RHEL 4 / 5 : java-1.5.0-sun (RHSA-2008:0595)

This script is Copyright (C) 2009-2014 Tenable Network Security, Inc.


Synopsis :

The remote Red Hat host is missing one or more security updates.

Description :

Updated java-1.5.0-sun packages that correct several security issues
are now available for Red Hat Enterprise Linux 4 Extras and 5
Supplementary.

This update has been rated as having critical security impact by the
Red Hat Security Response Team.

The Java Runtime Environment (JRE) contains the software and tools
that users need to run applets and applications written using the Java
programming language.

A vulnerability was found in the Java Management Extensions (JMX)
management agent, when local monitoring is enabled. This allowed
remote attackers to perform illegal operations. (CVE-2008-3103)

Multiple vulnerabilities with unsigned applets were reported. A remote
attacker could misuse an unsigned applet to connect to localhost
services running on the host running the applet. (CVE-2008-3104)

A Java Runtime Environment (JRE) vulnerability could be triggered by
an untrusted application or applet. A remote attacker could grant an
untrusted applet extended privileges such as reading and writing local
files, or executing local programs. (CVE-2008-3107)

Several buffer overflow vulnerabilities in Java Web Start were
reported. These vulnerabilities may allow an untrusted Java Web Start
application to elevate its privileges and thereby grant itself
permission to read and/or write local files, as well as to execute
local applications accessible to the user running the untrusted
application. (CVE-2008-3111)

Two file processing vulnerabilities in Java Web Start were found. A
remote attacker, by means of an untrusted Java Web Start application,
was able to create or delete arbitrary files with the permissions of
the user running the untrusted application. (CVE-2008-3112,
CVE-2008-3113)

A vulnerability in Java Web Start when processing untrusted
applications was reported. An attacker was able to acquire sensitive
information, such as the cache location. (CVE-2008-3114)

Users of java-1.5.0-sun should upgrade to these updated packages,
which correct these issues.

See also :

https://www.redhat.com/security/data/cve/CVE-2008-3103.html
https://www.redhat.com/security/data/cve/CVE-2008-3104.html
https://www.redhat.com/security/data/cve/CVE-2008-3107.html
https://www.redhat.com/security/data/cve/CVE-2008-3111.html
https://www.redhat.com/security/data/cve/CVE-2008-3112.html
https://www.redhat.com/security/data/cve/CVE-2008-3113.html
https://www.redhat.com/security/data/cve/CVE-2008-3114.html
http://rhn.redhat.com/errata/RHSA-2008-0595.html

Solution :

Update the affected packages.

Risk factor :

Critical / CVSS Base Score : 10.0
(CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
Public Exploit Available : true

Family: Red Hat Local Security Checks

Nessus Plugin ID: 40723 ()

Bugtraq ID:

CVE ID: CVE-2008-3103
CVE-2008-3104
CVE-2008-3107
CVE-2008-3111
CVE-2008-3112
CVE-2008-3113
CVE-2008-3114