Executive Summary
Summary | |
---|---|
Title | OpenJDK 7 vulnerabilities |
Informations | |||
---|---|---|---|
Name | USN-3194-1 | First vendor Publication | 2017-02-09 |
Vendor | Ubuntu | Last vendor Modification | 2017-02-09 |
Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P) | |||
---|---|---|---|
Cvss Base Score | 6.8 | Attack Range | Network |
Cvss Impact Score | 6.4 | Attack Complexity | Medium |
Cvss Expoit Score | 8.6 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 14.04 LTS Summary: Several security issues were fixed in OpenJDK 7. Software Description: - openjdk-7: Open Source Java implementation Details: Karthik Bhargavan and Gaetan Leurent discovered that the DES and Triple DES ciphers were vulnerable to birthday attacks. A remote attacker could possibly use this flaw to obtain clear text data from long encrypted sessions. This update moves those algorithms to the legacy algorithm set and causes them to be used only if no non-legacy algorithms can be negotiated. (CVE-2016-2183) It was discovered that OpenJDK accepted ECSDA signatures using non-canonical DER encoding. An attacker could use this to modify or expose sensitive data. (CVE-2016-5546) It was discovered that OpenJDK did not properly verify object identifier (OID) length when reading Distinguished Encoding Rules (DER) records, as used in x.509 certificates and elsewhere. An attacker could use this to cause a denial of service (memory consumption). (CVE-2016-5547) It was discovered that covert timing channel vulnerabilities existed in the DSA implementations in OpenJDK. A remote attacker could use this to expose sensitive information. (CVE-2016-5548) It was discovered that the URLStreamHandler class in OpenJDK did not properly parse user information from a URL. A remote attacker could use this to expose sensitive information. (CVE-2016-5552) It was discovered that the URLClassLoader class in OpenJDK did not properly check access control context when downloading class files. A remote attacker could use this to expose sensitive information. (CVE-2017-3231) It was discovered that the Remote Method Invocation (RMI) implementation in OpenJDK performed deserialization of untrusted inputs. A remote attacker could use this to execute arbitrary code. (CVE-2017-3241) It was discovered that the Java Authentication and Authorization Service (JAAS) component of OpenJDK did not properly perform user search LDAP queries. An attacker could use a specially constructed LDAP entry to expose or modify sensitive information. (CVE-2017-3252) It was discovered that the PNGImageReader class in OpenJDK did not properly handle iTXt and zTXt chunks. An attacker could use this to cause a denial of service (memory consumption). (CVE-2017-3253) It was discovered that integer overflows existed in the SocketInputStream and SocketOutputStream classes of OpenJDK. An attacker could use this to expose sensitive information. (CVE-2017-3261) It was discovered that the atomic field updaters in the java.util.concurrent.atomic package in OpenJDK did not properly restrict access to protected field members. An attacker could use this to specially craft a Java application or applet that could bypass Java sandbox restrictions. (CVE-2017-3272) It was discovered that a vulnerability existed in the class construction implementation in OpenJDK. An attacker could use this to specially craft a Java application or applet that could bypass Java sandbox restrictions. (CVE-2017-3289) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 14.04 LTS: This update uses a new upstream release, which includes additional bug fixes. After a standard system update you need to restart any Java applications or applets to make all the necessary changes. References: Package Information: |
Original Source
Url : http://www.ubuntu.com/usn/USN-3194-1 |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
67 % | CWE-200 | Information Exposure |
33 % | CWE-20 | Improper Input Validation |
CPE : Common Platform Enumeration
Snort® IPS/IDS
Date | Description |
---|---|
2016-10-18 | SSH weak blowfish cipher suite use attempt RuleID : 40190 - Revision : 2 - Type : POLICY-OTHER |
2016-10-18 | SSH weak 3DES cipher suite use attempt RuleID : 40189 - Revision : 2 - Type : POLICY-OTHER |
2016-10-18 | SSL weak 3DES cipher suite use attempt RuleID : 40188 - Revision : 2 - Type : POLICY-OTHER |
2016-10-18 | SSL weak 3DES cipher suite use attempt RuleID : 40187 - Revision : 2 - Type : POLICY-OTHER |
2016-10-18 | SSL weak 3DES cipher suite use attempt RuleID : 40186 - Revision : 2 - Type : POLICY-OTHER |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2018-08-17 | Name : The remote PhotonOS host is missing multiple security updates. File : PhotonOS_PHSA-2017-0016.nasl - Type : ACT_GATHER_INFO |
2018-07-16 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2018-2123.nasl - Type : ACT_GATHER_INFO |
2018-02-28 | Name : The version of Arista Networks EOS running on the remote device is affected b... File : arista_eos_sa0024.nasl - Type : ACT_GATHER_INFO |
2018-02-28 | Name : The version of Arista Networks EOS running on the remote device is affected b... File : arista_eos_sa0024_4_17.nasl - Type : ACT_GATHER_INFO |
2017-11-20 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2017-3240.nasl - Type : ACT_GATHER_INFO |
2017-11-08 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2017-3113.nasl - Type : ACT_GATHER_INFO |
2017-09-20 | Name : The remote VMware ESXi 6.0 host is affected by multiple vulnerabilities. File : vmware_esxi_6_0_build_5485776_remote.nasl - Type : ACT_GATHER_INFO |
2017-09-15 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2017-2709.nasl - Type : ACT_GATHER_INFO |
2017-09-15 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2017-2710.nasl - Type : ACT_GATHER_INFO |
2017-09-13 | Name : The version of Java SDK installed on the remote AIX host is affected by multi... File : aix_java_jan2017_advisory.nasl - Type : ACT_GATHER_INFO |
2017-07-20 | Name : A web application installed on the remote host is affected by multiple vulner... File : oracle_e-business_cpu_jul_2017.nasl - Type : ACT_GATHER_INFO |
2017-07-20 | Name : The remote database server is affected by multiple vulnerabilities. File : oracle_rdbms_cpu_jul_2017.nasl - Type : ACT_GATHER_INFO |
2017-07-13 | Name : The remote Virtuozzo host is missing a security update. File : Virtuozzo_VZLSA-2017-0180.nasl - Type : ACT_GATHER_INFO |
2017-07-13 | Name : The remote Virtuozzo host is missing a security update. File : Virtuozzo_VZLSA-2017-0269.nasl - Type : ACT_GATHER_INFO |
2017-07-06 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201707-01.nasl - Type : ACT_GATHER_INFO |
2017-06-26 | Name : The Tenable SecurityCenter application on the remote host contains an OpenSSL... File : securitycenter_openssl_1_0_1u.nasl - Type : ACT_GATHER_INFO |
2017-05-31 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2017-1444-1.nasl - Type : ACT_GATHER_INFO |
2017-05-30 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2017-629.nasl - Type : ACT_GATHER_INFO |
2017-05-25 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2017-1400-1.nasl - Type : ACT_GATHER_INFO |
2017-05-24 | Name : A database server installed on the remote host is affected by multiple vulner... File : ibm_informix_server_swg22002897.nasl - Type : ACT_GATHER_INFO |
2017-05-10 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2017-1216.nasl - Type : ACT_GATHER_INFO |
2017-05-02 | Name : An application installed on the remote host is affected by multiple vulnerabi... File : oracle_secure_global_desktop_apr_2017_cpu.nasl - Type : ACT_GATHER_INFO |
2017-05-01 | Name : The remote EulerOS host is missing a security update. File : EulerOS_SA-2016-1090.nasl - Type : ACT_GATHER_INFO |
2017-05-01 | Name : The remote EulerOS host is missing multiple security updates. File : EulerOS_SA-2017-1015.nasl - Type : ACT_GATHER_INFO |
2017-05-01 | Name : The remote EulerOS host is missing multiple security updates. File : EulerOS_SA-2017-1016.nasl - Type : ACT_GATHER_INFO |
2017-05-01 | Name : The remote EulerOS host is missing multiple security updates. File : EulerOS_SA-2017-1027.nasl - Type : ACT_GATHER_INFO |
2017-05-01 | Name : The remote EulerOS host is missing multiple security updates. File : EulerOS_SA-2017-1028.nasl - Type : ACT_GATHER_INFO |
2017-04-28 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-3270-1.nasl - Type : ACT_GATHER_INFO |
2017-04-21 | Name : An enterprise management application installed on the remote host is affected... File : oracle_enterprise_manager_apr_2017_cpu.nasl - Type : ACT_GATHER_INFO |
2017-03-30 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2017-0839-1.nasl - Type : ACT_GATHER_INFO |
2017-03-20 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2017-0716-1.nasl - Type : ACT_GATHER_INFO |
2017-03-20 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2017-0719-1.nasl - Type : ACT_GATHER_INFO |
2017-03-20 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2017-0720-1.nasl - Type : ACT_GATHER_INFO |
2017-03-09 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2017-0462.nasl - Type : ACT_GATHER_INFO |
2017-03-02 | Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL13167034.nasl - Type : ACT_GATHER_INFO |
2017-03-01 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2017-0336.nasl - Type : ACT_GATHER_INFO |
2017-03-01 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2017-0337.nasl - Type : ACT_GATHER_INFO |
2017-03-01 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2017-0338.nasl - Type : ACT_GATHER_INFO |
2017-02-21 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2017-278.nasl - Type : ACT_GATHER_INFO |
2017-02-21 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2017-0490-1.nasl - Type : ACT_GATHER_INFO |
2017-02-16 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-3198-1.nasl - Type : ACT_GATHER_INFO |
2017-02-15 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2017-797.nasl - Type : ACT_GATHER_INFO |
2017-02-15 | Name : An application running on the remote host is affected by multiple vulnerabili... File : nessus_tns_2016_16.nasl - Type : ACT_GATHER_INFO |
2017-02-15 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2017-0460-1.nasl - Type : ACT_GATHER_INFO |
2017-02-14 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2017-0269.nasl - Type : ACT_GATHER_INFO |
2017-02-14 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2017-0269.nasl - Type : ACT_GATHER_INFO |
2017-02-13 | Name : The remote Debian host is missing a security update. File : debian_DLA-821.nasl - Type : ACT_GATHER_INFO |
2017-02-13 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2017-0269.nasl - Type : ACT_GATHER_INFO |
2017-02-13 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20170213_java_1_7_0_openjdk_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
2017-02-10 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2017-0263.nasl - Type : ACT_GATHER_INFO |
2017-02-09 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-3782.nasl - Type : ACT_GATHER_INFO |
2017-02-09 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-3194-1.nasl - Type : ACT_GATHER_INFO |
2017-02-06 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2017-201.nasl - Type : ACT_GATHER_INFO |
2017-02-01 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2017-0346-1.nasl - Type : ACT_GATHER_INFO |
2017-01-27 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2017-791.nasl - Type : ACT_GATHER_INFO |
2017-01-26 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201701-65.nasl - Type : ACT_GATHER_INFO |
2017-01-26 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-3179-1.nasl - Type : ACT_GATHER_INFO |
2017-01-25 | Name : A web application running on the remote host is affected by multiple vulnerab... File : mysql_enterprise_monitor_3_1_5_7958.nasl - Type : ACT_GATHER_INFO |
2017-01-25 | Name : A web application running on the remote host is affected by multiple vulnerab... File : mysql_enterprise_monitor_3_2_5_1141.nasl - Type : ACT_GATHER_INFO |
2017-01-25 | Name : A web application running on the remote host is affected by multiple vulnerab... File : mysql_enterprise_monitor_3_3_1_1112.nasl - Type : ACT_GATHER_INFO |
2017-01-25 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20170120_java_1_8_0_openjdk_on_SL6_x.nasl - Type : ACT_GATHER_INFO |
2017-01-23 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2017-0180.nasl - Type : ACT_GATHER_INFO |
2017-01-23 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2017-0180.nasl - Type : ACT_GATHER_INFO |
2017-01-23 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2017-0180.nasl - Type : ACT_GATHER_INFO |
2017-01-20 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2017-0175.nasl - Type : ACT_GATHER_INFO |
2017-01-20 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2017-0176.nasl - Type : ACT_GATHER_INFO |
2017-01-20 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2017-0177.nasl - Type : ACT_GATHER_INFO |
2017-01-19 | Name : A programming platform installed on the remote Windows host is affected by mu... File : oracle_jrockit_cpu_jan_2017.nasl - Type : ACT_GATHER_INFO |
2017-01-19 | Name : The remote Windows host contains a programming platform that is affected by m... File : oracle_java_cpu_jan_2017.nasl - Type : ACT_GATHER_INFO |
2017-01-19 | Name : The remote Unix host contains a programming platform that is affected by mult... File : oracle_java_cpu_jan_2017_unix.nasl - Type : ACT_GATHER_INFO |
2017-01-06 | Name : A vulnerability scanner installed on the remote host is affected by multiple ... File : pvs_5_2_0.nasl - Type : ACT_GATHER_INFO |
2017-01-05 | Name : The remote device is missing a vendor-supplied security patch. File : juniper_jsa10759.nasl - Type : ACT_GATHER_INFO |
2016-12-29 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2016-363-01.nasl - Type : ACT_GATHER_INFO |
2016-12-27 | Name : An application running on the remote web server is affected by multiple vulne... File : ibm_bigfix_remote_control_9_1_3.nasl - Type : ACT_GATHER_INFO |
2016-12-07 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201612-16.nasl - Type : ACT_GATHER_INFO |
2016-11-22 | Name : The remote AIX host has a version of OpenSSL installed that is affected by mu... File : aix_openssl_advisory21.nasl - Type : ACT_GATHER_INFO |
2016-11-01 | Name : The remote service supports the use of 64-bit block ciphers. File : ssl_64bitblock_supported_ciphers.nasl - Type : ACT_GATHER_INFO |
2016-10-21 | Name : The remote database server is affected by multiple vulnerabilities. File : mysql_5_6_34_rpm.nasl - Type : ACT_GATHER_INFO |
2016-10-21 | Name : The remote database server is affected by multiple vulnerabilities. File : mysql_5_7_16_rpm.nasl - Type : ACT_GATHER_INFO |
2016-10-20 | Name : The remote database server is affected by multiple vulnerabilities. File : mysql_5_6_34.nasl - Type : ACT_GATHER_INFO |
2016-10-20 | Name : The remote database server is affected by multiple vulnerabilities. File : mysql_5_7_16.nasl - Type : ACT_GATHER_INFO |
2016-10-17 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2016-1189.nasl - Type : ACT_GATHER_INFO |
2016-10-17 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2016-3627.nasl - Type : ACT_GATHER_INFO |
2016-10-17 | Name : The remote OracleVM host is missing a security update. File : oraclevm_OVMSA-2016-0141.nasl - Type : ACT_GATHER_INFO |
2016-10-13 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2016-755.nasl - Type : ACT_GATHER_INFO |
2016-10-12 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2016-1172.nasl - Type : ACT_GATHER_INFO |
2016-10-07 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2016-2468-1.nasl - Type : ACT_GATHER_INFO |
2016-10-06 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2016-2458-1.nasl - Type : ACT_GATHER_INFO |
2016-09-30 | Name : The remote service is affected by multiple vulnerabilities. File : openssl_1_0_1u.nasl - Type : ACT_GATHER_INFO |
2016-09-30 | Name : The remote service is affected by multiple vulnerabilities. File : openssl_1_0_2i.nasl - Type : ACT_GATHER_INFO |
2016-09-29 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20160927_openssl_on_SL6_x.nasl - Type : ACT_GATHER_INFO |
2016-09-28 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2016-1940.nasl - Type : ACT_GATHER_INFO |
2016-09-28 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2016-1130.nasl - Type : ACT_GATHER_INFO |
2016-09-28 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2016-1134.nasl - Type : ACT_GATHER_INFO |
2016-09-28 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2016-1940.nasl - Type : ACT_GATHER_INFO |
2016-09-28 | Name : The remote OracleVM host is missing a security update. File : oraclevm_OVMSA-2016-0135.nasl - Type : ACT_GATHER_INFO |
2016-09-28 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2016-1940.nasl - Type : ACT_GATHER_INFO |
2016-09-28 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2016-2394-1.nasl - Type : ACT_GATHER_INFO |
2016-09-27 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2016-2387-1.nasl - Type : ACT_GATHER_INFO |
2016-09-26 | Name : The remote Debian host is missing a security update. File : debian_DLA-637.nasl - Type : ACT_GATHER_INFO |
2016-09-26 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-3087-2.nasl - Type : ACT_GATHER_INFO |
2016-09-23 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2016-266-01.nasl - Type : ACT_GATHER_INFO |
2016-09-23 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-3673.nasl - Type : ACT_GATHER_INFO |
2016-09-23 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_43eaa65680bc11e6bf52b499baebfeaf.nasl - Type : ACT_GATHER_INFO |
2016-09-23 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-3087-1.nasl - Type : ACT_GATHER_INFO |
2016-08-25 | Name : The service running on the remote host uses a weak encryption block cipher by... File : openssl_1_1_0.nasl - Type : ACT_GATHER_INFO |
2016-07-25 | Name : The remote web server is affected by multiple vulnerabilities. File : oracle_http_server_cpu_jul_2016.nasl - Type : ACT_GATHER_INFO |
2015-10-23 | Name : The remote web server is affected by multiple vulnerabilities. File : oracle_http_server_cpu_oct_2015.nasl - Type : ACT_GATHER_INFO |
2015-01-27 | Name : The remote web server is affected by multiple vulnerabilities. File : oracle_http_server_cpu_jan_2015.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2017-02-10 13:25:00 |
|
2017-02-09 13:23:37 |
|