Sun Java JRE Multiple Vulnerabilities (269868 / 269869 / 270476 ..)
high Nessus Plugin ID 42373
New! Plugin Severity Now Using CVSS v3
The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Synopsis
The remote Windows host contains a runtime environment that is affected by multiple vulnerabilities.Description
The version of Sun Java Runtime Environment (JRE) installed on the remote host is earlier than 6 Update 17 / 5.0 Update 22 / 1.4.2_24 / 1.3.1_27. Such versions are potentially affected by the following security issues :- The Java update mechanism on non-English versions does not update the JRE when a new version is available.
(269868)
- A command execution vulnerability exists in the Java runtime environment deployment toolkit. (269869)
- An issue in the Java web start installer may be leveraged to allow an untrusted Java web start application to run as a trusted application. (269870)
- Multiple buffer and integer overflow vulnerabilities.
(270474)
- A security vulnerability in the JRE with verifying HMAC digests may allow authentication to be bypassed. (270475)
- Two vulnerabilities in the JRE with decoding DER encoded data and parsing HTTP headers may separately allow a remote client to cause the JRE on the server to run out of memory, resulting in a denial of service. (270476)
- A directory traversal vulnerability in the ICC_Profile.getInstance method allows a remote attacker to determine the existence of local International Color Consortium (ICC) profile files. (Bug #6631533)
- A denial of service attack is possible via a BMP file containing a link to a UNC share pathname for an International Color Consortium (ICC) profile file. (Bug #6632445)
- Resurrected classloaders can still have children, which could allow a remote attacker to gain privileges via unspecified vectors. (Bug #6636650)
- The Abstract Window Toolkit (AWT) does not properly restrict the objects that may be sent to loggers, which allows attackers to obtain sensitive information via vectors related to the implementation of Component, KeyboardFocusManager, and DefaultKeyboardFocusManager. (Bug #6664512)
- An unspecified vulnerability in TrueType font parsing functionality may lead to a denial of service. (Bug #6815780)
- The failure to clone arrays returned by the getConfigurations function could lead to multiple, unspecified vulnerabilities in the X11 and Win32GraphicsDevice subsystems. (Bug #6822057)
- The TimeZone.getTimeZone method can be used by a remote attacker to determine the existence of local files via its handling of zoneinfo (aka tz) files. (Bug #6824265)
- Java Web Start does not properly handle the interaction between a signed JAR file and a JNLP application or applet. (Bug #6870531)
Solution
Update to Sun Java JDK / JRE 6 Update 17, JDK / JRE 5.0 Update 22, SDK / JRE 1.4.2_24, or SDK / JRE 1.3.1_27 or later and remove, if necessary, any affected versions.See Also
https://download.oracle.com/sunalerts/1021046.1.html
https://download.oracle.com/sunalerts/1021046.1.html
https://download.oracle.com/sunalerts/1021048.1.html
https://download.oracle.com/sunalerts/1021048.1.html
Plugin Details
Severity: High
ID: 42373
File Name: sun_java_jre_269868.nasl
Version: 1.28
Type: local
Agent: windows
Family: Windows
Published: 11/4/2009
Updated: 11/15/2018
Dependencies: sun_java_jre_installed.nasl
Risk Information
VPR
Risk Factor: Critical
Score: 9.9
CVSS v2
Risk Factor: High
Base Score: 9.3
Temporal Score: 8.1
Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Temporal Vector: E:H/RL:OF/RC:C
CVSS v3
Risk Factor: High
Base Score: 8.8
Temporal Score: 8.4
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Temporal Vector: E:H/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:oracle:jre
Required KB Items: SMB/Java/JRE/Installed
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 11/3/2009
Vulnerability Publication Date: 11/3/2009
Exploitable With
CANVAS (CANVAS)
Core Impact
Metasploit (Sun Java JRE AWT setDiffICM Buffer Overflow)
Reference Information
CVE: CVE-2009-3728, CVE-2009-3729, CVE-2009-3864, CVE-2009-3865, CVE-2009-3866, CVE-2009-3867, CVE-2009-3868, CVE-2009-3869, CVE-2009-3871, CVE-2009-3872, CVE-2009-3873, CVE-2009-3874, CVE-2009-3875, CVE-2009-3876, CVE-2009-3877, CVE-2009-3879, CVE-2009-3880, CVE-2009-3881, CVE-2009-3884, CVE-2009-3885, CVE-2009-3886
BID: 36881