific_linux:java-1.6.0-openjdk-devel, p-cpe:/a:fermilab:scientific_linux:java-1.6.0-openjdk-javadoc, p-cpe:/a:fermilab:scientific_linux:java-1.6.0-openjdk-src, x-cpe:/o:fermilab:scientific_linux
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/RedHat/release, Host/RedHat/rpm-list
Patch Publication Date: 7/21/2014
Vulnerability Publication Date: 7/17/2014
Reference Information
CVE: CVE-2014-2490, CVE-2014-4209, CVE-2014-4216, CVE-2014-4218, CVE-2014-4219, CVE-2014-4244, CVE-2014-4252, CVE-2014-4262, CVE-2014-4263, CVE-2014-4266