Detections
Analytics

Oracle Java SE Multiple Vulnerabilities (January 2015 CPU) (POODLE)

critical Nessus Plugin ID 80908

Language:

Synopsis

The remote Windows host contains a programming platform that is affected by multiple vulnerabilities.

Description

The version of Oracle Java SE or Java for Business installed on the remote host is prior to 8 Update 31, 7 Update 75, 6 Update 91, or 5 Update 81. It is, therefore, affected by security vulnerabilities in the following components :

 - 2D
 - Deployment
 - Hotspot
 - Install
 - JAX-WS
 - JSSE
 - Libraries
 - RMI
 - Security
 - Serviceability
 - Swing

Solution

Update to JDK / JRE 8 Update 31, 7 Update 75, 6 Update 91, or 5 Update 81 or later, and if necessary, remove any affected versions.

Note that an Extended Support contract with Oracle is needed to obtain JDK / JRE 5 Update 81 or later, or 6 Update 91 or later.

See Also

http://www.nessus.org/u?75c6cafb

https://www.imperialviolet.org/2014/10/14/poodle.html

https://www.openssl.org/~bodo/ssl-poodle.pdf

https://tools.ietf.org/html/draft-ietf-tls-downgrade-scsv-00

http://www.nessus.org/u?726f7054

http://www.nessus.org/u?84f3023c

http://www.nessus.org/u?17bff27a

http://www.nessus.org/u?64c6b956

Plugin Details

Severity: Critical

ID: 80908

File Name: oracle_java_cpu_jan_2015.nasl

Version: 1.16

Type: local

Agent: windows

Family: Windows

Published: 1/22/2015

Updated: 12/19/2024

Configuration: Enable thorough checks

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.5

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2014-6601

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:oracle:jdk, cpe:/a:oracle:jre

Required KB Items: installed_sw/Java

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 1/20/2015

Vulnerability Publication Date: 10/14/2014

Reference Information

CVE: CVE-2014-3566, CVE-2014-6549, CVE-2014-6585, CVE-2014-6587, CVE-2014-6591, CVE-2014-6593, CVE-2014-6601, CVE-2015-0383, CVE-2015-0395, CVE-2015-0400, CVE-2015-0403, CVE-2015-0406, CVE-2015-0407, CVE-2015-0408, CVE-2015-0410, CVE-2015-0412, CVE-2015-0413, CVE-2015-0421, CVE-2015-0437

BID: 70574, 72132, 72136, 72140, 72142, 72155, 72159, 72162, 72165, 72168, 72169, 72173, 72175, 72148, 72154, 72137, 72146, 72176, 72150

CERT: 577193