RHEL 4 / 5 : java-1.5.0-sun (RHSA-2008:0595)

This script is Copyright (C) 2009-2017 Tenable Network Security, Inc.

Synopsis :

The remote Red Hat host is missing one or more security updates.

Description :

Updated java-1.5.0-sun packages that correct several security issues
are now available for Red Hat Enterprise Linux 4 Extras and 5

This update has been rated as having critical security impact by the
Red Hat Security Response Team.

The Java Runtime Environment (JRE) contains the software and tools
that users need to run applets and applications written using the Java
programming language.

A vulnerability was found in the Java Management Extensions (JMX)
management agent, when local monitoring is enabled. This allowed
remote attackers to perform illegal operations. (CVE-2008-3103)

Multiple vulnerabilities with unsigned applets were reported. A remote
attacker could misuse an unsigned applet to connect to localhost
services running on the host running the applet. (CVE-2008-3104)

A Java Runtime Environment (JRE) vulnerability could be triggered by
an untrusted application or applet. A remote attacker could grant an
untrusted applet extended privileges such as reading and writing local
files, or executing local programs. (CVE-2008-3107)

Several buffer overflow vulnerabilities in Java Web Start were
reported. These vulnerabilities may allow an untrusted Java Web Start
application to elevate its privileges and thereby grant itself
permission to read and/or write local files, as well as to execute
local applications accessible to the user running the untrusted
application. (CVE-2008-3111)

Two file processing vulnerabilities in Java Web Start were found. A
remote attacker, by means of an untrusted Java Web Start application,
was able to create or delete arbitrary files with the permissions of
the user running the untrusted application. (CVE-2008-3112,

A vulnerability in Java Web Start when processing untrusted
applications was reported. An attacker was able to acquire sensitive
information, such as the cache location. (CVE-2008-3114)

Users of java-1.5.0-sun should upgrade to these updated packages,
which correct these issues.

See also :


Solution :

Update the affected packages.

Risk factor :

Critical / CVSS Base Score : 10.0
CVSS Temporal Score : 7.8
Public Exploit Available : true

Family: Red Hat Local Security Checks

Nessus Plugin ID: 40723 ()

Bugtraq ID: 30140

CVE ID: CVE-2008-3103

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now