Oracle JRockit R28.3.12 Multiple Vulnerabilities (January 2017 CPU)

This script is Copyright (C) 2017 Tenable Network Security, Inc.


Synopsis :

A programming platform installed on the remote Windows host is
affected by multiple vulnerabilities.

Description :

The version of Oracle JRockit installed on the remote Windows host is
R28.3.12. It is, therefore, affected by multiple vulnerabilities :

- An unspecified flaw exists in the Libraries subcomponent
that allows an unauthenticated, remote attacker to
impact integrity. (CVE-2016-5546)

- An unspecified flaw exists in the Libraries subcomponent
that allows an unauthenticated, remote attacker to cause
a denial of service condition. (CVE-2016-5547)

- An unspecified flaw exists in the Networking
subcomponent that allows an unauthenticated, remote
attacker to impact integrity. (CVE-2016-5552)

- An unspecified flaw exists in the RMI subcomponent that
allows an unauthenticated, remote attacker to execute
arbitrary code. (CVE-2017-3241)

- An unspecified flaw exists in the JAAS subcomponent that
allows an unauthenticated, remote attacker to impact
integrity. (CVE-2017-3252)

- An unspecified flaw exists in the 2D subcomponent that
allows an unauthenticated, remote attacker to cause a
denial of service condition. (CVE-2017-3253)

Note that CVE-2017-3241 can only be exploited by supplying
data to APIs in the specified component without using
untrusted Java Web Start applications or untrusted Java
applets, such as through a web service. Note that
CVE-2016-5546, CVE-2016-5547, CVE-2016-5552, CVE-2017-3252,
and CVE-2017-3253 can be exploited through sandboxed Java
Web Start applications and sandboxed Java applets. They can
also be exploited by supplying data to APIs in the specified
component without using sandboxed Java Web Start
applications or sandboxed Java applets, such as through a
web service.

See also :

http://www.nessus.org/u?951bfdb7

Solution :

Upgrade to Oracle JRockit version R28.3.13 or later as referenced in
the January 2017 Oracle Critical Patch Update advisory.

Risk factor :

High / CVSS Base Score : 7.6
(CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 6.0
(CVSS2#E:POC/RL:OF/RC:ND)
Public Exploit Available : true

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now