Executive Summary

Summary
Title java-1.5.0-bea security update
Informations
Name RHSA-2008:1044 First vendor Publication 2008-12-18
Vendor RedHat Last vendor Modification 2008-12-18
Severity (Vendor) Important Revision 01

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score 10 Attack Range Network
Cvss Impact Score 10 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Problem Description:

java-1.5.0-bea as shipped in Red Hat Enterprise Linux 4 Extras and Red Hat Enterprise Linux 5 Supplementary, contains security flaws and should not be used.

This update has been rated as having important security impact by the Red Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 4 Extras - i386, ia64, x86_64 Red Hat Desktop version 4 Extras - i386, x86_64 Red Hat Enterprise Linux ES version 4 Extras - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 Extras - i386, ia64, x86_64 RHEL Supplementary (v. 5 server) - i386, ia64, x86_64

3. Description:

The BEA WebLogic JRockit JRE and SDK contains BEA WebLogic JRockit Virtual Machine and is certified for the Javaâ„¢ 2 Platform, Standard Edition, v1.5.0.

The java-1.5.0-bea packages are vulnerable to important security flaws and should no longer be used.

A flaw was found in the Java Management Extensions (JMX) management agent. When local monitoring was enabled, remote attackers could use this flaw to perform illegal operations. (CVE-2008-3103)

Several flaws involving the handling of unsigned applets were found. A remote attacker could misuse an unsigned applet in order to connect to services on the host running the applet. (CVE-2008-3104)

Several flaws in the Java API for XML Web Services (JAX-WS) client and the JAX-WS service implementation were found. A remote attacker who could cause malicious XML to be processed by an application could access URLs, or cause a denial of service. (CVE-2008-3105, CVE-2008-3106)

A buffer overflow vulnerability was found in the font processing code. This allowed remote attackers to extend the permissions of an untrusted applet or application, allowing it to read or write local files, as well as to execute local applications accessible to the user running the untrusted application. (CVE-2008-3108)

The vulnerabilities concerning applets listed above can only be triggered in java-1.5.0-bea, by calling the "appletviewer" application.

BEA was acquired by Oracle® during 2008 (the acquisition was completed on April 29, 2008). Consequently, JRockit is now an Oracle offering and these issues are addressed in the current release of Oracle JRockit. Due to a license change by Oracle, however, Red Hat is unable to ship Oracle JRockit.

Users who wish to continue using JRockit should get an update directly from Oracle: http://oracle.com/technology/software/products/jrockit/.

Alternatives to Oracle JRockit include the Java 2 Technology Edition of the IBM® Developer Kit for Linux and the Sun™ Java SE Development Kit (JDK), both of which are available on the Extras or Supplementary channels. For Java 6 users, the new OpenJDK open source JDK will be included in Red Hat Enterprise Linux 5.3 and will be supported by Red Hat.

This update removes the java-1.5.0-bea packages due to their known security vulnerabilities.

4. Solution:

Before applying this update, make sure that all previously-released errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188

5. Package List:

Red Hat Enterprise Linux AS version 4 Extras:

i386: java-1.5.0-bea-uninstall-1.5.0.14-1jpp.5.el4.i686.rpm

ia64: java-1.5.0-bea-uninstall-1.5.0.14-1jpp.5.el4.ia64.rpm

x86_64: java-1.5.0-bea-uninstall-1.5.0.14-1jpp.5.el4.x86_64.rpm

Red Hat Desktop version 4 Extras:

i386: java-1.5.0-bea-uninstall-1.5.0.14-1jpp.5.el4.i686.rpm

x86_64: java-1.5.0-bea-uninstall-1.5.0.14-1jpp.5.el4.x86_64.rpm

Red Hat Enterprise Linux ES version 4 Extras:

i386: java-1.5.0-bea-uninstall-1.5.0.14-1jpp.5.el4.i686.rpm

ia64: java-1.5.0-bea-uninstall-1.5.0.14-1jpp.5.el4.ia64.rpm

x86_64: java-1.5.0-bea-uninstall-1.5.0.14-1jpp.5.el4.x86_64.rpm

Red Hat Enterprise Linux WS version 4 Extras:

i386: java-1.5.0-bea-uninstall-1.5.0.14-1jpp.5.el4.i686.rpm

ia64: java-1.5.0-bea-uninstall-1.5.0.14-1jpp.5.el4.ia64.rpm

x86_64: java-1.5.0-bea-uninstall-1.5.0.14-1jpp.5.el4.x86_64.rpm

RHEL Supplementary (v. 5 server):

i386: java-1.5.0-bea-uninstall-1.5.0.14-1jpp.5.el5.i686.rpm

ia64: java-1.5.0-bea-uninstall-1.5.0.14-1jpp.5.el5.ia64.rpm

x86_64: java-1.5.0-bea-uninstall-1.5.0.14-1jpp.5.el5.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package

Original Source

Url : https://rhn.redhat.com/errata/RHSA-2008-1044.html

CWE : Common Weakness Enumeration

% Id Name
80 % CWE-264 Permissions, Privileges, and Access Controls
20 % CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:10866
 
Oval ID: oval:org.mitre.oval:def:10866
Title: Unspecified vulnerability in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier and JDK and JRE 5.0 Update 15 and earlier allows remote attackers to access URLs via unknown vectors involving processing of XML data by an untrusted (1) application or (2) applet, a different vulnerability than CVE-2008-3105.
Description: Unspecified vulnerability in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier and JDK and JRE 5.0 Update 15 and earlier allows remote attackers to access URLs via unknown vectors involving processing of XML data by an untrusted (1) application or (2) applet, a different vulnerability than CVE-2008-3105.
Family: unix Class: vulnerability
Reference(s): CVE-2008-3106
 Version: 3
Platform(s): Red Hat Enterprise Linux Extras 5
 Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:10920
 
Oval ID: oval:org.mitre.oval:def:10920
Title: Unspecified vulnerability in the Java Management Extensions (JMX) management agent in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier and JDK and JRE 5.0 Update 15 and earlier, when local monitoring is enabled, allows remote attackers to "perform unauthorized operations" via unspecified vectors.
Description: Unspecified vulnerability in the Java Management Extensions (JMX) management agent in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier and JDK and JRE 5.0 Update 15 and earlier, when local monitoring is enabled, allows remote attackers to "perform unauthorized operations" via unspecified vectors.
Family: unix Class: vulnerability
Reference(s): CVE-2008-3103
 Version: 3
Platform(s): Red Hat Enterprise Linux Extras 4
Red Hat Enterprise Linux Extras 5
 Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:11274
 
Oval ID: oval:org.mitre.oval:def:11274
Title: Unspecified vulnerability in the JAX-WS client and service in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier allows remote attackers to access URLs or cause a denial of service via unknown vectors involving "processing of XML data" by a trusted application.
Description: Unspecified vulnerability in the JAX-WS client and service in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier allows remote attackers to access URLs or cause a denial of service via unknown vectors involving "processing of XML data" by a trusted application.
Family: unix Class: vulnerability
Reference(s): CVE-2008-3105
 Version: 3
Platform(s): Red Hat Enterprise Linux Extras 5
 Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22657
 
Oval ID: oval:org.mitre.oval:def:22657
Title: ELSA-2008:0891: java-1.5.0-ibm security update (Moderate)
Description: Unspecified vulnerability in the Java Management Extensions (JMX) management agent in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier and JDK and JRE 5.0 Update 15 and earlier, when local monitoring is enabled, allows remote attackers to "perform unauthorized operations" via unspecified vectors.
Family: unix Class: patch
Reference(s): ELSA-2008:0891-01
CVE-2008-3103
 Version: 6
Platform(s): Oracle Linux 5
 Product(s): java-1.5.0-ibm
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:9565
 
Oval ID: oval:org.mitre.oval:def:9565
Title: Multiple unspecified vulnerabilities in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, SDK and JRE 1.4.x before 1.4.2_18, and SDK and JRE 1.3.x before 1.3.1_23 allow remote attackers to violate the security model for an applet's outbound connections by connecting to localhost services running on the machine that loaded the applet.
Description: Multiple unspecified vulnerabilities in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, SDK and JRE 1.4.x before 1.4.2_18, and SDK and JRE 1.3.x before 1.3.1_23 allow remote attackers to violate the security model for an applet's outbound connections by connecting to localhost services running on the machine that loaded the applet.
Family: unix Class: vulnerability
Reference(s): CVE-2008-3104
 Version: 3
Platform(s): Red Hat Enterprise Linux Extras 4
Red Hat Enterprise Linux Extras 5
 Product(s):
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 359
Application 395
Application 54

OpenVAS Exploits

Date Description
2010-05-28 Name : Java for Mac OS X 10.5 Update 2
File : nvt/macosx_java_for_10_5_upd_2.nasl
2009-10-13 Name : SLES10: Security update for IBM Java
File : nvt/sles10_java-1_4_2-ibm2.nasl
2009-10-13 Name : SLES10: Security update for Java 1.4.2
File : nvt/sles10_java-1_4_2-sun0.nasl
2009-10-13 Name : SLES10: Security update for IBM Java 5
File : nvt/sles10_java-1_5_0-ibm.nasl
2009-10-13 Name : SLES10: Security update for IBM Java 1.5
File : nvt/sles10_java-1_5_0-ibm3.nasl
2009-10-10 Name : SLES9: Security update for Java2
File : nvt/sles9p5033740.nasl
2009-10-10 Name : SLES9: Security update for IBM Java5 JRE and IBMJava5 SDK
File : nvt/sles9p5034680.nasl
2009-10-10 Name : SLES9: Security update for IBM Java 5
File : nvt/sles9p5035420.nasl
2009-10-10 Name : SLES9: Security update for IBMJava5 JRE and IBMJava5 SDK
File : nvt/sles9p5037140.nasl
2009-10-10 Name : SLES9: Security update for IBM Java2 JRE and SDK
File : nvt/sles9p5039700.nasl
2009-05-20 Name : SuSE Security Summary SUSE-SR:2009:010
File : nvt/suse_sr_2009_010.nasl
2009-01-23 Name : SuSE Update for Sun Java security update SUSE-SA:2008:042
File : nvt/gb_suse_2008_042.nasl
2009-01-23 Name : SuSE Update for java-1_5_0-ibm,IBMJava5 SUSE-SA:2008:045
File : nvt/gb_suse_2008_045.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
46967 Sun Java JDK / JRE Java Management Extensions (JMX) Management Agent Remote P...
46966 Sun Java JDK / JRE Applet Outbound Connection Security Model Bypass
46965 Sun Java JDK / JRE XML Data Handling Unspecified Arbitrary URL Access
46964 Sun Java JDK / JRE JAX-WS XML Data Processing Arbitrary URL Resource Access
46962 Sun Java JDK / JRE Font Processing Unspecified Overflow

Information Assurance Vulnerability Management (IAVM)

Date Description
2012-08-16 IAVM : 2012-A-0136 - Multiple Vulnerabilities in Juniper Network Management Products
Severity : Category I - VMSKEY : V0033662

Nessus® Vulnerability Scanner

Date Description
2013-09-13 Name : The remote host is affected by multiple vulnerabilities.
File : juniper_nsm_psn_2012_08_689.nasl - Type : ACT_GATHER_INFO
2013-02-22 Name : The remote Unix host has an application that is affected by multiple vulnerab...
File : sun_java_jre_6_7_unix.nasl - Type : ACT_GATHER_INFO
2013-02-22 Name : The remote Unix host has an application that is affected by multiple vulnerab...
File : sun_java_jre_5_16_unix.nasl - Type : ACT_GATHER_INFO
2013-02-22 Name : The remote Unix host has an application that is affected by multiple vulnerab...
File : sun_java_j2se_4_2_18_unix.nasl - Type : ACT_GATHER_INFO
2013-01-24 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2008-0594.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20080714_java__jdk_1_5_0__on_SL4_x.nasl - Type : ACT_GATHER_INFO
2010-01-10 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2008-0636.nasl - Type : ACT_GATHER_INFO
2010-01-10 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2009-0466.nasl - Type : ACT_GATHER_INFO
2009-11-18 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200911-02.nasl - Type : ACT_GATHER_INFO
2009-09-24 Name : The remote SuSE 9 host is missing a security-related patch.
File : suse9_12206.nasl - Type : ACT_GATHER_INFO
2009-09-24 Name : The remote SuSE 9 host is missing a security-related patch.
File : suse9_12265.nasl - Type : ACT_GATHER_INFO
2009-09-24 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_java-1_4_2-ibm-5846.nasl - Type : ACT_GATHER_INFO
2009-09-24 Name : The remote SuSE 9 host is missing a security-related patch.
File : suse9_12313.nasl - Type : ACT_GATHER_INFO
2009-08-24 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2008-0595.nasl - Type : ACT_GATHER_INFO
2009-08-24 Name : The remote Red Hat host is missing a security update.
File : redhat-RHSA-2008-1045.nasl - Type : ACT_GATHER_INFO
2009-08-24 Name : The remote Red Hat host is missing a security update.
File : redhat-RHSA-2008-1044.nasl - Type : ACT_GATHER_INFO
2009-08-24 Name : The remote Red Hat host is missing a security update.
File : redhat-RHSA-2008-1043.nasl - Type : ACT_GATHER_INFO
2009-08-24 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2008-0955.nasl - Type : ACT_GATHER_INFO
2009-08-24 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2008-0906.nasl - Type : ACT_GATHER_INFO
2009-08-24 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2008-0891.nasl - Type : ACT_GATHER_INFO
2009-08-24 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2008-0790.nasl - Type : ACT_GATHER_INFO
2009-07-27 Name : The remote VMware ESXi / ESX host is missing one or more security-related pat...
File : vmware_VMSA-2008-0016.nasl - Type : ACT_GATHER_INFO
2009-07-21 Name : The remote openSUSE host is missing a security update.
File : suse_11_0_java-1_5_0-sun-080715.nasl - Type : ACT_GATHER_INFO
2009-07-21 Name : The remote openSUSE host is missing a security update.
File : suse_11_0_java-1_6_0-sun-080715.nasl - Type : ACT_GATHER_INFO
2008-10-24 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_java-1_5_0-ibm-5662.nasl - Type : ACT_GATHER_INFO
2008-09-25 Name : The remote host is affected by multiple vulnerabilities.
File : macosx_java_rel7.nasl - Type : ACT_GATHER_INFO
2008-09-25 Name : The remote host is affected by multiple vulnerabilities.
File : macosx_java_10_5_update2.nasl - Type : ACT_GATHER_INFO
2008-09-14 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_java-1_5_0-ibm-5591.nasl - Type : ACT_GATHER_INFO
2008-09-03 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_java-1_5_0-ibm-5557.nasl - Type : ACT_GATHER_INFO
2008-08-24 Name : The remote openSUSE host is missing a security update.
File : suse_java-1_4_2-sun-5430.nasl - Type : ACT_GATHER_INFO
2008-08-24 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_java-1_4_2-sun-5431.nasl - Type : ACT_GATHER_INFO
2008-08-24 Name : The remote openSUSE host is missing a security update.
File : suse_java-1_5_0-sun-5434.nasl - Type : ACT_GATHER_INFO
2008-08-24 Name : The remote openSUSE host is missing a security update.
File : suse_java-1_6_0-sun-5435.nasl - Type : ACT_GATHER_INFO
2008-07-15 Name : The remote Windows host has an application that is affected by multiple vulne...
File : sun_java_jre_6_7.nasl - Type : ACT_GATHER_INFO
2008-07-15 Name : The remote Windows host has an application that is affected by multiple vulne...
File : sun_java_jre_5_16.nasl - Type : ACT_GATHER_INFO
2008-07-15 Name : The remote Windows host has an application that is affected by multiple vulne...
File : sun_java_j2se_4_2_18.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2014-02-17 11:52:08
  • Multiple Updates