Oracle Linux 6 : icedtea-web (ELSA-2011-1100)

This script is Copyright (C) 2013-2016 Tenable Network Security, Inc.

Synopsis :

The remote Oracle Linux host is missing one or more security updates.

Description :

From Red Hat Security Advisory 2011:1100 :

Updated icedtea-web packages that fix two security issues are now
available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having
moderate security impact. Common Vulnerability Scoring System (CVSS)
base scores, which give detailed severity ratings, are available for
each vulnerability from the CVE links in the References section.

The IcedTea-Web project provides a Java web browser plug-in and an
implementation of Java Web Start, which is based on the Netx project.
It also contains a configuration tool for managing deployment settings
for the plug-in and Web Start implementations.

A flaw was discovered in the JNLP (Java Network Launching Protocol)
implementation in IcedTea-Web. An unsigned Java Web Start application
could use this flaw to manipulate the content of a Security Warning
dialog box, to trick a user into granting the application unintended
access permissions to local files. (CVE-2011-2514)

An information disclosure flaw was discovered in the JNLP
implementation in IcedTea-Web. An unsigned Java Web Start application
or Java applet could use this flaw to determine the path to the cache
directory used to store downloaded Java class and archive files, and
therefore determine the user's login name. (CVE-2011-2513)

All icedtea-web users should upgrade to these updated packages, which
contain backported patches to correct these issues.

See also :

Solution :

Update the affected icedtea-web packages.

Risk factor :

Medium / CVSS Base Score : 6.8
CVSS Temporal Score : 5.9
Public Exploit Available : true

Family: Oracle Linux Local Security Checks

Nessus Plugin ID: 68314 ()

Bugtraq ID: 48829

CVE ID: CVE-2011-2513

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now