Sun Java JRE Multiple Vulnerabilities (269868 / 269869 / 270476 ...) (Unix)

high Nessus Plugin ID 64831


The remote Unix host contains a runtime environment that is affected by multiple vulnerabilities.


The version of Sun Java Runtime Environment (JRE) installed on the remote host is earlier than 6 Update 17 / 5.0 Update 22 / 1.4.2_24 / 1.3.1_27. Such versions are potentially affected by the following security issues :

- The Java update mechanism on non-English versions does not update the JRE when a new version is available.

- A command execution vulnerability exists in the Java runtime environment deployment toolkit. (269869)

- An issue in the Java web start installer may be leveraged to allow an untrusted Java web start application to run as a trusted application. (269870)

- Multiple buffer and integer overflow vulnerabilities exist. (270474)

- A security vulnerability in the JRE with verifying HMAC digests may allow authentication to be bypassed.

- Two vulnerabilities in the JRE with decoding DER encoded data and parsing HTTP headers may separately allow a remote client to cause the JRE on the server to run out of memory, resulting in a denial of service. (270476)

- A directory traversal vulnerability in the ICC_Profile.getInstance method allows a remote attacker to determine the existence of local International Color Consortium (ICC) profile files. (Bug #6631533)

- A denial of service attack is possible via a BMP file containing a link to a UNC share pathname for an International Color Consortium (ICC) profile file.
(Bug #6632445)

- Resurrected classloaders can still have children, which could allow a remote attacker to gain privileges via unspecified vectors (Bug #6636650)

- The Abstract Window Toolkit (AWT) does not properly restrict the objects that may be sent to loggers, which allows attackers to obtain sensitive information via vectors related to the implementation of Component, KeyboardFocusManager, and DefaultKeyboardFocusManager.
(Bug #6664512)

- An unspecified vulnerability in TrueType font parsing functionality may lead to a denial of service. (Bug #6815780)

- The failure to clone arrays returned by the getConfigurations function could lead to multiple, unspecified vulnerabilities in the X11 and Win32GraphicsDevice subsystems. (Bug #6822057)

- The TimeZone.getTimeZone method can be used by a remote attacker to determine the existence of local files via its handling of zoneinfo (aka tz) files. (Bug #6824265)

- Java Web Start does not properly handle the interaction between a signed JAR file and a JNLP application or applet. (Bug #6870531)


Update to Sun Java JDK / JRE 6 Update 17, JDK / JRE 5.0 Update 22, SDK / JRE 1.4.2_24, or SDK / JRE 1.3.1_27 or later and remove, if necessary, any affected versions.

See Also

Plugin Details

Severity: High

ID: 64831

File Name: sun_java_jre_269868_unix.nasl

Version: 1.10

Type: local

Family: Misc.

Published: 2/22/2013

Updated: 4/11/2022

Configuration: Enable thorough checks

Risk Information


Risk Factor: Critical

Score: 9.8


Risk Factor: High

Base Score: 9.3

Temporal Score: 8.1

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: cpe:/a:oracle:jre

Required KB Items: Host/Java/JRE/Installed

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 11/3/2009

Vulnerability Publication Date: 11/3/2009

Exploitable With


Core Impact

Metasploit (Sun Java JRE AWT setDiffICM Buffer Overflow)

Reference Information

CVE: CVE-2009-3728, CVE-2009-3729, CVE-2009-3864, CVE-2009-3865, CVE-2009-3866, CVE-2009-3867, CVE-2009-3868, CVE-2009-3869, CVE-2009-3871, CVE-2009-3872, CVE-2009-3873, CVE-2009-3874, CVE-2009-3875, CVE-2009-3876, CVE-2009-3877, CVE-2009-3879, CVE-2009-3880, CVE-2009-3881, CVE-2009-3884, CVE-2009-3885, CVE-2009-3886

BID: 36881

CWE: 22, 94, 119, 189, 200, 264, 310, 399