Unspecified vulnerability in the Java Web Start component in Oracle Java SE and Java for Business 6 Update 21 and 5.0 Update 25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several third-party components and libraries :

  - Java Runtime Environment (JRE)
  - libuser
  - Netscape Portable Runtime (NSPR) 
  - Network Security Services (NSS)
  - OpenSSL

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several third-party components and libraries :

  - Apache Tomcat 
  - Apache Tomcat Manager
  - cURL 
  - Java Runtime Environment (JRE)
  - Kernel 
  - Microsoft SQL Express
  - OpenSSL
  - pam_krb5

Sun Java 1.6.0 was updated to Security Update U22.

The release notes for this release are on:
http://www.oracle.com/technetwork/java/javase/6u22releasenotes-176121.
html

Security advisory page for this update:
http://www.oracle.com/technetwork/topics/security/javacpuoct2010-17625 8.html

Following CVEs are tracked by the update: CVE-2010-3556 CVE-2010-3562 CVE-2010-3565 CVE-2010-3566 CVE-2010-3567 CVE-2010-3571 CVE-2010-3554 CVE-2010-3563 CVE-2010-3568 CVE-2010-3569 CVE-2010-3558 CVE-2010-3552 CVE-2010-3559 CVE-2010-3572 CVE-2010-3553 CVE-2010-3555 CVE-2010-3550 CVE-2010-3570 CVE-2010-3561 CVE-2009-3555 CVE-2010-1321 CVE-2010-3549 CVE-2010-3557 CVE-2010-3541 CVE-2010-3573 CVE-2010-3574 CVE-2010-3548 CVE-2010-3551 CVE-2010-3560

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is earlier than 6 Update 22 / 5.0 Update 26 / 1.4.2_28.  Such versions are potentially affected by security issue in the following components :

  - CORBA
  - Deployment
  - Deployment Toolkit
  - Java 2D
  - Java Web Start
  - JNDI
  - JRE
  - JSSE
  - Kerberos
  - Networking
  - New Java Plug-in
  - Sound
  - Swing

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:0880 advisory.

  - TLS: MITM attacks via session renegotiation (CVE-2009-3555)

  - krb5: null pointer dereference in GSS-API library leads to DoS (MITKRB5-SA-2010-005) (CVE-2010-1321)

  - OpenJDK HttpURLConnection allows arbitrary request headers (6961084,6980004) (CVE-2010-3541,     CVE-2010-3573)

  - OpenJDK DNS server IP address information leak (6957564) (CVE-2010-3548)

  - OpenJDK HttpURLConnection request splitting (6952017) (CVE-2010-3549)

  - JDK unspecified vulnerability in Java Web Start component (CVE-2010-3550, CVE-2010-3558)

  - OpenJDK local network address disclosure (6952603) (CVE-2010-3551)

  - OpenJDK Swing unsafe reflection usage (6622002) (CVE-2010-3553)

  - JDK unspecified vulnerability in Deployment component (CVE-2010-3555, CVE-2010-4422, CVE-2010-4447,     CVE-2010-4452, CVE-2010-4463, CVE-2010-4466, CVE-2010-4467, CVE-2010-4475)

  - JDK unspecified vulnerability in 2D component (CVE-2010-3556, CVE-2010-3571)

  - OpenJDK Swing mutable static (6938813) (CVE-2010-3557)

  - JDK unspecified vulnerability in Networking component (CVE-2010-3560)

  - OpenJDK IndexColorModel double-free (6925710) (CVE-2010-3562)

  - OpenJDK: unspecified vulnerability in Deployment component (CVE-2010-3563)

  - OpenJDK JPEG writeImage remote code execution (6963023) (CVE-2010-3565)

  - OpenJDK ICC Profile remote code execution (6963489) (CVE-2010-3566)

  - OpenJDK Deserialization Race condition (6559775) (CVE-2010-3568)

  - OpenJDK Serialization inconsistencies (6966692) (CVE-2010-3569)

  - JDK unspecified vulnerability in Sound component (CVE-2010-3572, CVE-2010-4454, CVE-2010-4462,     CVE-2010-4473)

  - OpenJDK HttpURLConnection incomplete TRACE permission check (6981426) (CVE-2010-3574)

  - OpenJDK DNS cache poisoning by untrusted applets (6981922) (CVE-2010-4448)

  - OpenJDK Swing timer-based security manager bypass  (6907662) (CVE-2010-4465)

  - JDK unspecified vulnerability in JDBC component (CVE-2010-4468)

  - OpenJDK Java2D font-related system property leak (6985453) (CVE-2010-4471)

  - JDK Double.parseDouble Denial-Of-Service (CVE-2010-4476)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update fixes several vulnerabilities in the Java 6 Software Development Kit. Further information about these flaws can be found on the 'Oracle Java SE and Java for Business Critical Patch Update Advisory' page. (CVE-2010-1321, CVE-2010-3541, CVE-2010-3548, CVE-2010-3549, CVE-2010-3550, CVE-2010-3551, CVE-2010-3552, CVE-2010-3553, CVE-2010-3554, CVE-2010-3555, CVE-2010-3556, CVE-2010-3557, CVE-2010-3558, CVE-2010-3559, CVE-2010-3560, CVE-2010-3561, CVE-2010-3562, CVE-2010-3563, CVE-2010-3565, CVE-2010-3566, CVE-2010-3567, CVE-2010-3568, CVE-2010-3569, CVE-2010-3570, CVE-2010-3571, CVE-2010-3572, CVE-2010-3573, CVE-2010-3574)

The RHSA-2010:0337 update mitigated a man-in-the-middle attack in the way the TLS/SSL (Transport Layer Security/Secure Sockets Layer) protocols handle session renegotiation by disabling renegotiation.
This update implements the TLS Renegotiation Indication Extension as defined in RFC 5746, allowing secure renegotiation between updated clients and servers. (CVE-2009-3555)

All running instances of Sun Java must be restarted for the update to take effect.

NOTE: jdk-1.6.0_20-fcs.x86_64.rpm has not been signed. We cannot sign this package without breaking it.

The remote host is affected by the vulnerability described in GLSA-201111-02 (Oracle JRE/JDK: Multiple vulnerabilities)

    Multiple vulnerabilities have been reported in the Oracle Java       implementation. Please review the CVE identifiers referenced below and       the associated Oracle Critical Patch Update Advisory for details.
  Impact :

    A remote attacker could exploit these vulnerabilities to cause       unspecified impact, possibly including remote execution of arbitrary       code.
  Workaround :

    There is no known workaround at this time.

a. ESX third-party update for Service Console openssl RPM

   The Service Console openssl RPM is updated to    openssl-0.9.8e.12.el5_5.7 resolving two security issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2008-7270 and CVE-2010-4180 to these    issues.
   b. ESX third-party update for Service Console libuser RPM     The Service Console libuser RPM is updated to version    0.54.7-2.1.el5_5.2 to resolve a security issue.
     The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2011-0002 to this issue.
  c. ESX third-party update for Service Console nss and nspr RPMs     The Service Console Network Security Services (NSS) and Netscape    Portable Runtime (NSPR) libraries are updated to nspr-4.8.6-1    and nss-3.12.8-4 resolving multiple security issues.
     The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2010-3170 and CVE-2010-3173 to these    issues.
  d. vCenter Server and ESX, Oracle (Sun) JRE update 1.6.0_24

   Oracle (Sun) JRE is updated to version 1.6.0_24, which addresses    multiple security issues that existed in earlier releases of    Oracle (Sun) JRE.
     The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    JRE 1.6.0_24: CVE-2010-4422, CVE-2010-4447, CVE-2010-4448,    CVE-2010-4450, CVE-2010-4451, CVE-2010-4452, CVE-2010-4454,    CVE-2010-4462, CVE-2010-4463, CVE-2010-4465, CVE-2010-4466,    CVE-2010-4467, CVE-2010-4468, CVE-2010-4469, CVE-2010-4470,    CVE-2010-4471, CVE-2010-4472, CVE-2010-4473, CVE-2010-4474,    CVE-2010-4475 and CVE-2010-4476.
     The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    JRE 1.6.0_22: CVE-2010-1321, CVE-2010-3541, CVE-2010-3548,    CVE-2010-3549, CVE-2010-3550, CVE-2010-3551, CVE-2010-3552,    CVE-2010-3553, CVE-2010-3554, CVE-2010-3555, CVE-2010-3556,    CVE-2010-3557, CVE-2010-3558, CVE-2010-3559, CVE-2010-3560,    CVE-2010-3561, CVE-2010-3562, CVE-2010-3563, CVE-2010-3565,    CVE-2010-3566, CVE-2010-3567, CVE-2010-3568, CVE-2010-3569,    CVE-2010-3570, CVE-2010-3571, CVE-2010-3572, CVE-2010-3573 and    CVE-2010-3574.
  e. vCenter Update Manager Oracle (Sun) JRE update 1.5.0_30

   Oracle (Sun) JRE is updated to version 1.5.0_30, which addresses    multiple security issues that existed in earlier releases of    Oracle (Sun) JRE.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    Oracle (Sun) JRE 1.5.0_30: CVE-2011-0862, CVE-2011-0873,    CVE-2011-0815, CVE-2011-0864, CVE-2011-0802, CVE-2011-0814,    CVE-2011-0871, CVE-2011-0867 and CVE-2011-0865.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    Oracle (Sun) JRE 1.5.0_28: CVE-2010-4447, CVE-2010-4448,    CVE-2010-4450, CVE-2010-4454, CVE-2010-4462, CVE-2010-4465,    CVE-2010-4466, CVE-2010-4468, CVE-2010-4469, CVE-2010-4473,    CVE-2010-4475, CVE-2010-4476.

f. Integer overflow in VMware third-party component sfcb

   This release resolves an integer overflow issue present in the    third-party library SFCB when the httpMaxContentLength has been    changed from its default value to 0 in in /etc/sfcb/sfcb.cfg.
   The integer overflow could allow remote attackers to cause a    denial of service (heap memory corruption) or possibly execute    arbitrary code via a large integer in the Content-Length HTTP    header.
     The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2010-2054 to this issue.

a. vCenter Server and vCenter Update Manager update Microsoft    SQL Server 2005 Express Edition to Service Pack 3

   Microsoft SQL Server 2005 Express Edition (SQL Express)    distributed with vCenter Server 4.1 Update 1 and vCenter Update    Manager 4.1 Update 1 is upgraded from  SQL Express Service Pack 2    to SQL Express Service Pack 3, to address multiple security    issues that exist in the earlier releases of Microsoft SQL Express.

   Customers using other database solutions need not update for    these issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2008-5416, CVE-2008-0085, CVE-2008-0086,    CVE-2008-0107 and CVE-2008-0106 to the issues addressed in MS SQL    Express Service Pack 3.

b. vCenter Apache Tomcat Management Application Credential Disclosure

   The Apache Tomcat Manager application configuration file contains    logon credentials that can be read by unprivileged local users.

   The issue is resolved by removing the Manager application in    vCenter 4.1 Update 1.

   If vCenter 4.1 is updated to vCenter 4.1 Update 1 the logon    credentials are not present in the configuration file after the    update.

   VMware would like to thank Claudio Criscione of Secure Networking    for reporting this issue to us.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2010-2928 to this issue.

c. vCenter Server and ESX, Oracle (Sun) JRE is updated to version    1.6.0_21

   Oracle (Sun) JRE update to version 1.6.0_21, which addresses    multiple security issues that existed in earlier releases of    Oracle (Sun) JRE.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    Oracle (Sun) JRE 1.6.0_19: CVE-2009-3555, CVE-2010-0082,    CVE-2010-0084, CVE-2010-0085, CVE-2010-0087, CVE-2010-0088,    CVE-2010-0089, CVE-2010-0090, CVE-2010-0091, CVE-2010-0092,    CVE-2010-0093, CVE-2010-0094, CVE-2010-0095, CVE-2010-0837,    CVE-2010-0838, CVE-2010-0839, CVE-2010-0840, CVE-2010-0841,    CVE-2010-0842, CVE-2010-0843, CVE-2010-0844, CVE-2010-0845,    CVE-2010-0846, CVE-2010-0847, CVE-2010-0848, CVE-2010-0849,    CVE-2010-0850.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following name to the security issue fixed in    Oracle (Sun) JRE 1.6.0_20: CVE-2010-0886.

d. vCenter Update Manager Oracle (Sun) JRE is updated to version   1.5.0_26

   Oracle (Sun) JRE update to version 1.5.0_26, which addresses    multiple security issues that existed in earlier releases of    Oracle (Sun) JRE.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    Oracle (Sun) JRE 1.5.0_26: CVE-2010-3556, CVE-2010-3566,    CVE-2010-3567, CVE-2010-3550, CVE-2010-3561, CVE-2010-3573,    CVE-2010-3565,CVE-2010-3568, CVE-2010-3569,  CVE-2009-3555,    CVE-2010-1321, CVE-2010-3548, CVE-2010-3551, CVE-2010-3562,    CVE-2010-3571, CVE-2010-3554, CVE-2010-3559, CVE-2010-3572,    CVE-2010-3553, CVE-2010-3549, CVE-2010-3557, CVE-2010-3541,    CVE-2010-3574.

e. vCenter Server and ESX Apache Tomcat updated to version 6.0.28

   Apache Tomcat updated to version 6.0.28, which addresses multiple    security issues that existed in earlier releases of Apache Tomcat

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    Apache Tomcat 6.0.24: CVE-2009-2693, CVE-2009-2901, CVE-2009-2902,i    and CVE-2009-3548.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    Apache Tomcat 6.0.28: CVE-2010-2227, CVE-2010-1157.

f. vCenter Server third-party component OpenSSL updated to version    0.9.8n

   The version of the OpenSSL library in vCenter Server is updated to    0.9.8n.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2010-0740 and CVE-2010-0433 to the    issues addressed in this version of OpenSSL.

g. ESX third-party component OpenSSL updated to version 0.9.8p

   The version of the ESX OpenSSL library is updated to 0.9.8p.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2010-3864 and CVE-2010-2939 to the    issues addressed in this update.

h. ESXi third-party component cURL updated

   The version of cURL library in ESXi is updated.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2010-0734 to the issues addressed in    this update.

i. ESX third-party component pam_krb5 updated

   The version of pam_krb5 library is updated.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2008-3825 and CVE-2009-1384 to the    issues addressed in the update.

j. ESX third-party update for Service Console kernel

   The Service Console kernel is updated to include kernel version    2.6.18-194.11.1.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2010-1084, CVE-2010-2066, CVE-2010-2070,    CVE-2010-2226, CVE-2010-2248, CVE-2010-2521, CVE-2010-2524,    CVE-2010-0008, CVE-2010-0415, CVE-2010-0437, CVE-2009-4308,    CVE-2010-0003, CVE-2010-0007, CVE-2010-0307, CVE-2010-1086,    CVE-2010-0410, CVE-2010-0730, CVE-2010-1085, CVE-2010-0291,    CVE-2010-0622, CVE-2010-1087, CVE-2010-1173, CVE-2010-1437,    CVE-2010-1088, CVE-2010-1187, CVE-2010-1436, CVE-2010-1641, and    CVE-2010-3081 to the issues addressed in the update.

   Notes :
   - The update also addresses the 64-bit compatibility mode    stack pointer underflow issue identified by CVE-2010-3081. This    issue was patched in an ESX 4.1 patch prior to the release of    ESX 4.1 Update 1 and in a previous ESX 4.0 patch release.
   - The update also addresses CVE-2010-2240 for ESX 4.0.

Sun Java 1.6.0 was updated to Security Update U22.

The release notes for this release are on:
http://www.oracle.com/technetwork/java/javase/6u22releasenotes-176121.
html

Security advisory page for this update:
http://www.oracle.com/technetwork/topics/security/javacpuoct2010-17625 8.html

Following CVEs are tracked for this update: CVE-2010-3556 / CVE-2010-3562 / CVE-2010-3565 / CVE-2010-3566 / CVE-2010-3567 / CVE-2010-3571 / CVE-2010-3554 / CVE-2010-3563 / CVE-2010-3568 / CVE-2010-3569 / CVE-2010-3558 / CVE-2010-3552 / CVE-2010-3559 / CVE-2010-3572 / CVE-2010-3553 / CVE-2010-3555 / CVE-2010-3550 / CVE-2010-3570 / CVE-2010-3561 / CVE-2009-3555 / CVE-2010-1321 / CVE-2010-3549 / CVE-2010-3557 / CVE-2010-3541 / CVE-2010-3573 / CVE-2010-3574 / CVE-2010-3548 / CVE-2010-3551 / CVE-2010-3560

IBM Java 6 SR9 was released, fixing a lot of security issues.

IBM JDK Alerts can also be found on this page:
http://www.ibm.com/developerworks/java/jdk/alerts/

IBM Java 6 SR9 was released which fixes a lot of security issues.

IBM JDK Alerts can also be found on this page:
http://www.ibm.com/developerworks/java/jdk/alerts/

Updated java-1.6.0-ibm packages that fix several security issues and two bugs are now available for Red Hat Enterprise Linux 4 Extras, and Red Hat Enterprise Linux 5 and 6 Supplementary.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The IBM 1.6.0 Java release includes the IBM Java 2 Runtime Environment and the IBM Java 2 Software Development Kit.

This update fixes several vulnerabilities in the IBM Java 2 Runtime Environment. Detailed vulnerability descriptions are linked from the IBM 'Security alerts' page, listed in the References section.
(CVE-2009-3555, CVE-2010-1321, CVE-2010-3541, CVE-2010-3548, CVE-2010-3549, CVE-2010-3550, CVE-2010-3551, CVE-2010-3553, CVE-2010-3555, CVE-2010-3556, CVE-2010-3557, CVE-2010-3558, CVE-2010-3560, CVE-2010-3562, CVE-2010-3563, CVE-2010-3565, CVE-2010-3566, CVE-2010-3568, CVE-2010-3569, CVE-2010-3571, CVE-2010-3572, CVE-2010-3573, CVE-2010-3574)

This update also fixes the following bugs :

* An error in the java-1.6.0-ibm RPM spec file caused an incorrect path to be included in HtmlConverter, preventing it from running.
(BZ#659716)

* On AMD64 and Intel 64 systems, if only the 64-bit java-1.6.0-ibm packages were installed, IBM Java 6 Web Start was not available as an application that could open JNLP (Java Network Launching Protocol) files. This affected file management and web browser tools. Users had to manually open them with the '/usr/lib/jvm/jre-1.6.0-ibm.x86_64/bin/javaws' command. This update resolves this issue. (BZ#633341)

All users of java-1.6.0-ibm are advised to upgrade to these updated packages, containing the IBM 1.6.0 SR9 Java release. All running instances of IBM Java must be restarted for the update to take effect.

This update brings IBM Java 5 to Service Release 12 Fixpack 2.

It fixes quite a large number of security problems and other bugs. The security issues are tracked by the following CVE ids: CVE-2009-3555 / CVE-2010-1321 / CVE-2010-3541 / CVE-2010-3548 / CVE-2010-3549 / CVE-2010-3550 / CVE-2010-3551 / CVE-2010-3556 / CVE-2010-3559 / CVE-2010-3562 / CVE-2010-3565 / CVE-2010-3566 / CVE-2010-3568 / CVE-2010-3569 / CVE-2010-3572 / CVE-2010-3573 / CVE-2010-3574

Sun Java 1.6.0 was updated to Security Update U22.

The release notes for this release are on:
http://www.oracle.com/technetwork/java/javase/6u22releasenotes-176121.
html

Security advisory page for this update:
http://www.oracle.com/technetwork/topics/security/javacpuoct2010-17625 8.html

This update brings IBM Java 5 to Service Release 12 Fixpack 2.

It fixes quite a large number of security problems and other bugs. The security issues are tracked by the following CVE ids :

  - CVE-2010-1321 CVE-2010-3541 CVE-2010-3548 CVE-2010-3549     CVE-2010-3550 CVE-2010-3551 CVE-2010-3556 CVE-2010-3559     CVE-2010-3562 CVE-2010-3565 CVE-2010-3566 CVE-2010-3568     CVE-2010-3569 CVE-2010-3572 CVE-2010-3573 CVE-2010-3574.
    (CVE-2009-3555)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2010:0873 advisory.

    The IBM 1.5.0 Java release includes the IBM Java 2 Runtime Environment and     the IBM Java 2 Software Development Kit.

    This update fixes several vulnerabilities in the IBM Java 2 Runtime     Environment and the IBM Java 2 Software Development Kit. Detailed     vulnerability descriptions are linked from the IBM Security alerts page,     listed in the References section. (CVE-2010-1321, CVE-2010-3541,     CVE-2010-3548, CVE-2010-3549, CVE-2010-3550, CVE-2010-3551, CVE-2010-3556,     CVE-2010-3559, CVE-2010-3562, CVE-2010-3565, CVE-2010-3566, CVE-2010-3568,     CVE-2010-3569, CVE-2010-3572, CVE-2010-3573, CVE-2010-3574)

    All users of java-1.5.0-ibm are advised to upgrade to these updated     packages, containing the IBM 1.5.0 SR12-FP2 Java release. All running     instances of IBM Java must be restarted for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated java-1.5.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 4 Extras and 5 Supplementary.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The IBM 1.5.0 Java release includes the IBM Java 2 Runtime Environment and the IBM Java 2 Software Development Kit.

This update fixes several vulnerabilities in the IBM Java 2 Runtime Environment and the IBM Java 2 Software Development Kit. Detailed vulnerability descriptions are linked from the IBM 'Security alerts' page, listed in the References section. (CVE-2010-1321, CVE-2010-3541, CVE-2010-3548, CVE-2010-3549, CVE-2010-3550, CVE-2010-3551, CVE-2010-3556, CVE-2010-3559, CVE-2010-3562, CVE-2010-3565, CVE-2010-3566, CVE-2010-3568, CVE-2010-3569, CVE-2010-3572, CVE-2010-3573, CVE-2010-3574)

The RHSA-2010:0130 update mitigated a man-in-the-middle attack in the way the TLS/SSL (Transport Layer Security/Secure Sockets Layer) protocols handle session renegotiation by disabling renegotiation.
This update implements the TLS Renegotiation Indication Extension as defined in RFC 5746, allowing secure renegotiation between updated clients and servers. (CVE-2009-3555)

All users of java-1.5.0-ibm are advised to upgrade to these updated packages, containing the IBM 1.5.0 SR12-FP2 Java release. All running instances of IBM Java must be restarted for this update to take effect.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is earlier than 6 Update 22 / 5.0 Update 26 / 1.4.2_28. Such versions are potentially affected by security issue in the following components :

  - CORBA
  - Deployment
  - Deployment Toolkit
  - Java 2D
  - Java Web Start
  - JNDI
  - JRE
  - JSSE
  - Kerberos
  - Networking
  - New Java Plug-in
  - Sound
  - Swing

Updated java-1.6.0-sun packages that fix several security issues are now available for Red Hat Enterprise Linux 4 Extras and 5 Supplementary.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The Sun 1.6.0 Java release includes the Sun Java 6 Runtime Environment and the Sun Java 6 Software Development Kit.

This update fixes several vulnerabilities in the Sun Java 6 Runtime Environment and the Sun Java 6 Software Development Kit. Further information about these flaws can be found on the 'Oracle Java SE and Java for Business Critical Patch Update Advisory' page, listed in the References section. (CVE-2010-1321, CVE-2010-3541, CVE-2010-3548, CVE-2010-3549, CVE-2010-3550, CVE-2010-3551, CVE-2010-3552, CVE-2010-3553, CVE-2010-3554, CVE-2010-3555, CVE-2010-3556, CVE-2010-3557, CVE-2010-3558, CVE-2010-3559, CVE-2010-3560, CVE-2010-3561, CVE-2010-3562, CVE-2010-3563, CVE-2010-3565, CVE-2010-3566, CVE-2010-3567, CVE-2010-3568, CVE-2010-3569, CVE-2010-3570, CVE-2010-3571, CVE-2010-3572, CVE-2010-3573, CVE-2010-3574)

The RHSA-2010:0337 update mitigated a man-in-the-middle attack in the way the TLS/SSL (Transport Layer Security/Secure Sockets Layer) protocols handle session renegotiation by disabling renegotiation.
This update implements the TLS Renegotiation Indication Extension as defined in RFC 5746, allowing secure renegotiation between updated clients and servers. (CVE-2009-3555)

Users of java-1.6.0-sun should upgrade to these updated packages, which correct these issues. All running instances of Sun Java must be restarted for the update to take effect.

ID	Name	Product	Family	Severity
89681	VMware ESX / ESXi Third-Party Libraries Multiple Vulnerabilities (VMSA-2011-0013) (remote check)	Nessus	Misc.	critical
89674	VMware ESX / ESXi Third-Party Libraries Multiple Vulnerabilities (VMSA-2011-0003) (remote check)	Nessus	Misc.	high
75540	openSUSE Security Update : java-1_6_0-sun (openSUSE-SU-2010:0754-1)	Nessus	SuSE Local Security Checks	critical
64843	Oracle Java SE Multiple Vulnerabilities (October 2010 CPU) (Unix)	Nessus	Misc.	critical
63983	RHEL 5 : Red Hat Network Satellite server IBM Java Runtime (RHSA-2011:0880)	Nessus	Red Hat Local Security Checks	critical
60869	Scientific Linux Security Update : java (jdk 1.6.0) on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	critical
56724	GLSA-201111-02 : Oracle JRE/JDK: Multiple vulnerabilities (BEAST)	Nessus	Gentoo Local Security Checks	critical
56665	VMSA-2011-0013 : VMware third-party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX	Nessus	VMware ESX Local Security Checks	critical
51971	VMSA-2011-0003 : Third-party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX	Nessus	VMware ESX Local Security Checks	high
51751	SuSE 10 Security Update : Sun Java 1.6.0 (ZYPP Patch Number 7204)	Nessus	SuSE Local Security Checks	critical
51750	SuSE 10 Security Update : IBM Java 6 SR9 (ZYPP Patch Number 7312)	Nessus	SuSE Local Security Checks	critical
51667	SuSE 11.1 Security Update : IBM Java 6 (SAT Patch Number 3724)	Nessus	SuSE Local Security Checks	critical
51197	RHEL 4 / 5 / 6 : java-1.6.0-ibm (RHSA-2010:0987)	Nessus	Red Hat Local Security Checks	critical
50968	SuSE 10 Security Update : IBM Java 5 (ZYPP Patch Number 7205)	Nessus	SuSE Local Security Checks	critical
50919	SuSE 11 / 11.1 Security Update : Java 1.6.0 (SAT Patch Numbers 3347 / 3349)	Nessus	SuSE Local Security Checks	critical
50854	SuSE9 Security Update : IBM Java 5 JRE and SDK (YOU Patch Number 12659)	Nessus	SuSE Local Security Checks	critical
50641	RHEL 6 : java-1.5.0-ibm (RHSA-2010:0873)	Nessus	Red Hat Local Security Checks	medium
50360	RHEL 4 / 5 : java-1.5.0-ibm (RHSA-2010:0807)	Nessus	Red Hat Local Security Checks	critical
50299	openSUSE Security Update : java-1_6_0-sun (openSUSE-SU-2010:0754-1)	Nessus	SuSE Local Security Checks	critical
50298	openSUSE Security Update : java-1_6_0-sun (openSUSE-SU-2010:0754-1)	Nessus	SuSE Local Security Checks	critical
49996	Oracle Java SE Multiple Vulnerabilities (October 2010 CPU)	Nessus	Windows	critical
49990	RHEL 4 / 5 : java-1.6.0-sun (RHSA-2010:0770)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2010-3550

medium

Tenable Plugins

critical

high

critical

critical

critical

critical

critical

critical

high

critical

critical

critical

critical

critical

critical

critical

medium

critical

critical

critical

critical

critical