Detections
Analytics
Oracle Java SE Multiple Vulnerabilities (October 2016 CPU)
critical Nessus Plugin ID 94138
Language:
Synopsis
The remote Windows host contains a programming platform that is affected by multiple vulnerabilities.Description
The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 8 Update 111, 7 Update 121, or 6 Update 131. It is, therefore, affected by multiple vulnerabilities :- An unspecified flaw exists in the Libraries subcomponent that allows an unauthenticated, remote attacker to impact integrity. (CVE-2016-5542)
- An unspecified flaw exists in the JMX subcomponent that allows an unauthenticated, remote attacker to impact integrity. (CVE-2016-5554)
- An unspecified flaw exists in the 2D subcomponent that allows an unauthenticated, remote attacker to execute arbitrary code. (CVE-2016-5556)
- An unspecified flaw exists in the AWT subcomponent that allows an unauthenticated, remote attacker to execute arbitrary code. (CVE-2016-5568)
- Multiple unspecified flaws exist in the Hotspot subcomponent that allow an unauthenticated, remote attacker to execute arbitrary code. (CVE-2016-5573, CVE-2016-5582)
- An unspecified flaw exists in the Networking subcomponent that allows an unauthenticated, remote attacker to disclose sensitive information.
(CVE-2016-5597)
Solution
Upgrade to Oracle JDK / JRE 8 Update 111 / 7 Update 121 / 6 Update 131 or later. If necessary, remove any affected versions.Note that an Extended Support contract with Oracle is needed to obtain JDK / JRE 6 Update 95 or later.
See Also
http://www.nessus.org/u?bac902d5
http://www.nessus.org/u?10d5f7a6
Plugin Details
Severity: Critical
ID: 94138
File Name: oracle_java_cpu_oct_2016.nasl
Version: 1.11
Type: local
Agent: windows
Family: Windows
Published: 10/19/2016
Updated: 4/11/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: High
Score: 7.3
CVSS v2
Risk Factor: High
Base Score: 9.3
Temporal Score: 6.9
Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C
CVSS v3
Risk Factor: Critical
Base Score: 9.6
Temporal Score: 8.3
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:oracle:jre, cpe:/a:oracle:jdk
Required KB Items: SMB/Java/JRE/Installed
Exploit Ease: No known exploits are available
Patch Publication Date: 10/18/2016
Vulnerability Publication Date: 10/18/2016
Reference Information
CVE: CVE-2016-5542, CVE-2016-5554, CVE-2016-5556, CVE-2016-5568, CVE-2016-5573, CVE-2016-5582, CVE-2016-5597