Sun Java JRE Multiple Vulnerabilities (263408 / 263409 / 263428 ..) (Unix)
critical Nessus Plugin ID 64830
Language:
New! Plugin Severity Now Using CVSS v3
The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Synopsis
The remote Unix host contains a runtime environment that is affected by multiple vulnerabilities.Description
The version of Sun Java Runtime Environment (JRE) installed on the remote host is earlier than 6 Update 15 / 5.0 Update 20 / 1.4.2_22 / 1.3.1_26. Such version are potentially affected by the following security issues :- A vulnerability in the JRE audio system may allow system properties to be accessed. (263408)
- A privilege escalation vulnerability may exist in the JRE SOCKS proxy implementation. (263409)
- An integer overflow vulnerability when parsing JPEG images may allow an untrusted Java Web Start application to elevate privileges. (263428)
- A vulnerability with verifying HMAC-based XML digital signatures in the XML Digital Signature implementation may allow authentication to be bypassed. (263429)
- An integer overflow vulnerability with unpacking applets and Java Web start applications using the 'unpack200' JAR unpacking utility may allow an untrusted applet to elevate privileges. (263488)
- An issue with parsing XML data may allow a remote client to create a denial of service condition. (263489)
- Non-current versions of the 'JNLPAppletLauncher' may be re-purposed with an untrusted Java applet to write arbitrary files. (263490)
Solution
Update to Sun Java JDK / JRE 6 Update 15, JDK / JRE 5.0 Update 20, SDK / JRE 1.4.2_22, or SDK / JRE 1.3.1_26 or later and remove, if necessary, any affected versions.See Also
https://download.oracle.com/sunalerts/1020707.1.html
https://download.oracle.com/sunalerts/1020708.1.html
https://download.oracle.com/sunalerts/1020709.1.html
https://download.oracle.com/sunalerts/1020710.1.html
https://download.oracle.com/sunalerts/1020712.1.html
Plugin Details
Severity: Critical
ID: 64830
File Name: sun_java_jre_263408_unix.nasl
Version: 1.9
Type: local
Family: Misc.
Published: 2/22/2013
Updated: 12/4/2019
Dependencies: sun_java_jre_installed_unix.nasl
Risk Information
CVSS Score Source: CVE-2009-2675
VPR
Risk Factor: High
Score: 7.7
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 7.4
Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Temporal Vector: E:U/RL:OF/RC:C
Vulnerability Information
CPE: cpe:/a:oracle:jre
Required KB Items: Host/Java/JRE/Installed
Exploit Ease: No known exploits are available
Patch Publication Date: 8/5/2009
Vulnerability Publication Date: 8/5/2009
Reference Information
CVE: CVE-2009-0217, CVE-2009-2625, CVE-2009-2670, CVE-2009-2671, CVE-2009-2672, CVE-2009-2673, CVE-2009-2674, CVE-2009-2675, CVE-2009-2676
CWE: 264