SuSE 11.1 Security Update : IBM Java (SAT Patch Number 4024)

critical Nessus Plugin ID 52631

Language:

Synopsis

The remote SuSE 11 host is missing one or more security updates.

Description

IBM Java 1.4.2 SR13 was updated to FP8 to fix various bugs and security issues.

The following security issues were fixed :

- The kg_accept_krb5 function in krb5/accept_sec_context.c in the GSS-API library in MIT Kerberos 5 (aka krb5) through 1.7.1 and 1.8 before 1.8.2, as used in kadmind and other applications, does not properly check for invalid GSS-API tokens, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an AP-REQ message in which the authenticator's checksum field is missing. (CVE-2010-1321)

- Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU.
Oracle has not commented on claims from a reliable downstream vendor that HttpURLConnection does not properly check for the allowHttpTrace permission, which allows untrusted code to perform HTTP TRACE requests.
(CVE-2010-3574)

- The Java Runtime Environment hangs forever when converting '2.2250738585072012e-308' to a binary floating-point number. (CVE-2010-4476)

Solution

Apply SAT patch number 4024.

Plugin Details

Severity: Critical

ID: 52631

File Name: suse_11_java-1_4_2-ibm-110223.nasl

Version: 1.13

Type: local

Agent: unix

Family: SuSE Local Security Checks

Published: 3/11/2011

Updated: 1/19/2021

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.4

CVSS v2

Risk Factor: Critical

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:11:java-1_4_2-ibm, p-cpe:/a:novell:suse_linux:11:java-1_4_2-ibm-jdbc, p-cpe:/a:novell:suse_linux:11:java-1_4_2-ibm-plugin, cpe:/o:novell:suse_linux:11

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2/23/2011

Reference Information

CVE: CVE-2010-1321, CVE-2010-3574, CVE-2010-4476

Detections

Analytics