APPLE-SA-2008-09-24

SUSE-SA:2008:018

29239

29273

29582

29858

30676

30780

32018

GLSA-200804-28

233323

http://support.apple.com/kb/HT3178

http://support.apple.com/kb/HT3179

GLSA-200804-20

GLSA-200806-11

RHSA-2008:0186

RHSA-2008:0267

1019549

TA08-066A

http://www.vmware.com/security/advisories/VMSA-2008-0010.html

ADV-2008-0770

ADV-2008-1856

javawebstart-application-priv-escalation(41029)

javawebstart-unspecified-priv-escalation(41136)

oval:org.mitre.oval:def:10167

Updated java-1.6.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 5 Supplementary.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

IBM's 1.6.0 Java release includes the IBM Java 2 Runtime Environment, and the IBM Java 2 Software Development Kit.

A flaw was found in the Java XSLT processing classes. An untrusted application or applet could cause a denial of service, or execute arbitrary code with the permissions of the user running the JRE.
(CVE-2008-1187)

Several buffer overflow flaws were found in Java Web Start (JWS). An untrusted JNLP application could access local files, or execute local applications accessible to the user running the JRE. (CVE-2008-1188, CVE-2008-1189, CVE-2008-1190, CVE-2008-1191, CVE-2008-1196)

A flaw was found in the Java plug-in. A remote attacker could bypass the same origin policy, executing arbitrary code with the permissions of the user running the JRE. (CVE-2008-1192)

A flaw was found in the JRE image parsing libraries. An untrusted application or applet could cause a denial of service, or possibly execute arbitrary code with the permissions of the user running the JRE. (CVE-2008-1193)

A flaw was found in the JRE color management library. An untrusted application or applet could trigger a denial of service (JVM crash).
(CVE-2008-1194)

The JRE allowed untrusted JavaScript code to create local network connections by the use of Java APIs. A remote attacker could use these flaws to access local network services. (CVE-2008-1195)

All users of java-1.6.0-ibm are advised to upgrade to these updated packages, that contain IBM's 1.6.0 SR1 Java release, which resolves these issues.

Flaws in the JRE allowed an untrusted application or applet to elevate its privileges. This could be exploited by a remote attacker to access local files or execute local applications accessible to the user running the JRE (CVE-2008-1185, CVE-2008-1186)

A flaw was found in the Java XSLT processing classes. An untrusted application or applet could cause a denial of service, or execute arbitrary code with the permissions of the user running the JRE.
(CVE-2008-1187)

Several buffer overflow flaws were found in Java Web Start (JWS). An untrusted JNLP application could access local files or execute local applications accessible to the user running the JRE. (CVE-2008-1188, CVE-2008-1189, CVE-2008-1190, CVE-2008-1191, CVE-2008-1196)

A flaw was found in the Java Plug-in. A remote attacker could bypass the same origin policy, executing arbitrary code with the permissions of the user running the JRE. (CVE-2008-1192)

A flaw was found in the JRE image parsing libraries. An untrusted application or applet could cause a denial of service, or possible execute arbitrary code with the permissions of the user running the JRE. (CVE-2008-1193)

A flaw was found in the JRE color management library. An untrusted application or applet could trigger a denial of service (JVM crash).
(CVE-2008-1194)

The JRE allowed untrusted JavaScript code to create local network connections by the use of Java APIs. A remote attacker could use these flaws to access local network services. (CVE-2008-1195)

A vulnerability was found in the Java Management Extensions (JMX) management agent, when local monitoring is enabled. This allowed remote attackers to perform illegal operations. (CVE-2008-3103)

Multiple vulnerabilities with unsigned applets were reported. A remote attacker could misuse an unsigned applet to connect to localhost services running on the host running the applet. (CVE-2008-3104)

A Java Runtime Environment (JRE) vulnerability could be triggered by an untrusted application or applet. A remote attacker could grant an untrusted applet extended privileges such as reading and writing local files, or executing local programs. (CVE-2008-3107)

Several buffer overflow vulnerabilities in Java Web Start were reported. These vulnerabilities may allow an untrusted Java Web Start application to elevate its privileges and thereby grant itself permission to read and/or write local files, as well as to execute local applications accessible to the user running the untrusted application. (CVE-2008-3111)

Two file processing vulnerabilities in Java Web Start were found. A remote attacker, by means of an untrusted Java Web Start application, was able to create or delete arbitrary files with the permissions of the user running the untrusted application. (CVE-2008-3112, CVE-2008-3113)

A vulnerability in Java Web Start when processing untrusted applications was reported. An attacker was able to acquire sensitive information, such as the cache location. (CVE-2008-3114)

Updated java-1.5.0-sun packages that correct several security issues are now available for Red Hat Enterprise Linux 4 Extras and 5 Supplementary.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

The Java Runtime Environment (JRE) contains the software and tools that users need to run applets and applications written using the Java programming language.

Flaws in the JRE allowed an untrusted application or applet to elevate its privileges. This could be exploited by a remote attacker to access local files or execute local applications accessible to the user running the JRE (CVE-2008-1185, CVE-2008-1186)

A flaw was found in the Java XSLT processing classes. An untrusted application or applet could cause a denial of service, or execute arbitrary code with the permissions of the user running the JRE.
(CVE-2008-1187)

Several buffer overflow flaws were found in Java Web Start (JWS). An untrusted JNLP application could access local files or execute local applications accessible to the user running the JRE. (CVE-2008-1188, CVE-2008-1189, CVE-2008-1190, CVE-2008-1191, CVE-2008-1196)

A flaw was found in the Java Plug-in. A remote attacker could bypass the same origin policy, executing arbitrary code with the permissions of the user running the JRE. (CVE-2008-1192)

A flaw was found in the JRE image parsing libraries. An untrusted application or applet could cause a denial of service, or possible execute arbitrary code with the permissions of the user running the JRE. (CVE-2008-1193)

A flaw was found in the JRE color management library. An untrusted application or applet could trigger a denial of service (JVM crash).
(CVE-2008-1194)

The JRE allowed untrusted JavaScript code to create local network connections by the use of Java APIs. A remote attacker could use these flaws to access local network services. (CVE-2008-1195)

This update also fixes an issue where the Java Plug-in is not available for browser use after successful installation.

Users of java-1.5.0-sun should upgrade to these updated packages, which correct these issues.

ESX patches and updates for VirtualCenter fix the following application vulnerabilities.

 a. Tomcat Server Security Update

The ESX patches and the updates for VirtualCenter update the Tomcat Server package to version 5.5.26, which addresses multiple security issues that existed in earlier releases of Tomcat Server.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2007-5333, CVE-2007-5342, CVE-2007-5461, CVE-2007-6286 to the security issues fixed in Tomcat 5.5.26.

 b. JRE Security Update

The ESX patches and the updates for VirtualCenter update the JRE package to version 1.5.0_15, which addresses multiple security issues that existed in earlier releases of JRE.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2008-1185, CVE-2008-1186, CVE-2008-1187, CVE-2008-1188, CVE-2008-1189, CVE-2008-1190, CVE-2008-1191, CVE-2008-1192, CVE-2008-1193, CVE-2008-1194, CVE-2008-1195, CVE-2008-1196, CVE-2008-0657, CVE-2007-5689, CVE-2007-5232, CVE-2007-5236, CVE-2007-5237, CVE-2007-5238, CVE-2007-5239, CVE-2007-5240, CVE-2007-5274 to the security issues fixed in JRE 1.5.0_12, JRE 1.5.0_13, JRE 1.5.0_14, JRE 1.5.0_15.

The remote Mac OS X 10.4 host is running a version of Java for Mac OS X that is older than release 7.

The remote version of this software contains several security vulnerabilities which may allow a rogue java applet to execute arbitrary code on the remote host.

To exploit these flaws, an attacker would need to lure an attacker into executing a rogue Java applet.

The remote Mac OS X 10.5 host is running a version of Java for Mac OS X that is missing update 2.

The remote version of this software contains several security vulnerabilities that may allow a rogue Java applet to execute arbitrary code on the remote host.

To exploit these flaws, an attacker would need to lure an attacker into executing a rogue Java applet.

The remote host is affected by the vulnerability described in GLSA-200804-20 (Sun JDK/JRE: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Sun Java:
    Daniel Soeder discovered that a long codebase attribute string in a     JNLP file will overflow a stack variable when launched by Java WebStart     (CVE-2007-3655).
    Multiple vulnerabilities (CVE-2007-2435, CVE-2007-2788,     CVE-2007-2789) that were previously reported as GLSA 200705-23 and GLSA     200706-08 also affect 1.4 and 1.6 SLOTs, which was not mentioned in the     initial revision of said GLSAs.
    The Zero Day Initiative, TippingPoint and John Heasman reported     multiple buffer overflows and unspecified vulnerabilities in Java Web     Start (CVE-2008-1188, CVE-2008-1189, CVE-2008-1190,     CVE-2008-1191).
    Hisashi Kojima of Fujitsu and JPCERT/CC reported a security issue     when performing XSLT transformations (CVE-2008-1187).
    CERT/CC reported a Stack-based buffer overflow in Java Web Start     when using JNLP files (CVE-2008-1196).
    Azul Systems reported an unspecified vulnerability that allows     applets to escalate their privileges (CVE-2007-5689).
    Billy Rios, Dan Boneh, Collin Jackson, Adam Barth, Andrew Bortz,     Weidong Shao, and David Byrne discovered multiple instances where Java     applets or JavaScript programs run within browsers do not pin DNS     hostnames to a single IP address, allowing for DNS rebinding attacks     (CVE-2007-5232, CVE-2007-5273, CVE-2007-5274).
    Peter Csepely reported that Java Web Start does not properly     enforce access restrictions for untrusted applications (CVE-2007-5237,     CVE-2007-5238).
    Java Web Start does not properly enforce access restrictions for     untrusted Java applications and applets, when handling drag-and-drop     operations (CVE-2007-5239).
    Giorgio Maone discovered that warnings for untrusted code can be     hidden under applications' windows (CVE-2007-5240).
    Fujitsu reported two security issues where security restrictions of     web applets and applications were not properly enforced (CVE-2008-1185,     CVE-2008-1186).
    John Heasman of NGSSoftware discovered that the Java Plug-in does     not properly enforce the same origin policy (CVE-2008-1192).
    Chris Evans of the Google Security Team discovered multiple     unspecified vulnerabilities within the Java Runtime Environment Image     Parsing Library (CVE-2008-1193, CVE-2008-1194).
    Gregory Fleischer reported that web content fetched via the 'jar:'     protocol was not subject to network access restrictions     (CVE-2008-1195).
    Chris Evans and Johannes Henkel of the Google Security Team     reported that the XML parsing code retrieves external entities even     when that feature is disabled (CVE-2008-0628).
    Multiple unspecified vulnerabilities might allow for escalation of     privileges (CVE-2008-0657).
  Impact :

    A remote attacker could entice a user to run a specially crafted applet     on a website or start an application in Java Web Start to execute     arbitrary code outside of the Java sandbox and of the Java security     restrictions with the privileges of the user running Java. The attacker     could also obtain sensitive information, create, modify, rename and     read local files, execute local applications, establish connections in     the local network, bypass the same origin policy, and cause a Denial of     Service via multiple vectors.
  Workaround :

    There is no known workaround at this time.

Sun Java was updated to 1.6.0u5 to fix following security vulnerabilities :

  - CVE-2008-1158: Unspecified vulnerability in the Virtual     Machine for Sun Java Runtime Environment (JRE) and JDK 6     Update 4 and earlier, 5.0 Update 14 and earlier, and     SDK/JRE 1.4.2_16 and earlier allows remote attackers     should gain privileges via an untrusted application or     applet, a different issue than CVE-2008-1186.

  - CVE-2008-1186: Unspecified vulnerability in the Virtual     Machine for Sun Java Runtime Environment (JRE) and JDK     5.0 Update 13 and earlier, and SDK/JRE 1.4.2_16 and     earlier, allows remote attackers to gain privileges via     an untrusted application or applet, a different issue     than CVE-2008-1185.

  - CVE-2008-1187: Unspecified vulnerability in Sun Java     Runtime Environment (JRE) and JDK 6 Update 4 and     earlier, 5.0 Update 14 and earlier, and SDK/JRE 1.4.2_16     and earlier allows remote attackers to cause a denial of     service (JRE crash) and possibly execute arbitrary code     via unknown vectors related to XSLT transforms.

  - CVE-2008-1189: Buffer overflow in Java Web Start in Sun     JDK and JRE 6 Update 4 and earlier, 5.0 Update 14 and     earlier, and SDK/JRE 1.4.2_16 and earlier allows remote     attackers to execute arbitrary code via unknown vectors,     a different issue than CVE-2008-1188.

  - CVE-2008-1190: Unspecified vulnerability in Java Web     Start in Sun JDK and JRE 6 Update 4 and earlier, 5.0     Update 14 and earlier, and SDK/JRE 1.4.2_16 and earlier     allows remote attackers to gain privileges via an     untrusted application, a different issue than     CVE-2008-1191.

  - CVE-2008-1192: Unspecified vulnerability in the Java     Plug-in for Sun JDK and JRE 6 Update 4 and earlier, and     5.0 Update 14 and earlier; and SDK and JRE 1.4.2_16 and     earlier, and 1.3.1_21 and earlier; allows remote     attackers to bypass the same origin policy and 'execute     local applications' via unknown vectors.

  - CVE-2008-1195: Unspecified vulnerability in Sun JDK and     Java Runtime Environment (JRE) 6 Update 4 and earlier     and 5.0 Update 14 and earlier; and SDK and JRE 1.4.2_16     and earlier; allows remote attackers to access arbitrary     network services on the local host via unspecified     vectors related to JavaScript and Java APIs.

  - CVE-2008-1196: Stack-based buffer overflow in Java Web     Start (javaws.exe) in Sun JDK and JRE 6 Update 4 and     earlier and 5.0 Update 14 and earlier; and SDK and JRE     1.4.2_16 and earlier; allows remote attackers to execute     arbitrary code via a crafted JNLP file.

Sun Java was updated to 1.5.0u15 to fix following security vulnerabilities :

  - CVE-2008-1158: Unspecified vulnerability in the Virtual     Machine for Sun Java Runtime Environment (JRE) and JDK 6     Update 4 and earlier, 5.0 Update 14 and earlier, and     SDK/JRE 1.4.2_16 and earlier allows remote attackers     should gain privileges via an untrusted application or     applet, a different issue than CVE-2008-1186.

  - CVE-2008-1186: Unspecified vulnerability in the Virtual     Machine for Sun Java Runtime Environment (JRE) and JDK     5.0 Update 13 and earlier, and SDK/JRE 1.4.2_16 and     earlier, allows remote attackers to gain privileges via     an untrusted application or applet, a different issue     than CVE-2008-1185.

  - CVE-2008-1187: Unspecified vulnerability in Sun Java     Runtime Environment (JRE) and JDK 6 Update 4 and     earlier, 5.0 Update 14 and earlier, and SDK/JRE 1.4.2_16     and earlier allows remote attackers to cause a denial of     service (JRE crash) and possibly execute arbitrary code     via unknown vectors related to XSLT transforms.

  - CVE-2008-1189: Buffer overflow in Java Web Start in Sun     JDK and JRE 6 Update 4 and earlier, 5.0 Update 14 and     earlier, and SDK/JRE 1.4.2_16 and earlier allows remote     attackers to execute arbitrary code via unknown vectors,     a different issue than CVE-2008-1188.

  - CVE-2008-1190: Unspecified vulnerability in Java Web     Start in Sun JDK and JRE 6 Update 4 and earlier, 5.0     Update 14 and earlier, and SDK/JRE 1.4.2_16 and earlier     allows remote attackers to gain privileges via an     untrusted application, a different issue than     CVE-2008-1191.

  - CVE-2008-1192: Unspecified vulnerability in the Java     Plug-in for Sun JDK and JRE 6 Update 4 and earlier, and     5.0 Update 14 and earlier; and SDK and JRE 1.4.2_16 and     earlier, and 1.3.1_21 and earlier; allows remote     attackers to bypass the same origin policy and 'execute     local applications' via unknown vectors.

  - CVE-2008-1195: Unspecified vulnerability in Sun JDK and     Java Runtime Environment (JRE) 6 Update 4 and earlier     and 5.0 Update 14 and earlier; and SDK and JRE 1.4.2_16     and earlier; allows remote attackers to access arbitrary     network services on the local host via unspecified     vectors related to JavaScript and Java APIs.

  - CVE-2008-1196: Stack-based buffer overflow in Java Web     Start (javaws.exe) in Sun JDK and JRE 6 Update 4 and     earlier and 5.0 Update 14 and earlier; and SDK and JRE     1.4.2_16 and earlier; allows remote attackers to execute     arbitrary code via a crafted JNLP file.

Sun Java was updated to 1.4.2u17 to fix following security vulnerabilities :

  - Unspecified vulnerability in the Virtual Machine for Sun     Java Runtime Environment (JRE) and JDK 6 Update 4 and     earlier, 5.0 Update 14 and earlier, and SDK/JRE 1.4.2_16     and earlier allows remote attackers should gain     privileges via an untrusted application or applet, a     different issue than CVE-2008-1186. (CVE-2008-1158)

  - Unspecified vulnerability in the Virtual Machine for Sun     Java Runtime Environment (JRE) and JDK 5.0 Update 13 and     earlier, and SDK/JRE 1.4.2_16 and earlier, allows remote     attackers to gain privileges via an untrusted     application or applet, a different issue than     CVE-2008-1185. (CVE-2008-1186)

  - Unspecified vulnerability in Sun Java Runtime     Environment (JRE) and JDK 6 Update 4 and earlier, 5.0     Update 14 and earlier, and SDK/JRE 1.4.2_16 and earlier     allows remote attackers to cause a denial of service     (JRE crash) and possibly execute arbitrary code via     unknown vectors related to XSLT transforms.
    (CVE-2008-1187)

  - Buffer overflow in Java Web Start in Sun JDK and JRE 6     Update 4 and earlier, 5.0 Update 14 and earlier, and     SDK/JRE 1.4.2_16 and earlier allows remote attackers to     execute arbitrary code via unknown vectors, a different     issue than CVE-2008-1188. (CVE-2008-1189)

  - Unspecified vulnerability in Java Web Start in Sun JDK     and JRE 6 Update 4 and earlier, 5.0 Update 14 and     earlier, and SDK/JRE 1.4.2_16 and earlier allows remote     attackers to gain privileges via an untrusted     application, a different issue than CVE-2008-1191.
    (CVE-2008-1190)

  - Unspecified vulnerability in the Java Plug-in for Sun     JDK and JRE 6 Update 4 and earlier, and 5.0 Update 14     and earlier; and SDK and JRE 1.4.2_16 and earlier, and     1.3.1_21 and earlier; allows remote attackers to bypass     the same origin policy and 'execute local applications'     via unknown vectors. (CVE-2008-1192)

  - Unspecified vulnerability in Sun JDK and Java Runtime     Environment (JRE) 6 Update 4 and earlier and 5.0 Update     14 and earlier; and SDK and JRE 1.4.2_16 and earlier;
    allows remote attackers to access arbitrary network     services on the local host via unspecified vectors     related to JavaScript and Java APIs. (CVE-2008-1195)

  - Stack-based buffer overflow in Java Web Start     (javaws.exe) in Sun JDK and JRE 6 Update 4 and earlier     and 5.0 Update 14 and earlier; and SDK and JRE 1.4.2_16     and earlier; allows remote attackers to execute     arbitrary code via a crafted JNLP file. (CVE-2008-1196)

Sun Java was updated to 1.4.2u17 to fix following security vulnerabilities :

  - CVE-2008-1158: Unspecified vulnerability in the Virtual     Machine for Sun Java Runtime Environment (JRE) and JDK 6     Update 4 and earlier, 5.0 Update 14 and earlier, and     SDK/JRE 1.4.2_16 and earlier allows remote attackers     should gain privileges via an untrusted application or     applet, a different issue than CVE-2008-1186.

  - CVE-2008-1186: Unspecified vulnerability in the Virtual     Machine for Sun Java Runtime Environment (JRE) and JDK     5.0 Update 13 and earlier, and SDK/JRE 1.4.2_16 and     earlier, allows remote attackers to gain privileges via     an untrusted application or applet, a different issue     than CVE-2008-1185.

  - CVE-2008-1187: Unspecified vulnerability in Sun Java     Runtime Environment (JRE) and JDK 6 Update 4 and     earlier, 5.0 Update 14 and earlier, and SDK/JRE 1.4.2_16     and earlier allows remote attackers to cause a denial of     service (JRE crash) and possibly execute arbitrary code     via unknown vectors related to XSLT transforms.

  - CVE-2008-1189: Buffer overflow in Java Web Start in Sun     JDK and JRE 6 Update 4 and earlier, 5.0 Update 14 and     earlier, and SDK/JRE 1.4.2_16 and earlier allows remote     attackers to execute arbitrary code via unknown vectors,     a different issue than CVE-2008-1188.

  - CVE-2008-1190: Unspecified vulnerability in Java Web     Start in Sun JDK and JRE 6 Update 4 and earlier, 5.0     Update 14 and earlier, and SDK/JRE 1.4.2_16 and earlier     allows remote attackers to gain privileges via an     untrusted application, a different issue than     CVE-2008-1191.

  - CVE-2008-1192: Unspecified vulnerability in the Java     Plug-in for Sun JDK and JRE 6 Update 4 and earlier, and     5.0 Update 14 and earlier; and SDK and JRE 1.4.2_16 and     earlier, and 1.3.1_21 and earlier; allows remote     attackers to bypass the same origin policy and 'execute     local applications' via unknown vectors.

  - CVE-2008-1195: Unspecified vulnerability in Sun JDK and     Java Runtime Environment (JRE) 6 Update 4 and earlier     and 5.0 Update 14 and earlier; and SDK and JRE 1.4.2_16     and earlier; allows remote attackers to access arbitrary     network services on the local host via unspecified     vectors related to JavaScript and Java APIs.

  - CVE-2008-1196: Stack-based buffer overflow in Java Web     Start (javaws.exe) in Sun JDK and JRE 6 Update 4 and     earlier and 5.0 Update 14 and earlier; and SDK and JRE     1.4.2_16 and earlier; allows remote attackers to execute     arbitrary code via a crafted JNLP file.

ID	Name	Product	Family	Severity
63854	RHEL 5 : java-1.6.0-ibm (RHSA-2008:0267)	Nessus	Red Hat Local Security Checks	high
60440	Scientific Linux Security Update : java (jdk 1.5.0) on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	critical
40717	RHEL 4 / 5 : java-1.5.0-sun (RHSA-2008:0186)	Nessus	Red Hat Local Security Checks	high
40379	VMSA-2008-0010 : Updated Tomcat and Java JRE packages for VMware ESX 3.5 and VirtualCenter	Nessus	VMware ESX Local Security Checks	critical
34291	Mac OS X : Java for Mac OS X 10.4 Release 7	Nessus	MacOS X Local Security Checks	high
34290	Mac OS X : Java for Mac OS X 10.5 Update 2	Nessus	MacOS X Local Security Checks	high
32013	GLSA-200804-20 : Sun JDK/JRE: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
31774	openSUSE 10 Security Update : java-1_6_0-sun (java-1_6_0-sun-5132)	Nessus	SuSE Local Security Checks	high
31773	openSUSE 10 Security Update : java-1_5_0-sun (java-1_5_0-sun-5133)	Nessus	SuSE Local Security Checks	high
31772	SuSE 10 Security Update : Sun Java (ZYPP Patch Number 5131)	Nessus	SuSE Local Security Checks	high
31771	openSUSE 10 Security Update : java-1_4_2-sun (java-1_4_2-sun-5130)	Nessus	SuSE Local Security Checks	high

CVE-2008-1191

Description

References

Details

Risk Information

CVSS v2.0

Vulnerable Software

Configuration 1

Tenable Plugins