SUSE SLED12 / SLES12 Security Update : java-1_7_0-openjdk (SUSE-SU-2015:1319-1) (Bar Mitzvah) (Logjam)

This script is Copyright (C) 2015-2016 Tenable Network Security, Inc.


Synopsis :

The remote SUSE host is missing one or more security updates.

Description :

OpenJDK was updated to 2.6.1 - OpenJDK 7u85 to fix security issues and
bugs.

The following vulnerabilities were fixed :

- CVE-2015-2590: Easily exploitable vulnerability in the
Libraries component allowed successful unauthenticated
network attacks via multiple protocols. Successful
attack of this vulnerability could have resulted in
unauthorized Operating System takeover including
arbitrary code execution.

- CVE-2015-2596: Difficult to exploit vulnerability in the
Hotspot component allowed successful unauthenticated
network attacks via multiple protocols. Successful
attack of this vulnerability could have resulted in
unauthorized update, insert or delete access to some
Java accessible data.

- CVE-2015-2597: Easily exploitable vulnerability in the
Install component requiring logon to Operating System.
Successful attack of this vulnerability could have
resulted in unauthorized Operating System takeover
including arbitrary code execution.

- CVE-2015-2601: Easily exploitable vulnerability in the
JCE component allowed successful unauthenticated network
attacks via multiple protocols. Successful attack of
this vulnerability could have resulted in unauthorized
read access to a subset of Java accessible data.

- CVE-2015-2613: Easily exploitable vulnerability in the
JCE component allowed successful unauthenticated network
attacks via multiple protocols. Successful attack of
this vulnerability could have resulted in unauthorized
read access to a subset of Java SE, Java SE Embedded
accessible data.

- CVE-2015-2619: Easily exploitable vulnerability in the
2D component allowed successful unauthenticated network
attacks via multiple protocols. Successful attack of
this vulnerability could have resulted in unauthorized
read access to a subset of Java accessible data.

- CVE-2015-2621: Easily exploitable vulnerability in the
JMX component allowed successful unauthenticated network
attacks via multiple protocols. Successful attack of
this vulnerability could have resulted in unauthorized
read access to a subset of Java accessible data.

- CVE-2015-2625: Very difficult to exploit vulnerability
in the JSSE component allowed successful unauthenticated
network attacks via SSL/TLS. Successful attack of this
vulnerability could have resulted in unauthorized read
access to a subset of Java accessible data.

- CVE-2015-2627: Very difficult to exploit vulnerability
in the Install component allowed successful
unauthenticated network attacks via multiple protocols.
Successful attack of this vulnerability could have
resulted in unauthorized read access to a subset of Java
accessible data.

- CVE-2015-2628: Easily exploitable vulnerability in the
CORBA component allowed successful unauthenticated
network attacks via multiple protocols. Successful
attack of this vulnerability could have resulted in
unauthorized Operating System takeover including
arbitrary code execution.

- CVE-2015-2632: Easily exploitable vulnerability in the
2D component allowed successful unauthenticated network
attacks via multiple protocols. Successful attack of
this vulnerability could have resulted in unauthorized
read access to a subset of Java accessible data.

- CVE-2015-2637: Easily exploitable vulnerability in the
2D component allowed successful unauthenticated network
attacks via multiple protocols. Successful attack of
this vulnerability could have resulted in unauthorized
read access to a subset of Java accessible data.

- CVE-2015-2638: Easily exploitable vulnerability in the
2D component allowed successful unauthenticated network
attacks via multiple protocols. Successful attack of
this vulnerability could have resulted in unauthorized
Operating System takeover including arbitrary code
execution.

- CVE-2015-2664: Difficult to exploit vulnerability in the
Deployment component requiring logon to Operating
System. Successful attack of this vulnerability could
have resulted in unauthorized Operating System takeover
including arbitrary code execution.

- CVE-2015-2808: Very difficult to exploit vulnerability
in the JSSE component allowed successful unauthenticated
network attacks via SSL/TLS. Successful attack of this
vulnerability could have resulted in unauthorized
update, insert or delete access to some Java accessible
data as well as read access to a subset of Java
accessible data.

- CVE-2015-4000: Very difficult to exploit vulnerability
in the JSSE component allowed successful unauthenticated
network attacks via SSL/TLS. Successful attack of this
vulnerability could have resulted in unauthorized
update, insert or delete access to some Java accessible
data as well as read access to a subset of Java Embedded
accessible data.

- CVE-2015-4729: Very difficult to exploit vulnerability
in the Deployment component allowed successful
unauthenticated network attacks via multiple protocols.
Successful attack of this vulnerability could have
resulted in unauthorized update, insert or delete access
to some Java SE accessible data as well as read access
to a subset of Java SE accessible data.

- CVE-2015-4731: Easily exploitable vulnerability in the
JMX component allowed successful unauthenticated network
attacks via multiple protocols. Successful attack of
this vulnerability could have resulted in unauthorized
Operating System takeover including arbitrary code
execution.

- CVE-2015-4732: Easily exploitable vulnerability in the
Libraries component allowed successful unauthenticated
network attacks via multiple protocols. Successful
attack of this vulnerability could have resulted in
unauthorized Operating System takeover including
arbitrary code execution.

- CVE-2015-4733: Easily exploitable vulnerability in the
RMI component allowed successful unauthenticated network
attacks via multiple protocols. Successful attack of
this vulnerability could have resulted in unauthorized
Operating System takeover including arbitrary code
execution.

- CVE-2015-4736: Difficult to exploit vulnerability in the
Deployment component allowed successful unauthenticated
network attacks via multiple protocols. Successful
attack of this vulnerability could have resulted in
unauthorized Operating System takeover including
arbitrary code execution.

- CVE-2015-4748: Very difficult to exploit vulnerability
in the Security component allowed successful
unauthenticated network attacks via OCSP. Successful
attack of this vulnerability could have resulted in
unauthorized Operating System takeover including
arbitrary code execution.

- CVE-2015-4749: Difficult to exploit vulnerability in the
JNDI component allowed successful unauthenticated
network attacks via multiple protocols. Successful
attack of this vulnerability could have resulted in
unauthorized ability to cause a partial denial of
service (partial DOS).

- CVE-2015-4760: Easily exploitable vulnerability in the
2D component allowed successful unauthenticated network
attacks via multiple protocols. Successful attack of
this vulnerability could have resulted in unauthorized
Operating System takeover including arbitrary code
execution.

Note that Tenable Network Security has extracted the preceding
description block directly from the SUSE security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.

See also :

https://bugzilla.suse.com/938248
https://www.suse.com/security/cve/CVE-2015-2590.html
https://www.suse.com/security/cve/CVE-2015-2596.html
https://www.suse.com/security/cve/CVE-2015-2597.html
https://www.suse.com/security/cve/CVE-2015-2601.html
https://www.suse.com/security/cve/CVE-2015-2613.html
https://www.suse.com/security/cve/CVE-2015-2619.html
https://www.suse.com/security/cve/CVE-2015-2621.html
https://www.suse.com/security/cve/CVE-2015-2625.html
https://www.suse.com/security/cve/CVE-2015-2627.html
https://www.suse.com/security/cve/CVE-2015-2628.html
https://www.suse.com/security/cve/CVE-2015-2632.html
https://www.suse.com/security/cve/CVE-2015-2637.html
https://www.suse.com/security/cve/CVE-2015-2638.html
https://www.suse.com/security/cve/CVE-2015-2664.html
https://www.suse.com/security/cve/CVE-2015-2808.html
https://www.suse.com/security/cve/CVE-2015-4000.html
https://www.suse.com/security/cve/CVE-2015-4729.html
https://www.suse.com/security/cve/CVE-2015-4731.html
https://www.suse.com/security/cve/CVE-2015-4732.html
https://www.suse.com/security/cve/CVE-2015-4733.html
https://www.suse.com/security/cve/CVE-2015-4736.html
https://www.suse.com/security/cve/CVE-2015-4748.html
https://www.suse.com/security/cve/CVE-2015-4749.html
https://www.suse.com/security/cve/CVE-2015-4760.html
http://www.nessus.org/u?16d16647

Solution :

To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product :

SUSE Linux Enterprise Server 12 :

zypper in -t patch SUSE-SLE-SERVER-12-2015-352=1

SUSE Linux Enterprise Desktop 12 :

zypper in -t patch SUSE-SLE-DESKTOP-12-2015-352=1

To bring your system up-to-date, use 'zypper patch'.

Risk factor :

Critical / CVSS Base Score : 10.0
(CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 8.3
(CVSS2#E:F/RL:OF/RC:ND)
Public Exploit Available : true