It was found that icedtea-web up to and including 1.7.2 and 1.8.2 was vulnerable to a zip-slip attack during auto-extraction of a JAR file. An attacker could use this flaw to write files to arbitrary locations. This could also be used to replace the main running application and, possibly, break out of the sandbox.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1259-1 advisory.

  - It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be injected in     a JAR file without compromising the signature verification. An attacker could use this flaw to inject code     in a trusted JAR. The code would be executed inside the sandbox. (CVE-2019-10181)

  - It was found that icedtea-web though 1.7.2 and 1.8.2 did not properly sanitize paths from <jar/> elements     in JNLP files. An attacker could trick a victim into running a specially crafted application and use this     flaw to upload arbitrary files to arbitrary locations in the context of the user. (CVE-2019-10182)

  - It was found that icedtea-web up to and including 1.7.2 and 1.8.2 was vulnerable to a zip-slip attack     during auto-extraction of a JAR file. An attacker could use this flaw to write files to arbitrary     locations. This could also be used to replace the main running application and, possibly, break out of the     sandbox. (CVE-2019-10185)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202107-51 (IcedTeaWeb: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in IcedTeaWeb. Please       review the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:2004 advisory.

  - icedtea-web: unsigned code injection in a signed JAR file (CVE-2019-10181)

  - icedtea-web: path traversal while processing  elements of JNLP files results in arbitrary file     overwrite (CVE-2019-10182)

  - icedtea-web: directory traversal in the nested jar auto-extraction leading to arbitrary file overwrite     (CVE-2019-10185)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the icedtea-web package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - It was found that in icedtea-web up to and including     1.7.2 and 1.8.2 executable code could be injected in a     JAR file without compromising the signature     verification. An attacker could use this flaw to inject     code in a trusted JAR. The code would be executed     inside the sandbox.(CVE-2019-10181)

  - It was found that icedtea-web though 1.7.2 and 1.8.2     did not properly sanitize paths from <jar/> elements in     JNLP files. An attacker could trick a victim into     running a specially crafted application and use this     flaw to upload arbitrary files to arbitrary locations     in the context of the user.(CVE-2019-10182)

  - It was found that icedtea-web up to and including 1.7.2     and 1.8.2 was vulnerable to a zip-slip attack during     auto-extraction of a JAR file. An attacker could use     this flaw to write files to arbitrary locations. This     could also be used to replace the main running     application and, possibly, break out of the     sandbox.(CVE-2019-10185)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for icedtea-web is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The IcedTea-Web project provides a Java web browser plug-in and an implementation of Java Web Start, which is based on the Netx project.
It also contains a configuration tool for managing deployment settings for the plug-in and Web Start implementations. IcedTea-Web now also contains PolicyEditor - a simple tool to configure Java policies.

Security Fix(es) :

* icedtea-web: path traversal while processing elements of JNLP files results in arbitrary file overwrite (CVE-2019-10182)

* icedtea-web: directory traversal in the nested jar auto-extraction leading to arbitrary file overwrite (CVE-2019-10185)

* icedtea-web: unsigned code injection in a signed JAR file (CVE-2019-10181)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

According to the versions of the icedtea-web package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - It was found that executable code could be injected in     a JAR file without compromising the signature     verification. An attacker could use this flaw to inject     code in a trusted JAR. The code would be executed     inside the sandbox.(CVE-2019-10181)

  - It was found that icedtea-web did not properly sanitize     paths from i1/4oejar/i1/4z elements in JNLP files. An     attacker could trick a victim into running a specially     crafted application and use this flaw to upload     arbitrary files to arbitrary locations in the context     of the user.(CVE-2019-10182)

  - It was found that icedtea-web was vulnerable to a     zip-slip attack during auto-extraction of a JAR file.
    An attacker could use this flaw to write files to     arbitrary locations. This could also be used to replace     the main running application and, possibly, break out     of the sandbox.(CVE-2019-10185)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several security vulnerabilities were found in icedtea-web, an implementation of the Java Network Launching Protocol (JNLP).

CVE-2019-10181

It was found that in icedtea-web executable code could be injected in a JAR file without compromising the signature verification. An attacker could use this flaw to inject code in a trusted JAR. The code would be executed inside the sandbox.

CVE-2019-10182

It was found that icedtea-web did not properly sanitize paths from <jar/> elements in JNLP files. An attacker could trick a victim into running a specially crafted application and use this flaw to upload arbitrary files to arbitrary locations in the context of the user.

CVE-2019-10185

It was found that icedtea-web was vulnerable to a zip-slip attack during auto-extraction of a JAR file. An attacker could use this flaw to write files to arbitrary locations. This could also be used to replace the main running application and, possibly, break out of the sandbox.

For Debian 8 'Jessie', these problems have been fixed in version 1.5.3-1+deb8u1.

We recommend that you upgrade your icedtea-web packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for icedtea-web to version 1.7.2 fixes the following issues :

Security issues fixed :

  - CVE-2019-10181: Fixed an unsigned code injection in a     signed JAR file (bsc#1142835)

  - CVE-2019-10182: Fixed a path traversal while processing     <jar/> elements of JNLP files results in arbitrary file     overwrite (bsc#1142825).

  - CVE-2019-10185: Fixed a directory traversal in the     nested jar auto-extraction leading to arbitrary file     overwrite (bsc#1142832).

This update was imported from the SUSE:SLE-15:Update update project.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2004 advisory.

  - icedtea-web: unsigned code injection in a signed JAR file (CVE-2019-10181)

  - icedtea-web: path traversal while processing <jar/> elements of JNLP files results in arbitrary file     overwrite (CVE-2019-10182)

  - icedtea-web: directory traversal in the nested jar auto-extraction leading to arbitrary file overwrite     (CVE-2019-10185)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2003 advisory.

  - icedtea-web: unsigned code injection in a signed JAR file (CVE-2019-10181)

  - icedtea-web: path traversal while processing <jar/> elements of JNLP files results in arbitrary file     overwrite (CVE-2019-10182)

  - icedtea-web: directory traversal in the nested jar auto-extraction leading to arbitrary file overwrite     (CVE-2019-10185)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2019:2004 :

An update for icedtea-web is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The IcedTea-Web project provides a Java web browser plug-in and an implementation of Java Web Start, which is based on the Netx project.
It also contains a configuration tool for managing deployment settings for the plug-in and Web Start implementations. IcedTea-Web now also contains PolicyEditor - a simple tool to configure Java policies.

Security Fix(es) :

* icedtea-web: path traversal while processing elements of JNLP files results in arbitrary file overwrite (CVE-2019-10182)

* icedtea-web: directory traversal in the nested jar auto-extraction leading to arbitrary file overwrite (CVE-2019-10185)

* icedtea-web: unsigned code injection in a signed JAR file (CVE-2019-10181)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

From Red Hat Security Advisory 2019:2003 :

An update for icedtea-web is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The IcedTea-Web project provides a Java web browser plug-in and an implementation of Java Web Start, which is based on the Netx project.
It also contains a configuration tool for managing deployment settings for the plug-in and Web Start implementations. IcedTea-Web now also contains PolicyEditor - a simple tool to configure Java policies.

Security Fix(es) :

* icedtea-web: path traversal while processing elements of JNLP files results in arbitrary file overwrite (CVE-2019-10182)

* icedtea-web: directory traversal in the nested jar auto-extraction leading to arbitrary file overwrite (CVE-2019-10185)

* icedtea-web: unsigned code injection in a signed JAR file (CVE-2019-10181)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

ID	Name	Product	Family	Severity
159951	SUSE SLED15 / SLES15 Security Update : icedtea-web (SUSE-SU-2022:1259-1)	Nessus	SuSE Local Security Checks	high
154716	GLSA-202107-51 : IcedTeaWeb: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
145602	CentOS 8 : icedtea-web (CESA-2019:2004)	Nessus	CentOS Local Security Checks	high
139959	EulerOS 2.0 SP8 : icedtea-web (EulerOS-SA-2020-1856)	Nessus	Huawei Local Security Checks	high
135312	CentOS 7 : icedtea-web (CESA-2019:2003)	Nessus	CentOS Local Security Checks	high
128828	EulerOS 2.0 SP5 : icedtea-web (EulerOS-SA-2019-1905)	Nessus	Huawei Local Security Checks	high
128618	Debian DLA-1914-1 : icedtea-web security update	Nessus	Debian Local Security Checks	high
128003	openSUSE Security Update : icedtea-web (openSUSE-2019-1911)	Nessus	SuSE Local Security Checks	high
127646	RHEL 8 : icedtea-web (RHSA-2019:2004)	Nessus	Red Hat Local Security Checks	high
127645	RHEL 7 : icedtea-web (RHSA-2019:2003)	Nessus	Red Hat Local Security Checks	high
127612	Oracle Linux 8 : icedtea-web (ELSA-2019-2004)	Nessus	Oracle Linux Local Security Checks	high
127611	Oracle Linux 7 : icedtea-web (ELSA-2019-2003)	Nessus	Oracle Linux Local Security Checks	high

Detections

Analytics

CVE-2019-10185

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high