Detections
Analytics
Oracle JRockit R27 < R27.8.3.9 / R28 < R28.3.3.10 Multiple Vulnerabilities (July 2014 CPU)
medium Nessus Plugin ID 76883
Language:
Synopsis
The remote Windows host contains a programming platform that is affected by multiple vulnerabilities.Description
The remote host has a version of Oracle JRockit that is affected by multiple vulnerabilities that could allow a remote user to affect the confidentiality of the system via :- A design flaw in the RSA 'blinding' security component of the 'RASCore' class. By performing operations requiring the use of private keys and measuring timing differences, an attacker may be able to disclose information about the keys used.
(CVE-2014-4244).
- A design flaw in the 'validateDHPublicKey' function of the 'KeyUtil' class. A remote attacker may be able to recover a key. (CVE-2014-4263).
Solution
Upgrade to version R27.8.3.9 / R28.3.3.10 or later.See Also
Plugin Details
Severity: Medium
ID: 76883
File Name: oracle_jrockit_cpu_jul_2014.nasl
Version: 1.7
Type: local
Agent: windows
Family: Windows
Published: 7/29/2014
Updated: 11/15/2018
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.6
CVSS v2
Risk Factor: Medium
Base Score: 4
Temporal Score: 3
Vector: CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:N
Vulnerability Information
CPE: cpe:/a:oracle:jrockit
Required KB Items: installed_sw/Oracle JRockit
Exploit Ease: No known exploits are available
Patch Publication Date: 7/15/2014
Vulnerability Publication Date: 3/26/2014
Reference Information
CVE: CVE-2014-4244, CVE-2014-4263