RHEL 4 / 5 : IBM Java Runtime in Satellite Server (RHSA-2010:0043)

Critical Nessus Plugin ID 44029

New! Vulnerability Priority Rating (VPR)

Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it's different from CVSS.

VPR Score: 9.5

Synopsis

The remote Red Hat host is missing one or more security updates.

Description

Updated java-1.6.0-ibm packages that fix several security issues are now available for Red Hat Network Satellite Server 5.3.

This update has been rated as having low security impact by the Red Hat Security Response Team.

This update corrects several security vulnerabilities in the IBM Java Runtime Environment shipped as part of Red Hat Network Satellite Server 5.3. In a typical operating environment, these are of low security risk as the runtime is not used on untrusted applets.

Several flaws were fixed in the IBM Java 2 Runtime Environment.
(CVE-2009-0217, CVE-2009-1093, CVE-2009-1094, CVE-2009-1095, CVE-2009-1096, CVE-2009-1097, CVE-2009-1098, CVE-2009-1099, CVE-2009-1100, CVE-2009-1101, CVE-2009-1103, CVE-2009-1104, CVE-2009-1105, CVE-2009-1106, CVE-2009-1107, CVE-2009-2625, CVE-2009-2670, CVE-2009-2671, CVE-2009-2672, CVE-2009-2673, CVE-2009-2674, CVE-2009-2675, CVE-2009-2676, CVE-2009-3865, CVE-2009-3866, CVE-2009-3867, CVE-2009-3868, CVE-2009-3869, CVE-2009-3871, CVE-2009-3872, CVE-2009-3873, CVE-2009-3874, CVE-2009-3875, CVE-2009-3876, CVE-2009-3877)

Users of Red Hat Network Satellite Server 5.3 are advised to upgrade to these updated java-1.6.0-ibm packages, which resolve these issues.
For this update to take effect, Red Hat Network Satellite Server must be restarted ('/usr/sbin/rhn-satellite restart'), as well as all running instances of IBM Java.

Solution

Update the affected java-1.6.0-ibm and / or java-1.6.0-ibm-devel packages.

See Also

https://access.redhat.com/security/cve/cve-2009-0217

https://access.redhat.com/security/cve/cve-2009-1093

https://access.redhat.com/security/cve/cve-2009-1094

https://access.redhat.com/security/cve/cve-2009-1095

https://access.redhat.com/security/cve/cve-2009-1096

https://access.redhat.com/security/cve/cve-2009-1097

https://access.redhat.com/security/cve/cve-2009-1098

https://access.redhat.com/security/cve/cve-2009-1099

https://access.redhat.com/security/cve/cve-2009-1100

https://access.redhat.com/security/cve/cve-2009-1101

https://access.redhat.com/security/cve/cve-2009-1103

https://access.redhat.com/security/cve/cve-2009-1104

https://access.redhat.com/security/cve/cve-2009-1105

https://access.redhat.com/security/cve/cve-2009-1106

https://access.redhat.com/security/cve/cve-2009-1107

https://access.redhat.com/security/cve/cve-2009-2625

https://access.redhat.com/security/cve/cve-2009-2670

https://access.redhat.com/security/cve/cve-2009-2671

https://access.redhat.com/security/cve/cve-2009-2672

https://access.redhat.com/security/cve/cve-2009-2673

https://access.redhat.com/security/cve/cve-2009-2674

https://access.redhat.com/security/cve/cve-2009-2675

https://access.redhat.com/security/cve/cve-2009-2676

https://access.redhat.com/security/cve/cve-2009-3865

https://access.redhat.com/security/cve/cve-2009-3866

https://access.redhat.com/security/cve/cve-2009-3867

https://access.redhat.com/security/cve/cve-2009-3868

https://access.redhat.com/security/cve/cve-2009-3869

https://access.redhat.com/security/cve/cve-2009-3871

https://access.redhat.com/security/cve/cve-2009-3872

https://access.redhat.com/security/cve/cve-2009-3873

https://access.redhat.com/security/cve/cve-2009-3874

https://access.redhat.com/security/cve/cve-2009-3875

https://access.redhat.com/security/cve/cve-2009-3876

https://access.redhat.com/security/cve/cve-2009-3877

https://access.redhat.com/errata/RHSA-2010:0043

Plugin Details

Severity: Critical

ID: 44029

File Name: redhat-RHSA-2010-0043.nasl

Version: 1.36

Type: local

Agent: unix

Published: 2010/01/15

Updated: 2021/01/14

Dependencies: 12634

Risk Information

Risk Factor: Critical

VPR Score: 9.5

CVSS v2.0

Base Score: 10

Temporal Score: 8.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:H/RL:OF/RC:C

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:java-1.6.0-ibm, p-cpe:/a:redhat:enterprise_linux:java-1.6.0-ibm-devel, cpe:/o:redhat:enterprise_linux:4, cpe:/o:redhat:enterprise_linux:5

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2010/01/14

Vulnerability Publication Date: 2009/03/25

Exploitable With

CANVAS (CANVAS)

Core Impact

Metasploit (Sun Java JRE AWT setDiffICM Buffer Overflow)

Reference Information

CVE: CVE-2009-0217, CVE-2009-1093, CVE-2009-1094, CVE-2009-1095, CVE-2009-1096, CVE-2009-1097, CVE-2009-1098, CVE-2009-1099, CVE-2009-1100, CVE-2009-1101, CVE-2009-1103, CVE-2009-1104, CVE-2009-1105, CVE-2009-1106, CVE-2009-1107, CVE-2009-2625, CVE-2009-2670, CVE-2009-2671, CVE-2009-2672, CVE-2009-2673, CVE-2009-2674, CVE-2009-2675, CVE-2009-2676, CVE-2009-3403, CVE-2009-3865, CVE-2009-3866, CVE-2009-3867, CVE-2009-3868, CVE-2009-3869, CVE-2009-3871, CVE-2009-3872, CVE-2009-3873, CVE-2009-3874, CVE-2009-3875, CVE-2009-3876, CVE-2009-3877, CVE-2010-0079

BID: 34240, 35671, 35939, 35942, 35943, 35944, 35946, 35958, 36881

RHSA: 2010:0043

CWE: 16, 20, 94, 119, 189, 264, 310, 399