SuSE 11 Security Update : IBM Java 1.6.0 (SAT Patch Number 736)

This script is Copyright (C) 2009-2016 Tenable Network Security, Inc.


Synopsis :

The remote SuSE 11 host is missing one or more security updates.

Description :

This update brings the IBM Java 6 JDK and JRE to Service Release 4. It
fixes lots of bugs and various security issues :

- A vulnerability in the Java Runtime Environment may
allow an untrusted Java Web Start application to
determine the location of the Java Web Start cache and
the username of the user running the Java Web Start
application. (CVE-2008-5341)

- A vulnerability in the Java Runtime Environment with
launching Java Web Start applications may allow an
untrusted Java Web Start application to escalate
privileges. For example, an untrusted application may
grant itself permissions to read and write local files
or execute local applications that are accessible to the
user running the untrusted application. (CVE-2008-5340)

- The UTF-8 (Unicode Transformation Format-8) decoder in
the Java Runtime Environment (JRE) accepts encodings
that are longer than the 'shortest' form. This behavior
is not a vulnerability in Java SE. However, it may be
leveraged to exploit systems running software that
relies on the JRE UTF-8 decoder to reject non-shortest
form sequences. For example, non-shortest form sequences
may be decoded into illegal URIs, which may then allow
files that are not otherwise accessible to be read, if
the URIs are not checked following UTF-8 decoding.
(CVE-2008-5351)

- A buffer vulnerability in the Java Runtime Environment
(JRE) with processing fonts may allow an untrusted
applet or Java Web Start application to escalate
privileges. For example, an untrusted applet may grant
itself permissions to read and write local files or
execute local applications that are accessible to the
user running the untrusted applet. (CVE-2008-5356)

- A buffer vulnerability in the Java Runtime Environment
(JRE) with processing fonts may allow an untrusted
applet or Java Web Start application to escalate
privileges. For example, an untrusted applet may grant
itself permissions to read and write local files or
execute local applications that are accessible to the
user running the untrusted applet. (CVE-2008-5357)

- A buffer overflow vulnerability in the Java Runtime
Environment with processing GIF images may allow an
untrusted Java Web Start application to escalate
privileges. For example, an untrusted application may
grant itself permissions to read and write local files
or execute local applications that are accessible to the
user running the untrusted applet. (CVE-2008-5358)

- A security vulnerability in the the Java Web Start
BasicService allows untrusted applications that are
downloaded from another system to request local files to
be displayed by the browser of the user running the
untrusted application. (CVE-2008-5342)

See also :

https://bugzilla.novell.com/show_bug.cgi?id=489052
http://support.novell.com/security/cve/CVE-2008-5340.html
http://support.novell.com/security/cve/CVE-2008-5341.html
http://support.novell.com/security/cve/CVE-2008-5342.html
http://support.novell.com/security/cve/CVE-2008-5351.html
http://support.novell.com/security/cve/CVE-2008-5356.html
http://support.novell.com/security/cve/CVE-2008-5357.html
http://support.novell.com/security/cve/CVE-2008-5358.html

Solution :

Apply SAT patch number 736.

Risk factor :

Critical / CVSS Base Score : 10.0
(CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)

Family: SuSE Local Security Checks

Nessus Plugin ID: 41405 ()

Bugtraq ID:

CVE ID: CVE-2008-5340
CVE-2008-5341
CVE-2008-5342
CVE-2008-5351
CVE-2008-5356
CVE-2008-5357
CVE-2008-5358

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now