Ubuntu Security Notice (C) 2010-2013 Canonical, Inc. / NASL script (C) 2010-2013 Tenable Network Security, Inc.
The remote Ubuntu host is missing one or more security-related patches.
Marsh Ray and Steve Dispensa discovered a flaw in the TLS and SSLv3
protocols. If an attacker could perform a man in the middle attack at
the start of a TLS connection, the attacker could inject arbitrary
content at the beginning of the user's session. (CVE-2009-3555)
It was discovered that Loader-constraint table, Policy/PolicyFile,
Inflater/Deflater, drag/drop access, and deserialization did not
correctly handle certain sensitive objects. If a user were tricked
into running a specially crafted applet, private information could be
leaked to a remote attacker, leading to a loss of privacy.
(CVE-2010-0082, CVE-2010-0084, CVE-2010-0085, CVE-2010-0088,
It was discovered that AtomicReferenceArray, System.arraycopy,
InetAddress, and HashAttributeSet did not correctly handle certain
situations. If a remote attacker could trigger specific error
conditions, a Java application could crash, leading to a denial of
service. (CVE-2010-0092, CVE-2010-0093, CVE-2010-0095, CVE-2010-0845)
It was discovered that Pack200, CMM readMabCurveData, ImagingLib, and
the AWT library did not correctly check buffer lengths. If a user or
automated system were tricked into handling specially crafted JAR
files or images, a remote attacker could crash the Java application or
possibly gain user privileges (CVE-2010-0837, CVE-2010-0838,
It was discovered that applets did not correctly handle certain trust
chains. If a user were tricked into running a specially crafted
applet, a remote attacker could possibly run untrusted code with user
Update the affected packages.
Risk factor :
High / CVSS Base Score : 7.5
CVSS Temporal Score : 5.9
Public Exploit Available : true
Family: Ubuntu Local Security Checks
Nessus Plugin ID: 45474 ()
CVE ID: CVE-2009-3555