The Java Update functionality in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22 and JDK and JRE 6 before Update 17, when a non-English version of Windows is used, does not retrieve available new JRE versions, which allows remote attackers to leverage vulnerabilities in older releases of this software, aka Bug Id 6869694.

The remote VMware ESX host is missing a security-related patch. It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in the bundled version of the Java Runtime Environment (JRE).

The version of Sun Java Runtime Environment (JRE) installed on the remote host is earlier than 6 Update 17 / 5.0 Update 22 / 1.4.2_24 / 1.3.1_27.  Such versions are potentially affected by the following security issues :

  - The Java update mechanism on non-English versions does     not update the JRE when a new version is available.
    (269868)

  - A command execution vulnerability exists in the Java     runtime environment deployment toolkit. (269869)

  - An issue in the Java web start installer may be     leveraged to allow an untrusted Java web start     application to run as a trusted application. (269870)

  - Multiple buffer and integer overflow vulnerabilities     exist. (270474)

  - A security vulnerability in the JRE with verifying HMAC     digests may allow authentication to be bypassed.
    (270475)

  - Two vulnerabilities in the JRE with decoding DER encoded     data and parsing HTTP headers may separately allow a     remote client to cause the JRE on the server to run out     of memory, resulting in a denial of service. (270476)

  - A directory traversal vulnerability in the     ICC_Profile.getInstance method allows a remote attacker     to determine the existence of local International Color     Consortium (ICC) profile files. (Bug #6631533)

  - A denial of service attack is possible via a BMP file     containing a link to a UNC share pathname for an     International Color Consortium (ICC) profile file.
    (Bug #6632445)

  - Resurrected classloaders can still have children,     which could allow a remote attacker to gain     privileges via unspecified vectors (Bug #6636650)

  - The Abstract Window Toolkit (AWT) does not properly     restrict the objects that may be sent to loggers, which     allows attackers to obtain sensitive information via     vectors related to the implementation of Component,     KeyboardFocusManager, and DefaultKeyboardFocusManager.
    (Bug #6664512)

  - An unspecified vulnerability in TrueType font parsing     functionality may lead to a denial of service. (Bug     #6815780)

  - The failure to clone arrays returned by the     getConfigurations function could lead to multiple,     unspecified vulnerabilities in the X11 and     Win32GraphicsDevice subsystems. (Bug #6822057)

  - The TimeZone.getTimeZone method can be used by a remote     attacker to determine the existence of local files via     its handling of zoneinfo (aka tz) files. (Bug #6824265)

  - Java Web Start does not properly handle the interaction     between a signed JAR file and a JNLP application or     applet. (Bug #6870531)

a. Java JRE Security Update

  JRE update to version 1.5.0_22, which addresses multiple security   issues that existed in earlier releases of JRE.

  The Common Vulnerabilities and Exposures project (cve.mitre.org) has   assigned the following names to the security issues fixed in   JRE 1.5.0_18: CVE-2009-1093, CVE-2009-1094, CVE-2009-1095,   CVE-2009-1096, CVE-2009-1097, CVE-2009-1098, CVE-2009-1099,   CVE-2009-1100, CVE-2009-1101, CVE-2009-1102, CVE-2009-1103,   CVE-2009-1104, CVE-2009-1105, CVE-2009-1106, and CVE-2009-1107.

  The Common Vulnerabilities and Exposures project (cve.mitre.org) has   assigned the following names to the security issues fixed in   JRE 1.5.0_20: CVE-2009-2625, CVE-2009-2670, CVE-2009-2671,   CVE-2009-2672, CVE-2009-2673, CVE-2009-2675, CVE-2009-2676,   CVE-2009-2716, CVE-2009-2718, CVE-2009-2719, CVE-2009-2720,   CVE-2009-2721, CVE-2009-2722, CVE-2009-2723, CVE-2009-2724.

  The Common Vulnerabilities and Exposures project (cve.mitre.org) has   assigned the following names to the security issues fixed in   JRE 1.5.0_22: CVE-2009-3728, CVE-2009-3729, CVE-2009-3864,   CVE-2009-3865, CVE-2009-3866, CVE-2009-3867, CVE-2009-3868,   CVE-2009-3869, CVE-2009-3871, CVE-2009-3872, CVE-2009-3873,   CVE-2009-3874, CVE-2009-3875, CVE-2009-3876, CVE-2009-3877,   CVE-2009-3879, CVE-2009-3880, CVE-2009-3881, CVE-2009-3882,   CVE-2009-3883, CVE-2009-3884, CVE-2009-3886, CVE-2009-3885.

The Sun Java 6 SDK/JRE was updated to u17 update fixing bugs and various security issues :

  - The Java Web Start Installer in Sun Java SE in JDK and     JRE 6 before Update 17 does not properly use security     model permissions when removing installer extensions,     which allows remote attackers to execute arbitrary code     by modifying a certain JNLP file to have a URL field     that poi nts to an unintended trusted application, aka     Bug Id 6872824. (CVE-2009-3866)

  - Stack-based buffer overflow in the     HsbParser.getSoundBank function in Sun Java SE in JDK     and JRE 5.0 before Update 22, JDK and JRE 6 before     Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK     and JRE 1.4.x before 1.4.2_24 allows remote attackers to     execute arbitrary code via a long file: URL in an     argument, aka Bug Id 6854303. (CVE-2009-3867)

  - Stack-based buffer overflow in the setDiffICM function     in the Abstract Window Toolkit (AWT) in Java Runtime     Environment (JRE) in Sun Java SE in JDK and JRE 5.0     before Update 22, JDK and JRE 6 before Update 17, SDK     and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x     before 1.4.2_ 24 allows remote attackers to execute     arbitrary code via a crafted argument, aka Bug Id     6872357. (CVE-2009-3869)

  - Heap-based buffer overflow in the setBytePixels function     in the Abstract Window Toolkit (AWT) in Java Runtime     Environment (JRE) in Sun Java SE in JDK and JRE 5.0     before Update 22, JDK and JRE 6 before Update 17, SDK     and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x     before 1.4. 2_24 allows remote attackers to execute     arbitrary code via crafted arguments, aka Bug Id     6872358. (CVE-2009-3871)

  - Integer overflow in the JPEGImageReader implementation     in the ImageI/O component in Sun Java SE in JDK and JRE     5.0 before Update 22, JDK and JRE 6 before Update 17,     and SDK and JRE 1.4.x before 1.4.2_24 allows remote     attackers to execute arbitrary code via large subsample     dimensi ons in a JPEG file that triggers a heap-based     buffer overflow, aka Bug Id 6874643. (CVE-2009-3874)

  - The MessageDigest.isEqual function in Java Runtime     Environment (JRE) in Sun Java SE in JDK and JRE 5.0     before Update 22, JDK and JRE 6 befor e Update 17, SDK     and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x     before 1.4.2_24 allows remote attackers to spoof     HMAC-based digital si gnatures, and possibly bypass     authentication, via unspecified vectors related to     'timing attack vulnerabilities,' aka Bug Id 6863503.
    (CVE-2009-3875)

  - Unspecified vulnerability in Sun Java SE in JDK and JRE     5.0 before Update 22, JDK and JRE 6 before Update 17,     SDK and JRE 1.3.x before 1.3.1 _27, and SDK and JRE     1.4.x before 1.4.2_24 allows remote attackers to cause a     denial of service (memory consumption) via crafted DER     encoded data, which is not properly decoded by the ASN.1     DER input stream parser, aka Bug Id 6864911.
    (CVE-2009-3876)

  - Unspecified vulnerability in Sun Java SE in JDK and JRE     5.0 before Update 22, JDK and JRE 6 before Update 17,     SDK and JRE 1.3.x before 1.3.1 _27, and SDK and JRE     1.4.x before 1.4.2_24 allows remote attackers to cause a     denial of service (memory consumption) via crafted HTTP     header s, which are not properly parsed by the ASN.1 DER     input stream parser, aka Bug Id 6864911. (CVE-2009-3877)

  - The Java Update functionality in Java Runtime     Environment (JRE) in Sun Java SE in JDK and JRE 5.0     before Update 22 and JDK and JRE 6 before Update 17,     when a non-English version of Windows is used, does not     retrieve available new JRE versions, which allows remote     attackers to lev erage vulnerabilities in older releases     of this software, aka Bug Id 6869694. (CVE-2009-3864)

  - The launch method in the Deployment Toolkit plugin in     Java Runtime Environment (JRE) in Sun Java SE in JDK and     JRE 6 before Update 17 allows remote attackers to     execute arbitrary commands via a crafted web page, aka     Bug Id 6869752. (CVE-2009-3865)

  - Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and     JRE 6 before Update 17, SDK and JRE 1.3.x before     1.3.1_27, and SDK and JRE 1.4.x be fore 1.4.2_24 does     not properly parse color profiles, which allows remote     attackers to gain privileges via a crafted image file,     aka Bug Id 6862970. (CVE-2009-3868)

  - Unspecified vulnerability in the JPEG JFIF Decoder in     Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and     JRE 6 before Update 17, SDK a nd JRE 1.3.x before     1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows     remote attackers to gain privileges via a crafted image     file, aka Bug Id 6862969. (CVE-2009-3872)

  - The JPEG Image Writer in Sun Java SE in JDK and JRE 5.0     before Update 22, JDK and JRE 6 before Update 17, and     SDK and JRE 1.4.x before 1.4.2 _24 allows remote     attackers to gain privileges via a crafted image file,     related to a 'quanization problem,' aka Bug Id 6862968.
    (CVE-2009-3873)

The Sun Java 6 SDK/JRE was updated to u17 update fixing bugs and various security issues :

CVE-2009-3866:The Java Web Start Installer in Sun Java SE in JDK and JRE 6 before Update 17 does not properly use security model permissions when removing installer extensions, which allows remote attackers to execute arbitrary code by modifying a certain JNLP file to have a URL field that poi nts to an unintended trusted application, aka Bug Id 6872824.

CVE-2009-3867: Stack-based buffer overflow in the HsbParser.getSoundBank function in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via a long file: URL in an argument, aka Bug Id 6854303.

CVE-2009-3869: Stack-based buffer overflow in the setDiffICM function in the Abstract Window Toolkit (AWT) in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_ 24 allows remote attackers to execute arbitrary code via a crafted argument, aka Bug Id 6872357.

CVE-2009-3871: Heap-based buffer overflow in the setBytePixels function in the Abstract Window Toolkit (AWT) in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4. 2_24 allows remote attackers to execute arbitrary code via crafted arguments, aka Bug Id 6872358.

CVE-2009-3874: Integer overflow in the JPEGImageReader implementation in the ImageI/O component in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via large subsample dimensi ons in a JPEG file that triggers a heap-based buffer overflow, aka Bug Id 6874643.

CVE-2009-3875: The MessageDigest.isEqual function in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to spoof HMAC-based digital si gnatures, and possibly bypass authentication, via unspecified vectors related to 'timing attack vulnerabilities,' aka Bug Id 6863503.

CVE-2009-3876: Unspecified vulnerability in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1 _27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to cause a denial of service (memory consumption) via crafted DER encoded data, which is not properly decoded by the ASN.1 DER input stream parser, aka Bug Id 6864911.

CVE-2009-3877: Unspecified vulnerability in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1 _27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to cause a denial of service (memory consumption) via crafted HTTP header s, which are not properly parsed by the ASN.1 DER input stream parser, aka Bug Id 6864911.

CVE-2009-3864: The Java Update functionality in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22 and JDK and JRE 6 before Update 17, when a non-English version of Windows is used, does not retrieve available new JRE versions, which allows remote attackers to lev erage vulnerabilities in older releases of this software, aka Bug Id 6869694.

CVE-2009-3865: The launch method in the Deployment Toolkit plugin in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 6 before Update 17 allows remote attackers to execute arbitrary commands via a crafted web page, aka Bug Id 6869752.

CVE-2009-3868: Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x be fore 1.4.2_24 does not properly parse color profiles, which allows remote attackers to gain privileges via a crafted image file, aka Bug Id 6862970.

CVE-2009-3872: Unspecified vulnerability in the JPEG JFIF Decoder in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK a nd JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to gain privileges via a crafted image file, aka Bug Id 6862969.

CVE-2009-3873: The JPEG Image Writer in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, and SDK and JRE 1.4.x before 1.4.2 _24 allows remote attackers to gain privileges via a crafted image file, related to a 'quanization problem,' aka Bug Id 6862968.

java-1_5_0-sun u22 update fixes the following security bugs :

  - CVE-2009-3864: CVSS v2 Base Score: 7.5

  - CVE-2009-3867: CVSS v2 Base Score: 9.3

  - CVE-2009-3868: CVSS v2 Base Score: 9.3

  - CVE-2009-3869: CVSS v2 Base Score: 9.3

  - CVE-2009-3871: CVSS v2 Base Score: 9.3

  - CVE-2009-3872: CVSS v2 Base Score: 10.0

  - CVE-2009-3873: CVSS v2 Base Score: n/a

  - CVE-2009-3874: CVSS v2 Base Score: 9.3

  - CVE-2009-3875: CVSS v2 Base Score: 5.0

  - CVE-2009-3876: CVSS v2 Base Score: 5.0

  - CVE-2009-3877: CVSS v2 Base Score: 5.0 For bug details     use the CVE-ID to query the Mitre database at     http://cve.mitre.org/cve please.

The version of Sun Java Runtime Environment (JRE) installed on the remote host is earlier than 6 Update 17 / 5.0 Update 22 / 1.4.2_24 / 1.3.1_27.  Such versions are potentially affected by the following security issues :

  - The Java update mechanism on non-English versions does     not update the JRE when a new version is available.
    (269868)

  - A command execution vulnerability exists in the Java     runtime environment deployment toolkit. (269869)

  - An issue in the Java web start installer may be     leveraged to allow an untrusted Java web start     application to run as a trusted application. (269870)

  - Multiple buffer and integer overflow vulnerabilities.
    (270474)

  - A security vulnerability in the JRE with verifying HMAC     digests may allow authentication to be bypassed.     (270475)

  - Two vulnerabilities in the JRE with decoding DER encoded     data and parsing HTTP headers may separately allow a     remote client to cause the JRE on the server to run out     of memory, resulting in a denial of service. (270476)

  - A directory traversal vulnerability in the     ICC_Profile.getInstance method allows a remote attacker     to determine the existence of local International Color     Consortium (ICC) profile files. (Bug #6631533)

  - A denial of service attack is possible via a BMP file     containing a link to a UNC share pathname for an     International Color Consortium (ICC) profile file.     (Bug #6632445)

  - Resurrected classloaders can still have children,     which could allow a remote attacker to gain     privileges via unspecified vectors. (Bug #6636650)

  - The Abstract Window Toolkit (AWT) does not properly     restrict the objects that may be sent to loggers, which     allows attackers to obtain sensitive information via     vectors related to the implementation of Component,     KeyboardFocusManager, and DefaultKeyboardFocusManager.     (Bug #6664512)

  - An unspecified vulnerability in TrueType font parsing     functionality may lead to a denial of service. (Bug     #6815780)

  - The failure to clone arrays returned by the     getConfigurations function could lead to multiple,     unspecified vulnerabilities in the X11 and     Win32GraphicsDevice subsystems. (Bug #6822057)

  - The TimeZone.getTimeZone method can be used by a remote     attacker to determine the existence of local files via     its handling of zoneinfo (aka tz) files. (Bug #6824265)

  - Java Web Start does not properly handle the interaction     between a signed JAR file and a JNLP application or     applet. (Bug #6870531)

ID	Name	Product	Family	Type	Severity
89736	VMware ESX Java Runtime Environment (JRE) Multiple Vulnerabilities (VMSA-2010-0002) (remote check)	Nessus	VMware ESX Local Security Checks	Remote	critical
64831	Sun Java JRE Multiple Vulnerabilities (269868 / 269869 / 270476 ...) (Unix)	Nessus	Misc.	Local	high
45386	VMSA-2010-0002 : VMware vCenter update release addresses multiple security issues in Java JRE	Nessus	VMware ESX Local Security Checks	Local	critical
42857	SuSE 11 Security Update : Sun Java 1.6.0 (SAT Patch Number 1542)	Nessus	SuSE Local Security Checks	Local	high
42855	openSUSE Security Update : java-1_6_0-sun (java-1_6_0-sun-1541)	Nessus	SuSE Local Security Checks	Local	high
42853	openSUSE Security Update : java-1_6_0-sun (java-1_6_0-sun-1541)	Nessus	SuSE Local Security Checks	Local	high
42851	openSUSE Security Update : java-1_6_0-sun (java-1_6_0-sun-1541)	Nessus	SuSE Local Security Checks	Local	high
42460	openSUSE Security Update : java-1_5_0-sun (java-1_5_0-sun-1529)	Nessus	SuSE Local Security Checks	Local	high
42457	openSUSE Security Update : java-1_5_0-sun (java-1_5_0-sun-1529)	Nessus	SuSE Local Security Checks	Local	high
42373	Sun Java JRE Multiple Vulnerabilities (269868 / 269869 / 270476 ..)	Nessus	Windows	Local	high

Detections

Analytics

CVE-2009-3864

high

Tenable Plugins

critical

high

critical

high

high

high

high

high

high

high