The version of VMware vCenter Update Manager installed on the remote Windows host is 5.1 prior to Update 3. It is, therefore, affected by multiple vulnerabilities related to the bundled version of Oracle JRE prior to 1.6.0_81.

This Critical Patch Update contains 20 new security fixes for Oracle Java SE. All of these vulnerabilities could have been remotely exploitable without authentication, i.e., could be exploited over a network without the need for a username and password.

According to its self-reported version number, the Puppet Enterprise application installed on the remote host is version 3.3.0. Therefore, it contains a bundled version of Oracle Java that is affected by multiple vulnerabilities.

The remote host is affected by the vulnerability described in GLSA-201502-12 (Oracle JRE/JDK: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Oracle&rsquo;s Java SE       Development Kit and Runtime Environment. Please review the CVE       identifiers referenced below for details.
  Impact :

    A context-dependent attacker may be able to execute arbitrary code,       disclose, update, insert, or delete certain data.
  Workaround :

    There is no known workaround at this time.

The VMware vCenter Server installed on the remote host is version 5.0 prior to Update 3c, 5.1 prior to Update 3, or 5.5 prior to Update 2.
It is, therefore, affected by multiple vulnerabilities in third party libraries :

  - Due to improper certificate validation when connecting     to a CIM server on an ESXi host, an attacker can     perform man-in-the-middle attacks. (CVE-2014-8371)

  - The bundled version of Oracle JRE is prior to 1.6.0_81     and thus is affected by multiple vulnerabilities. Note     that this only affects version 5.1 and 5.0 of vCenter     but is only fixed in 5.1 Update 3.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 8 Update 11, 7 Update 65, 6 Update 81, or 5 Update 71. It is, therefore, affected by security issues in the following components :

  - Deployment
  - Hotspot
  - JavaFX
  - JMX
  - Libraries
  - Security
  - Serviceability
  - Swing

ID	Name	Product	Family	Published	Updated	Severity
79864	VMware vCenter Update Manager Multiple Java Vulnerabilities (VMSA-2014-0012)	Nessus	Windows	12/12/2014	11/15/2018	critical
76998	SuSE 11.3 Security Update : openjdk (SAT Patch Number 9543)	Nessus	SuSE Local Security Checks	8/5/2014	1/19/2021	critical
77282	Puppet Enterprise 3.3.0 Bundled Oracle Java Vulnerabilities	Nessus	CGI abuses	8/20/2014	1/19/2021	critical
81370	GLSA-201502-12 : Oracle JRE/JDK: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2/16/2015	1/11/2021	critical
79865	VMware Security Updates for vCenter Server (VMSA-2014-0012)	Nessus	Misc.	12/12/2014	11/15/2018	critical
76533	Oracle Java SE Multiple Vulnerabilities (July 2014 CPU) (Unix)	Nessus	Misc.	7/16/2014	4/11/2022	critical
76532	Oracle Java SE Multiple Vulnerabilities (July 2014 CPU)	Nessus	Windows	7/16/2014	12/19/2024	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical