Updated java-1.5.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 6 Supplementary.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The IBM 1.5.0 Java release includes the IBM Java 2 Runtime Environment and the IBM Java 2 Software Development Kit.

This update fixes several vulnerabilities in the IBM Java 2 Runtime Environment and the IBM Java 2 Software Development Kit. Detailed vulnerability descriptions are linked from the IBM 'Security alerts' page, listed in the References section. (CVE-2010-1321, CVE-2010-3541, CVE-2010-3548, CVE-2010-3549, CVE-2010-3550, CVE-2010-3551, CVE-2010-3556, CVE-2010-3559, CVE-2010-3562, CVE-2010-3565, CVE-2010-3566, CVE-2010-3568, CVE-2010-3569, CVE-2010-3572, CVE-2010-3573, CVE-2010-3574)

All users of java-1.5.0-ibm are advised to upgrade to these updated packages, containing the IBM 1.5.0 SR12-FP2 Java release. All running instances of IBM Java must be restarted for this update to take effect.

IBM Java 1.4.2 SR13 was updated to FP8 to fix various bugs and security issues.

The following security issues were fixed :

  - The kg_accept_krb5 function in krb5/accept_sec_context.c     in the GSS-API library in MIT Kerberos 5 (aka krb5)     through 1.7.1 and 1.8 before 1.8.2, as used in kadmind     and other applications, does not properly check for     invalid GSS-API tokens, which allows remote     authenticated users to cause a denial of service (NULL     pointer dereference and daemon crash) via an AP-REQ     message in which the authenticator's checksum field is     missing. (CVE-2010-1321)

  - Unspecified vulnerability in the Networking component in     Oracle Java SE and Java for Business 6 Update 21, 5.0     Update 25, 1.4.2_27, and 1.3.1_28 allows remote     attackers to affect confidentiality, integrity, and     availability via unknown vectors. NOTE: the previous     information was obtained from the October 2010 CPU.
    Oracle has not commented on claims from a reliable     downstream vendor that HttpURLConnection does not     properly check for the allowHttpTrace permission, which     allows untrusted code to perform HTTP TRACE requests.
    (CVE-2010-3574)

  - The Java Runtime Environment hangs forever when     converting '2.2250738585072012e-308' to a binary     floating-point number. (CVE-2010-4476)

This update brings IBM Java 5 to Service Release 12 Fixpack 2.

It fixes quite a large number of security problems and other bugs. The security issues are tracked by the following CVE ids :

  - CVE-2010-1321 CVE-2010-3541 CVE-2010-3548 CVE-2010-3549     CVE-2010-3550 CVE-2010-3551 CVE-2010-3556 CVE-2010-3559     CVE-2010-3562 CVE-2010-3565 CVE-2010-3566 CVE-2010-3568     CVE-2010-3569 CVE-2010-3572 CVE-2010-3573 CVE-2010-3574.
    (CVE-2009-3555)

Updated krb5 packages that fix one security issue are now available for Red Hat Enterprise Linux 3, 4, and 5.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Kerberos is a network authentication system which allows clients and servers to authenticate to each other using symmetric encryption and a trusted third party, the Key Distribution Center (KDC).

A NULL pointer dereference flaw was discovered in the MIT Kerberos Generic Security Service Application Program Interface (GSS-API) library. A remote, authenticated attacker could use this flaw to crash any server application using the GSS-API authentication mechanism, by sending a specially crafted GSS-API token with a missing checksum field. (CVE-2010-1321)

Red Hat would like to thank the MIT Kerberos Team for responsibly reporting this issue. Upstream acknowledges Shawn Emery of Oracle as the original reporter.

All krb5 users should upgrade to these updated packages, which contain a backported patch to correct this issue. All running services using the MIT Kerberos libraries must be restarted for the update to take effect.

ID	Name	Product	Family	Published	Updated	Severity
50641	RHEL 6 : java-1.5.0-ibm (RHSA-2010:0873)	Nessus	Red Hat Local Security Checks	11/18/2010	1/14/2021	critical
57203	SuSE 10 Security Update : IBM Java (ZYPP Patch Number 7440)	Nessus	SuSE Local Security Checks	12/13/2011	1/19/2021	critical
50854	SuSE9 Security Update : IBM Java 5 JRE and SDK (YOU Patch Number 12659)	Nessus	SuSE Local Security Checks	12/1/2010	1/14/2021	critical
46665	RHEL 3 / 4 / 5 : krb5 (RHSA-2010:0423)	Nessus	Red Hat Local Security Checks	5/19/2010	1/14/2021	medium
52631	SuSE 11.1 Security Update : IBM Java (SAT Patch Number 4024)	Nessus	SuSE Local Security Checks	3/11/2011	1/19/2021	critical

Detections

Analytics

Plugins Search

critical

critical

critical

medium

critical