Detections
Analytics

Oracle Java SE Multiple Vulnerabilities (April 2017 CPU)

high Nessus Plugin ID 99588

Language:

Synopsis

The remote Windows host contains a programming platform that is affected by multiple vulnerabilities.

Description

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 6 Update 151, 7 Update 141, or 8 Update 131. It is, therefore, affected by multiple vulnerabilities :

 - An unspecified flaw exists in the Networking subcomponent that allows an unauthenticated, remote attacker to impact confidentiality and integrity.
 (CVE-2017-3509)

 - An unspecified flaw exists in the JCE subcomponent that allows a local attacker to gain elevated privileges.
 This vulnerability does not affect Java SE version 6.
 (CVE-2017-3511)

 - An unspecified flaw exists in the AWT subcomponent that allows an unauthenticated, remote attacker to execute arbitrary code. This vulnerability does not affect Java SE version 6. (CVE-2017-3512)

 - An unspecified flaw exists in the AWT subcomponent that allows an unauthenticated, remote attacker to execute arbitrary code. (CVE-2017-3514)

 - An unspecified flaw exists in the JAXP subcomponent that allows an unauthenticated, remote attacker to cause a denial of service condition. (CVE-2017-3526)

 - Multiple unspecified flaws exist in the Networking subcomponent that allow an unauthenticated, remote attacker to gain update, insert, or delete access to unauthorized data. (CVE-2017-3533, CVE-2017-3544)

 - An unspecified flaw exists in the Security subcomponent that allows an unauthenticated, remote attacker to gain update, insert, or delete access to unauthorized data.
 (CVE-2017-3539)

Solution

Upgrade to Oracle JDK / JRE 6 Update 151 / 7 Update 141 / 8 Update 131 or later. If necessary, remove any affected versions.

Note that an Extended Support contract with Oracle is needed to obtain JDK / JRE 6 Update 95 or later.

See Also

http://www.nessus.org/u?726f7054

http://www.nessus.org/u?eb4db3c7

http://www.nessus.org/u?02dc6498

http://www.nessus.org/u?ce35fa3a

http://www.nessus.org/u?2fbcacca

Plugin Details

Severity: High

ID: 99588

File Name: oracle_java_cpu_apr_2017.nasl

Version: 1.9

Type: local

Agent: windows

Family: Windows

Published: 4/21/2017

Updated: 4/11/2022

Configuration: Enable thorough checks

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.3

CVSS v2

Risk Factor: Medium

Base Score: 5.1

Temporal Score: 4

Vector: CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2017-3514

CVSS v3

Risk Factor: High

Base Score: 8.3

Temporal Score: 7.5

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:oracle:jre, cpe:/a:oracle:jdk

Required KB Items: SMB/Java/JRE/Installed

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 4/18/2017

Vulnerability Publication Date: 4/18/2017

Reference Information

CVE: CVE-2017-3509, CVE-2017-3511, CVE-2017-3512, CVE-2017-3514, CVE-2017-3526, CVE-2017-3533, CVE-2017-3539, CVE-2017-3544

BID: 97727, 97729, 97731, 97733, 97737, 97740, 97745, 97752