Dan Kaminsky discovered that SSL certificates signed with MD2 could be spoofed given enough time. As a result, an attacker could potentially create a malicious trusted certificate to impersonate another site.
This update handles this issue by completely disabling MD2 for certificate validation in OpenJDK. (CVE-2009-2409)

It was discovered that ICC profiles could be identified with '..' pathnames. If a user were tricked into running a specially crafted applet, a remote attacker could gain information about a local system.
(CVE-2009-3728)

Peter Vreugdenhil discovered multiple flaws in the processing of graphics in the AWT library. If a user were tricked into running a specially crafted applet, a remote attacker could crash the application or run arbitrary code with user privileges.
(CVE-2009-3869, CVE-2009-3871)

Multiple flaws were discovered in JPEG and BMP image handling. If a user were tricked into loading a specially crafted image, a remote attacker could crash the application or run arbitrary code with user privileges. (CVE-2009-3873, CVE-2009-3874, CVE-2009-3885)

Coda Hale discovered that HMAC-based signatures were not correctly validated. Remote attackers could bypass certain forms of authentication, granting unexpected access. (CVE-2009-3875)

Multiple flaws were discovered in ASN.1 parsing. A remote attacker could send a specially crafted HTTP stream that would exhaust system memory and lead to a denial of service. (CVE-2009-3876, CVE-2009-3877)

It was discovered that the graphics configuration subsystem did not correctly handle arrays. If a user were tricked into running a specially crafted applet, a remote attacker could exploit this to crash the application or execute arbitrary code with user privileges.
(CVE-2009-3879)

It was discovered that loggers and Swing did not correctly handle certain sensitive objects. If a user were tricked into running a specially crafted applet, private information could be leaked to a remote attacker, leading to a loss of privacy. (CVE-2009-3880, CVE-2009-3882, CVE-2009-3883)

It was discovered that the ClassLoader did not correctly handle certain options. If a user were tricked into running a specially crafted applet, a remote attacker could execute arbitrary code with user privileges. (CVE-2009-3881)

It was discovered that time zone file loading could be used to determine the existence of files on the local system. If a user were tricked into running a specially crafted applet, private information could be leaked to a remote attacker, leading to a loss of privacy.
(CVE-2009-3884).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Sun Java 6 SDK/JRE was updated to u17 update fixing bugs and various security issues :

CVE-2009-3866:The Java Web Start Installer in Sun Java SE in JDK and JRE 6 before Update 17 does not properly use security model permissions when removing installer extensions, which allows remote attackers to execute arbitrary code by modifying a certain JNLP file to have a URL field that poi nts to an unintended trusted application, aka Bug Id 6872824.

CVE-2009-3867: Stack-based buffer overflow in the HsbParser.getSoundBank function in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via a long file: URL in an argument, aka Bug Id 6854303.

CVE-2009-3869: Stack-based buffer overflow in the setDiffICM function in the Abstract Window Toolkit (AWT) in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_ 24 allows remote attackers to execute arbitrary code via a crafted argument, aka Bug Id 6872357.

CVE-2009-3871: Heap-based buffer overflow in the setBytePixels function in the Abstract Window Toolkit (AWT) in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4. 2_24 allows remote attackers to execute arbitrary code via crafted arguments, aka Bug Id 6872358.

CVE-2009-3874: Integer overflow in the JPEGImageReader implementation in the ImageI/O component in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via large subsample dimensi ons in a JPEG file that triggers a heap-based buffer overflow, aka Bug Id 6874643.

CVE-2009-3875: The MessageDigest.isEqual function in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to spoof HMAC-based digital si gnatures, and possibly bypass authentication, via unspecified vectors related to 'timing attack vulnerabilities,' aka Bug Id 6863503.

CVE-2009-3876: Unspecified vulnerability in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1 _27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to cause a denial of service (memory consumption) via crafted DER encoded data, which is not properly decoded by the ASN.1 DER input stream parser, aka Bug Id 6864911.

CVE-2009-3877: Unspecified vulnerability in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1 _27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to cause a denial of service (memory consumption) via crafted HTTP header s, which are not properly parsed by the ASN.1 DER input stream parser, aka Bug Id 6864911.

CVE-2009-3864: The Java Update functionality in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22 and JDK and JRE 6 before Update 17, when a non-English version of Windows is used, does not retrieve available new JRE versions, which allows remote attackers to lev erage vulnerabilities in older releases of this software, aka Bug Id 6869694.

CVE-2009-3865: The launch method in the Deployment Toolkit plugin in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 6 before Update 17 allows remote attackers to execute arbitrary commands via a crafted web page, aka Bug Id 6869752.

CVE-2009-3868: Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x be fore 1.4.2_24 does not properly parse color profiles, which allows remote attackers to gain privileges via a crafted image file, aka Bug Id 6862970.

CVE-2009-3872: Unspecified vulnerability in the JPEG JFIF Decoder in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK a nd JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to gain privileges via a crafted image file, aka Bug Id 6862969.

CVE-2009-3873: The JPEG Image Writer in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, and SDK and JRE 1.4.x before 1.4.2 _24 allows remote attackers to gain privileges via a crafted image file, related to a 'quanization problem,' aka Bug Id 6862968.

New icedtea update to fix :

  - ICC_Profile file existence detection information leak;
    CVE-2009-3728: CVSS v2 Base Score: 5.0

  - BMP parsing DoS with UNC ICC links; CVE-2009-3885: CVSS     v2 Base Score: 5.0

  - resurrected classloaders can still have children;
    CVE-2009-3881: CVSS v2 Base Score: 7.5

  - Numerous static security flaws in Swing; CVE-2009-3882:
    CVSS v2 Base Score: 7.5

  - Mutable statics in Windows PL&F; CVE-2009-3883: CVSS v2     Base Score: 7.5

  - UI logging information leakage; CVE-2009-3880: CVSS v2     Base Score: 5.0

  - GraphicsConfiguration information leak; CVE-2009-3879:
    CVSS v2 Base Score: 7.5

  - zoneinfo file existence information leak; CVE-2009-3884:
    CVSS v2 Base Score: 5.0

  - deprecate MD2 in SSL cert validation; CVE-2009-2409:
    CVSS v2 Base Score: 6.4

  - JPEG Image Writer quantization problem; CVE-2009-3873:
    CVSS v2 Base Score: 9.3

  - MessageDigest.isEqual introduces timing attack     vulnerabilities; CVE-2009-3875: CVSS v2 Base Score: 5.0

  - OpenJDK ASN.1/DER input stream parser denial of service;
    CVE-2009-3876,CVE-2009-3877: CVSS v2 Base Score: 5.0

  - JRE AWT setDifflCM stack overflow; CVE-2009-3869: CVSS     v2 Base Score: 9.3

  - ImageI/O JPEG heap overflow; CVE-2009-3874: CVSS v2 Base     Score: 9.3

  - JRE AWT setBytePixels heap overflow; CVE-2009-3871: CVSS     v2 Base Score: 9.3

Updated java-1.4.2-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 3 Extras, Red Hat Enterprise Linux 4 Extras, and Red Hat Enterprise Linux 5 Supplementary.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

The IBM 1.4.2 SR13-FP3 Java release includes the IBM Java 2 Runtime Environment and the IBM Java 2 Software Development Kit.

This update fixes several vulnerabilities in the IBM Java 2 Runtime Environment and the IBM Java 2 Software Development Kit. These vulnerabilities are summarized on the IBM 'Security alerts' page listed in the References section. (CVE-2009-3867, CVE-2009-3868, CVE-2009-3869, CVE-2009-3871, CVE-2009-3872, CVE-2009-3873, CVE-2009-3874, CVE-2009-3875, CVE-2009-3876, CVE-2009-3877)

All users of java-1.4.2-ibm are advised to upgrade to these updated packages, which contain the IBM 1.4.2 SR13-FP3 Java release. All running instances of IBM Java must be restarted for this update to take effect.

IBM Java 5 was updated to Service Refresh 11. It fixes lots of bugs and security issues.

The timezone update to 1.6.9s (with the latest Fiji change).

  - A vulnerability in the Java Runtime Environment with     decoding DER encoded data might allow a remote client to     cause the JRE to crash, resulting in a denial of service     condition. (CVE-2009-3876 / CVE-2009-3877)

  - A buffer overflow vulnerability in the Java Runtime     Environment audio system might allow an untrusted applet     or Java Web Start application to escalate privileges.
    For example, an untrusted applet might grant itself     permissions to read and write local files, or run local     applications that are accessible to the user running the     untrusted applet. (CVE-2009-3867)

  - A buffer overflow vulnerability in the Java Runtime     Environment with parsing image files might allow an     untrusted applet or Java Web Start application to     escalate privileges. For example, an untrusted applet     might grant itself permissions to read and write local     files, or run local applications that are accessible to     the user running the untrusted applet. (CVE-2009-3868)

  - An integer overflow vulnerability in the Java Runtime     Environment with reading JPEG files might allow an     untrusted applet or Java Web Start application to     escalate privileges. For example, an untrusted applet     might grant itself permissions to read and write local     files, or run local applications that are accessible to     the user running the untrusted applet. (CVE-2009-3872)

  - A buffer overflow vulnerability in the Java Runtime     Environment with processing JPEG files might allow an     untrusted applet or Java Web Start application to     escalate privileges. For example, an untrusted applet     might grant itself permissions to read and write local     files, or run local applications that are accessible to     the user running the untrusted applet. (CVE-2009-3873)

  - A security vulnerability in the Java Runtime Environment     with verifying HMAC digests might allow authentication     to be bypassed. This action can allow a user to forge a     digital signature that would be accepted as valid.
    Applications that validate HMAC-based digital signatures     might be vulnerable to this type of attack.
    (CVE-2009-3875)

  - A buffer overflow vulnerability in the Java Runtime     Environment with processing image files might allow an     untrusted applet or Java Web Start application to     escalate privileges. For example, an untrusted applet     might grant itself permissions to read and write local     files or run local applications that are accessible to     the user running the untrusted applet. (CVE-2009-3869)

  - A buffer overflow vulnerability in the Java Runtime     Environment with processing image files might allow an     untrusted applet or Java Web Start application to     escalate privileges. For example, an untrusted applet     might grant itself permissions to read and write local     files or run local applications that are accessible to     the user running the untrusted applet. (CVE-2009-3871)

  - An integer overflow vulnerability in the Java Runtime     Environment with processing JPEG images might allow an     untrusted applet or Java Web Start application to     escalate privileges. For example, an untrusted applet     might grant itself permissions to read and write local     files or run local applications that are accessible to     the user running the untrusted applet. (CVE-2009-3874)

  - The Java Runtime Environment includes the Java Web Start     technology that uses the Java Web Start ActiveX control     to launch Java Web Start in Internet Explorer. A     security vulnerability in the Active Template Library     (ATL) in various releases of Microsoft Visual Studio,     which is used by the Java Web Start ActiveX control,     might allow the Java Web Start ActiveX control to be     leveraged to run arbitrary code. This might occur as the     result of a user of the Java Runtime Environment viewing     a specially crafted web page that exploits this     vulnerability. (CVE-2009-2493)

Please also see http://www.ibm.com/developerworks/java/jdk/alerts/

IBM Java 6 was updated to Service Refresh 7.

The following security issues were fixed :

  - A vulnerability in the Java Runtime Environment with     decoding DER encoded data might allow a remote client to     cause the JRE to crash, resulting in a denial of service     condition. (CVE-2009-3876 / CVE-2009-3877)

  - A buffer overflow vulnerability in the Java Runtime     Environment audio system might allow an untrusted applet     or Java Web Start application to escalate privileges.
    For example, an untrusted applet might grant itself     permissions to read and write local files, or run local     applications that are accessible to the user running the     untrusted applet. (CVE-2009-3867)

  - A buffer overflow vulnerability in the Java Runtime     Environment with parsing image files might allow an     untrusted applet or Java Web Start application to     escalate privileges. For example, an untrusted applet     might grant itself permissions to read and write local     files, or run local applications that are accessible to     the user running the untrusted applet. (CVE-2009-3868)

  - An integer overflow vulnerability in the Java Runtime     Environment with reading JPEG files might allow an     untrusted applet or Java Web Start application to     escalate privileges. For example, an untrusted applet     might grant itself permissions to read and write local     files, or run local applications that are accessible to     the user running the untrusted applet. (CVE-2009-3872)

  - A buffer overflow vulnerability in the Java Runtime     Environment with processing JPEG files might allow an     untrusted applet or Java Web Start application to     escalate privileges. For example, an untrusted applet     might grant itself permissions to read and write local     files, or run local applications that are accessible to     the user running the untrusted applet. (CVE-2009-3873)

  - A security vulnerability in the Java Runtime Environment     with verifying HMAC digests might allow authentication     to be bypassed. This action can allow a user to forge a     digital signature that would be accepted as valid.
    Applications that validate HMAC-based digital signatures     might be vulnerable to this type of attack.
    (CVE-2009-3875)

  - A command execution vulnerability in the Java Runtime     Environment Deployment Toolkit might be used to run     arbitrary code. This issue might occur as the result of     a user of the Java Runtime Environment viewing a     specially crafted web page that exploits this     vulnerability. (CVE-2009-3865)

  - A buffer overflow vulnerability in the Java Runtime     Environment with processing image files might allow an     untrusted applet or Java Web Start application to     escalate privileges. For example, an untrusted applet     might grant itself permissions to read and write local     files or run local applications that are accessible to     the user running the untrusted applet. (CVE-2009-3869)

  - A buffer overflow vulnerability in the Java Runtime     Environment with processing image files might allow an     untrusted applet or Java Web Start application to     escalate privileges. For example, an untrusted applet     might grant itself permissions to read and write local     files or run local applications that are accessible to     the user running the untrusted applet. (CVE-2009-3871)

  - A security vulnerability in the Java Web Start Installer     might be used to allow an untrusted Java Web Start     application to run as a trusted application and run     arbitrary code. This issue might occur as the result of     a user of the Java Runtime Environment viewing a     specially crafted web page that exploits this     vulnerability. (CVE-2009-3866)

  - An integer overflow vulnerability in the Java Runtime     Environment with processing JPEG images might allow an     untrusted applet or Java Web Start application to     escalate privileges. For example, an untrusted applet     might grant itself permissions to read and write local     files or run local applications that are accessible to     the user running the untrusted applet. (CVE-2009-3874)

  - A vulnerability with verifying HMAC-based XML digital     signatures in the XML Digital Signature implementation     included with the Java Runtime Environment (JRE) might     allow authentication to be bypassed. Applications that     validate HMAC-based XML digital signatures might be     vulnerable to this type of attack. (CVE-2009-0217)

Note: This vulnerability cannot be exploited by an untrusted applet or Java Web Start application.

Updated java-1.6.0-ibm packages that fix several security issues are now available for Red Hat Network Satellite Server 5.3.

This update has been rated as having low security impact by the Red Hat Security Response Team.

This update corrects several security vulnerabilities in the IBM Java Runtime Environment shipped as part of Red Hat Network Satellite Server 5.3. In a typical operating environment, these are of low security risk as the runtime is not used on untrusted applets.

Several flaws were fixed in the IBM Java 2 Runtime Environment.
(CVE-2009-0217, CVE-2009-1093, CVE-2009-1094, CVE-2009-1095, CVE-2009-1096, CVE-2009-1097, CVE-2009-1098, CVE-2009-1099, CVE-2009-1100, CVE-2009-1101, CVE-2009-1103, CVE-2009-1104, CVE-2009-1105, CVE-2009-1106, CVE-2009-1107, CVE-2009-2625, CVE-2009-2670, CVE-2009-2671, CVE-2009-2672, CVE-2009-2673, CVE-2009-2674, CVE-2009-2675, CVE-2009-2676, CVE-2009-3865, CVE-2009-3866, CVE-2009-3867, CVE-2009-3868, CVE-2009-3869, CVE-2009-3871, CVE-2009-3872, CVE-2009-3873, CVE-2009-3874, CVE-2009-3875, CVE-2009-3876, CVE-2009-3877)

Users of Red Hat Network Satellite Server 5.3 are advised to upgrade to these updated java-1.6.0-ibm packages, which resolve these issues.
For this update to take effect, Red Hat Network Satellite Server must be restarted ('/usr/sbin/rhn-satellite restart'), as well as all running instances of IBM Java.

Updated java-1.6.0-openjdk packages that fix several security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

These packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Software Development Kit. The Java Runtime Environment (JRE) contains the software and tools that users need to run applications written using the Java programming language.

An integer overflow flaw and buffer overflow flaws were found in the way the JRE processed image files. An untrusted applet or application could use these flaws to extend its privileges, allowing it to read and write local files, as well as to execute local applications with the privileges of the user running the applet or application.
(CVE-2009-3869, CVE-2009-3871, CVE-2009-3873, CVE-2009-3874)

An information leak was found in the JRE. An untrusted applet or application could use this flaw to extend its privileges, allowing it to read and write local files, as well as to execute local applications with the privileges of the user running the applet or application. (CVE-2009-3881)

It was discovered that the JRE still accepts certificates with MD2 hash signatures, even though MD2 is no longer considered a cryptographically strong algorithm. This could make it easier for an attacker to create a malicious certificate that would be treated as trusted by the JRE. With this update, the JRE disables the use of the MD2 algorithm inside signatures by default. (CVE-2009-2409)

A timing attack flaw was found in the way the JRE processed HMAC digests. This flaw could aid an attacker using forged digital signatures to bypass authentication checks. (CVE-2009-3875)

Two denial of service flaws were found in the JRE. These could be exploited in server-side application scenarios that process DER-encoded (Distinguished Encoding Rules) data. (CVE-2009-3876, CVE-2009-3877)

An information leak was found in the way the JRE handled color profiles. An attacker could use this flaw to discover the existence of files outside of the color profiles directory. (CVE-2009-3728)

A flaw in the JRE with passing arrays to the X11GraphicsDevice API was found. An untrusted applet or application could use this flaw to access and modify the list of supported graphics configurations. This flaw could also lead to sensitive information being leaked to unprivileged code. (CVE-2009-3879)

It was discovered that the JRE passed entire objects to the logging API. This could lead to sensitive information being leaked to either untrusted or lower-privileged code from an attacker-controlled applet which has access to the logging API and is therefore able to manipulate (read and/or call) the passed objects. (CVE-2009-3880)

Potential information leaks were found in various mutable static variables. These could be exploited in application scenarios that execute untrusted scripting code. (CVE-2009-3882, CVE-2009-3883)

An information leak was found in the way the TimeZone.getTimeZone method was handled. This method could load time zone files that are outside of the [JRE_HOME]/lib/zi/ directory, allowing a remote attacker to probe the local file system. (CVE-2009-3884)

Note: The flaws concerning applets in this advisory, CVE-2009-3869, CVE-2009-3871, CVE-2009-3873, CVE-2009-3874, CVE-2009-3879, CVE-2009-3880, CVE-2009-3881 and CVE-2009-3884, can only be triggered in java-1.6.0-openjdk by calling the 'appletviewer' application.

All users of java-1.6.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect.

ID	Name	Product	Family	Published	Updated	Severity
42817	Ubuntu 8.10 / 9.04 / 9.10 : openjdk-6 vulnerabilities (USN-859-1)	Nessus	Ubuntu Local Security Checks	11/16/2009	1/19/2021	critical
42851	openSUSE Security Update : java-1_6_0-sun (java-1_6_0-sun-1541)	Nessus	SuSE Local Security Checks	11/19/2009	1/14/2021	high
42926	openSUSE Security Update : java-1_6_0-openjdk (java-1_6_0-openjdk-1613)	Nessus	SuSE Local Security Checks	11/30/2009	1/14/2021	high
43048	RHEL 3 / 4 / 5 : java-1.4.2-ibm (RHSA-2009:1643)	Nessus	Red Hat Local Security Checks	12/8/2009	1/14/2021	critical
43822	SuSE 10 Security Update : IBM Java 1.5.0 (ZYPP Patch Number 6740)	Nessus	SuSE Local Security Checks	1/8/2010	1/14/2021	high
43872	SuSE 11 Security Update : IBM Java 1.6.0 (SAT Patch Number 1748)	Nessus	SuSE Local Security Checks	1/13/2010	1/14/2021	high
44029	RHEL 4 / 5 : IBM Java Runtime in Satellite Server (RHSA-2010:0043)	Nessus	Red Hat Local Security Checks	1/15/2010	1/14/2021	critical
67075	CentOS 5 : java-1.6.0-openjdk (CESA-2009:1584)	Nessus	CentOS Local Security Checks	6/29/2013	1/4/2021	critical

Detections

Analytics

Plugins Search

critical

high

high

critical

high

high

critical

critical