The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:1091 advisory.

    IBM Java SE version 6 includes the IBM Java Runtime Environment and the IBM     Java Software Development Kit.

    This update corrects several security vulnerabilities in the IBM Java     Runtime Environment shipped as part of Red Hat Satellite 5. In a typical     operating environment, these are of low security risk as the runtime is not     used on untrusted applets. Further information about these flaws can be     found on the IBM Java Security alerts page, listed in the References     section. (CVE-2005-1080, CVE-2015-0138, CVE-2015-0192, CVE-2015-0458,     CVE-2015-0459, CVE-2015-0469, CVE-2015-0477, CVE-2015-0478, CVE-2015-0480,     CVE-2015-0488, CVE-2015-0491, CVE-2015-1914, CVE-2015-2808)

    The CVE-2015-0478 issue was discovered by Florian Weimer of Red Hat     Product Security.

    Note: With this update, the IBM JDK now disables RC4 SSL/TLS cipher suites     by default to address the CVE-2015-2808 issue. Refer to Red Hat Bugzilla     bug 1207101, linked to from the References section, for additional details     about this change.

    Users of Red Hat Satellite 5.6 and 5.7 are advised to upgrade to these     updated packages, which contain the IBM Java SE 6 SR16-FP4 release. For     this update to take effect, Red Hat Satellite must be restarted     (/usr/sbin/rhn-satellite restart), as well as all running instances of     IBM Java.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 5 / 6 : Red Hat Satellite IBM Java Runtime (RHSA-2015:1091)

critical Nessus Plugin ID 84143

Version 2.14