RHEL 2.1 : IBMJava2 (RHSA-2008:0133)

This script is Copyright (C) 2008-2014 Tenable Network Security, Inc.


Synopsis :

The remote Red Hat host is missing one or more security updates.

Description :

IBMJava2-JRE and IBMJava2-SDK packages that correct several security
issues are available for Red Hat Enterprise Linux 2.1.

IBM's 1.3.1 Java release includes the IBM Java 2 Runtime Environment
and the IBM Java 2 Software Development Kit.

A buffer overflow was found in the Java Runtime Environment
image-handling code. An untrusted applet or application could use this
flaw to elevate its privileges and potentially execute arbitrary code
as the user running the java virtual machine. (CVE-2007-3004)

An unspecified vulnerability was discovered in the Java Runtime
Environment. An untrusted applet or application could cause the java
virtual machine to become unresponsive. (CVE-2007-3005)

A flaw was found in the applet class loader. An untrusted applet could
use this flaw to circumvent network access restrictions, possibly
connecting to services hosted on the machine that executed the applet.
(CVE-2007-3922)

These updated packages also add the following enhancements :

* Time zone information has been updated to the latest available
information, 2007h.

* Accessibility support in AWT can now be disabled through a system
property, java.assistive. To support this change, permission to read
this property must be added to
/opt/IBMJava2-131/jre/lib/security/java.policy. Users of IBMJava2 who
have modified this file should add this following line to the grant
section :

permission java.util.PropertyPermission 'java.assistive', 'read'


All users of IBMJava2 should upgrade to these updated packages, which
contain IBM's 1.3.1 SR11 Java release, which resolves these issues.

See also :

https://www.redhat.com/security/data/cve/CVE-2007-3004.html
https://www.redhat.com/security/data/cve/CVE-2007-3005.html
https://www.redhat.com/security/data/cve/CVE-2007-3922.html
http://www-128.ibm.com/developerworks/java/jdk/alerts/
http://rhn.redhat.com/errata/RHSA-2008-0133.html

Solution :

Update the affected IBMJava2-JRE and / or IBMJava2-SDK packages.

Risk factor :

Medium / CVSS Base Score : 6.8
(CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)

Family: Red Hat Local Security Checks

Nessus Plugin ID: 33247 ()

Bugtraq ID:

CVE ID: CVE-2007-2788
CVE-2007-2789
CVE-2007-3922