Sun Java SE 5.0 before Update 22 and 6 before Update 17 on Windows allows remote attackers to cause a denial of service via a BMP file containing a link to a UNC share pathname for an International Color Consortium (ICC) profile file, probably a related issue to CVE-2007-2789, aka Bug Id 6632445.

The remote VMware ESX host is missing a security-related patch. It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in the bundled version of the Java Runtime Environment (JRE).

The version of Sun Java Runtime Environment (JRE) installed on the remote host is earlier than 6 Update 17 / 5.0 Update 22 / 1.4.2_24 / 1.3.1_27.  Such versions are potentially affected by the following security issues :

  - The Java update mechanism on non-English versions does     not update the JRE when a new version is available.
    (269868)

  - A command execution vulnerability exists in the Java     runtime environment deployment toolkit. (269869)

  - An issue in the Java web start installer may be     leveraged to allow an untrusted Java web start     application to run as a trusted application. (269870)

  - Multiple buffer and integer overflow vulnerabilities     exist. (270474)

  - A security vulnerability in the JRE with verifying HMAC     digests may allow authentication to be bypassed.
    (270475)

  - Two vulnerabilities in the JRE with decoding DER encoded     data and parsing HTTP headers may separately allow a     remote client to cause the JRE on the server to run out     of memory, resulting in a denial of service. (270476)

  - A directory traversal vulnerability in the     ICC_Profile.getInstance method allows a remote attacker     to determine the existence of local International Color     Consortium (ICC) profile files. (Bug #6631533)

  - A denial of service attack is possible via a BMP file     containing a link to a UNC share pathname for an     International Color Consortium (ICC) profile file.
    (Bug #6632445)

  - Resurrected classloaders can still have children,     which could allow a remote attacker to gain     privileges via unspecified vectors (Bug #6636650)

  - The Abstract Window Toolkit (AWT) does not properly     restrict the objects that may be sent to loggers, which     allows attackers to obtain sensitive information via     vectors related to the implementation of Component,     KeyboardFocusManager, and DefaultKeyboardFocusManager.
    (Bug #6664512)

  - An unspecified vulnerability in TrueType font parsing     functionality may lead to a denial of service. (Bug     #6815780)

  - The failure to clone arrays returned by the     getConfigurations function could lead to multiple,     unspecified vulnerabilities in the X11 and     Win32GraphicsDevice subsystems. (Bug #6822057)

  - The TimeZone.getTimeZone method can be used by a remote     attacker to determine the existence of local files via     its handling of zoneinfo (aka tz) files. (Bug #6824265)

  - Java Web Start does not properly handle the interaction     between a signed JAR file and a JNLP application or     applet. (Bug #6870531)

Multiple Java OpenJDK security vulnerabilities has been identified and fixed :

  - TLS: MITM attacks via session renegotiation     (CVE-2009-3555).

    - Loader-constraint table allows arrays instead of only       the b ase-classes (CVE-2010-0082).

  - Policy/PolicyFile leak dynamic ProtectionDomains.
    (CVE-2010-0084).

    - File TOCTOU deserialization vulnerability       (CVE-2010-0085).

    - Inflater/Deflater clone issues (CVE-2010-0088).

    - Unsigned applet can retrieve the dragged information       before drop action occurs (CVE-2010-0091).

  - AtomicReferenceArray causes SIGSEGV -> SEGV_MAPERR error     (CVE-2010-0092).

  - System.arraycopy unable to reference elements beyond     Integer.MAX_VALUE bytes (CVE-2010-0093).

  - Deserialization of RMIConnectionImpl objects should     enforce stricter checks (CVE-2010-0094).

  - Subclasses of InetAddress may incorrectly interpret     network addresses (CVE-2010-0095).

  - JAR unpack200 must verify input parameters     (CVE-2010-0837).

    - CMM readMabCurveData Buffer Overflow Vulnerability       (CVE-2010-0838).

    - Applet Trusted Methods Chaining Privilege Escalation       Vulnerability (CVE-2010-0840).

  - No ClassCastException for HashAttributeSet constructors     if run with -Xcomp (CVE-2010-0845)

  - ImagingLib arbitrary code execution vulnerability     (CVE-2010-0847).

    - AWT Library Invalid Index Vulnerability       (CVE-2010-0848).

Additional security issues that was fixed with IcedTea6 1.6.2 :

  - deprecate MD2 in SSL cert validation (CVE-2009-2409).

    - ICC_Profile file existence detection information leak       (CVE-2009-3728).

  - JRE AWT setDifflCM stack overflow (CVE-2009-3869).

    - JRE AWT setBytePixels heap overflow (CVE-2009-3871).

    - JPEG Image Writer quantization problem       (CVE-2009-3873).

    - ImageI/O JPEG heap overflow (CVE-2009-3874).

    - MessageDigest.isEqual introduces timing attack       vulnerabilities (CVE-2009-3875).

  - OpenJDK ASN.1/DER input stream parser denial of service     (CVE-2009-3876, CVE-2009-3877)

  - GraphicsConfiguration information leak (CVE-2009-3879).

    - UI logging information leakage (CVE-2009-3880).

    - resurrected classloaders can still have children       (CVE-2009-3881).

    - Numerous static security flaws in Swing (findbugs)       (CVE-2009-3882).

    - Mutable statics in Windows PL&amp;F (findbugs)       (CVE-2009-3883).

    - zoneinfo file existence information leak       (CVE-2009-3884).

    - BMP parsing DoS with UNC ICC links (CVE-2009-3885).

Additionally Paulo Cesar Pereira de Andrade (pcpa) at Mandriva found and fixed a bug in IcedTea6 1.8 that is also applied to the provided packages :

  - plugin/icedteanp/IcedTeaNPPlugin.cc     (plugin_filter_environment): Increment malloc size by     one to account for NULL terminator. Bug# 474.

Packages for 2009.0 are provided due to the Extended Maintenance Program.

a. Java JRE Security Update

  JRE update to version 1.5.0_22, which addresses multiple security   issues that existed in earlier releases of JRE.

  The Common Vulnerabilities and Exposures project (cve.mitre.org) has   assigned the following names to the security issues fixed in   JRE 1.5.0_18: CVE-2009-1093, CVE-2009-1094, CVE-2009-1095,   CVE-2009-1096, CVE-2009-1097, CVE-2009-1098, CVE-2009-1099,   CVE-2009-1100, CVE-2009-1101, CVE-2009-1102, CVE-2009-1103,   CVE-2009-1104, CVE-2009-1105, CVE-2009-1106, and CVE-2009-1107.

  The Common Vulnerabilities and Exposures project (cve.mitre.org) has   assigned the following names to the security issues fixed in   JRE 1.5.0_20: CVE-2009-2625, CVE-2009-2670, CVE-2009-2671,   CVE-2009-2672, CVE-2009-2673, CVE-2009-2675, CVE-2009-2676,   CVE-2009-2716, CVE-2009-2718, CVE-2009-2719, CVE-2009-2720,   CVE-2009-2721, CVE-2009-2722, CVE-2009-2723, CVE-2009-2724.

  The Common Vulnerabilities and Exposures project (cve.mitre.org) has   assigned the following names to the security issues fixed in   JRE 1.5.0_22: CVE-2009-3728, CVE-2009-3729, CVE-2009-3864,   CVE-2009-3865, CVE-2009-3866, CVE-2009-3867, CVE-2009-3868,   CVE-2009-3869, CVE-2009-3871, CVE-2009-3872, CVE-2009-3873,   CVE-2009-3874, CVE-2009-3875, CVE-2009-3876, CVE-2009-3877,   CVE-2009-3879, CVE-2009-3880, CVE-2009-3881, CVE-2009-3882,   CVE-2009-3883, CVE-2009-3884, CVE-2009-3886, CVE-2009-3885.

New icedtea update to fix :

  - ICC_Profile file existence detection information leak;
    CVE-2009-3728: CVSS v2 Base Score: 5.0

  - BMP parsing DoS with UNC ICC links; CVE-2009-3885: CVSS     v2 Base Score: 5.0

  - resurrected classloaders can still have children;
    CVE-2009-3881: CVSS v2 Base Score: 7.5

  - Numerous static security flaws in Swing; CVE-2009-3882:
    CVSS v2 Base Score: 7.5

  - Mutable statics in Windows PL&F; CVE-2009-3883: CVSS v2     Base Score: 7.5

  - UI logging information leakage; CVE-2009-3880: CVSS v2     Base Score: 5.0

  - GraphicsConfiguration information leak; CVE-2009-3879:
    CVSS v2 Base Score: 7.5

  - zoneinfo file existence information leak; CVE-2009-3884:
    CVSS v2 Base Score: 5.0

  - deprecate MD2 in SSL cert validation; CVE-2009-2409:
    CVSS v2 Base Score: 6.4

  - JPEG Image Writer quantization problem; CVE-2009-3873:
    CVSS v2 Base Score: 9.3

  - MessageDigest.isEqual introduces timing attack     vulnerabilities; CVE-2009-3875: CVSS v2 Base Score: 5.0

  - OpenJDK ASN.1/DER input stream parser denial of service;
    CVE-2009-3876,CVE-2009-3877: CVSS v2 Base Score: 5.0

  - JRE AWT setDifflCM stack overflow; CVE-2009-3869: CVSS     v2 Base Score: 9.3

  - ImageI/O JPEG heap overflow; CVE-2009-3874: CVSS v2 Base     Score: 9.3

  - JRE AWT setBytePixels heap overflow; CVE-2009-3871: CVSS     v2 Base Score: 9.3

Dan Kaminsky discovered that SSL certificates signed with MD2 could be spoofed given enough time. As a result, an attacker could potentially create a malicious trusted certificate to impersonate another site.
This update handles this issue by completely disabling MD2 for certificate validation in OpenJDK. (CVE-2009-2409)

It was discovered that ICC profiles could be identified with '..' pathnames. If a user were tricked into running a specially crafted applet, a remote attacker could gain information about a local system.
(CVE-2009-3728)

Peter Vreugdenhil discovered multiple flaws in the processing of graphics in the AWT library. If a user were tricked into running a specially crafted applet, a remote attacker could crash the application or run arbitrary code with user privileges.
(CVE-2009-3869, CVE-2009-3871)

Multiple flaws were discovered in JPEG and BMP image handling. If a user were tricked into loading a specially crafted image, a remote attacker could crash the application or run arbitrary code with user privileges. (CVE-2009-3873, CVE-2009-3874, CVE-2009-3885)

Coda Hale discovered that HMAC-based signatures were not correctly validated. Remote attackers could bypass certain forms of authentication, granting unexpected access. (CVE-2009-3875)

Multiple flaws were discovered in ASN.1 parsing. A remote attacker could send a specially crafted HTTP stream that would exhaust system memory and lead to a denial of service. (CVE-2009-3876, CVE-2009-3877)

It was discovered that the graphics configuration subsystem did not correctly handle arrays. If a user were tricked into running a specially crafted applet, a remote attacker could exploit this to crash the application or execute arbitrary code with user privileges.
(CVE-2009-3879)

It was discovered that loggers and Swing did not correctly handle certain sensitive objects. If a user were tricked into running a specially crafted applet, private information could be leaked to a remote attacker, leading to a loss of privacy. (CVE-2009-3880, CVE-2009-3882, CVE-2009-3883)

It was discovered that the ClassLoader did not correctly handle certain options. If a user were tricked into running a specially crafted applet, a remote attacker could execute arbitrary code with user privileges. (CVE-2009-3881)

It was discovered that time zone file loading could be used to determine the existence of files on the local system. If a user were tricked into running a specially crafted applet, private information could be leaked to a remote attacker, leading to a loss of privacy.
(CVE-2009-3884).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Sun Java Runtime Environment (JRE) installed on the remote host is earlier than 6 Update 17 / 5.0 Update 22 / 1.4.2_24 / 1.3.1_27.  Such versions are potentially affected by the following security issues :

  - The Java update mechanism on non-English versions does     not update the JRE when a new version is available.
    (269868)

  - A command execution vulnerability exists in the Java     runtime environment deployment toolkit. (269869)

  - An issue in the Java web start installer may be     leveraged to allow an untrusted Java web start     application to run as a trusted application. (269870)

  - Multiple buffer and integer overflow vulnerabilities.
    (270474)

  - A security vulnerability in the JRE with verifying HMAC     digests may allow authentication to be bypassed.     (270475)

  - Two vulnerabilities in the JRE with decoding DER encoded     data and parsing HTTP headers may separately allow a     remote client to cause the JRE on the server to run out     of memory, resulting in a denial of service. (270476)

  - A directory traversal vulnerability in the     ICC_Profile.getInstance method allows a remote attacker     to determine the existence of local International Color     Consortium (ICC) profile files. (Bug #6631533)

  - A denial of service attack is possible via a BMP file     containing a link to a UNC share pathname for an     International Color Consortium (ICC) profile file.     (Bug #6632445)

  - Resurrected classloaders can still have children,     which could allow a remote attacker to gain     privileges via unspecified vectors. (Bug #6636650)

  - The Abstract Window Toolkit (AWT) does not properly     restrict the objects that may be sent to loggers, which     allows attackers to obtain sensitive information via     vectors related to the implementation of Component,     KeyboardFocusManager, and DefaultKeyboardFocusManager.     (Bug #6664512)

  - An unspecified vulnerability in TrueType font parsing     functionality may lead to a denial of service. (Bug     #6815780)

  - The failure to clone arrays returned by the     getConfigurations function could lead to multiple,     unspecified vulnerabilities in the X11 and     Win32GraphicsDevice subsystems. (Bug #6822057)

  - The TimeZone.getTimeZone method can be used by a remote     attacker to determine the existence of local files via     its handling of zoneinfo (aka tz) files. (Bug #6824265)

  - Java Web Start does not properly handle the interaction     between a signed JAR file and a JNLP application or     applet. (Bug #6870531)

ID	Name	Product	Family	Severity
89736	VMware ESX Java Runtime Environment (JRE) Multiple Vulnerabilities (VMSA-2010-0002) (remote check)	Nessus	VMware ESX Local Security Checks	critical
64831	Sun Java JRE Multiple Vulnerabilities (269868 / 269869 / 270476 ...) (Unix)	Nessus	Misc.	high
46176	Mandriva Linux Security Advisory : java-1.6.0-openjdk (MDVSA-2010:084)	Nessus	Mandriva Local Security Checks	high
45386	VMSA-2010-0002 : VMware vCenter update release addresses multiple security issues in Java JRE	Nessus	VMware ESX Local Security Checks	critical
42926	openSUSE Security Update : java-1_6_0-openjdk (java-1_6_0-openjdk-1613)	Nessus	SuSE Local Security Checks	high
42923	openSUSE Security Update : java-1_6_0-openjdk (java-1_6_0-openjdk-1613)	Nessus	SuSE Local Security Checks	high
42921	openSUSE Security Update : java-1_6_0-openjdk (java-1_6_0-openjdk-1613)	Nessus	SuSE Local Security Checks	high
42817	Ubuntu 8.10 / 9.04 / 9.10 : openjdk-6 vulnerabilities (USN-859-1)	Nessus	Ubuntu Local Security Checks	critical
42373	Sun Java JRE Multiple Vulnerabilities (269868 / 269869 / 270476 ..)	Nessus	Windows	high

Detections

Analytics

CVE-2009-3885

high

Tenable Plugins

critical

high

high

critical

high

high

high

critical

high