RHEL 5 / 6 : java-1.7.0-oracle (RHSA-2014:0030)

medium Nessus Plugin ID 71987

Language:

Synopsis

The remote Red Hat host is missing one or more security updates for java-1.7.0-oracle.

Description

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:0030 advisory.

- OpenJDK: jarsigner does not detect unsigned bytecode injected into signed jars (CVE-2013-4578)

- Oracle JDK: multiple unspecified vulnerabilities fixed in 7u51 (JavaFX) (CVE-2013-5870, CVE-2013-5895, CVE-2014-0382)

- OpenJDK: null xmlns handling issue (Security, 8025026) (CVE-2013-5878)

- OpenJDK: insufficient security checks in CORBA stub factories (CORBA, 8026193) (CVE-2013-5884)

- Oracle JDK: unspecified vulnerability fixed in 6u71 and 7u51 (Deployment) (CVE-2013-5887, CVE-2013-5888, CVE-2013-5889, CVE-2013-5898, CVE-2013-5899, CVE-2013-5902, CVE-2014-0375, CVE-2014-0387, CVE-2014-0403, CVE-2014-0410, CVE-2014-0415, CVE-2014-0418, CVE-2014-0424)

- OpenJDK: JVM method processing issues (Libraries, 8029507) (CVE-2013-5893)

- OpenJDK: com.sun.corba.se. should be restricted package (CORBA, 8025022) (CVE-2013-5896)

- Oracle JDK: unspecified vulnerability fixed in 7u51 (Deployment) (CVE-2013-5904)

- Oracle JDK: unspecified vulnerability fixed in 5.0u71, 6u71 and 7u51 (Install) (CVE-2013-5905, CVE-2013-5906)

- ICU: Layout Engine LookupProcessor insufficient input checks (JDK 2D, 8025034) (CVE-2013-5907)

- OpenJDK: XML canonicalizer mutable strings passed to untrusted code (Security, 8026417) (CVE-2013-5910)

- OpenJDK: insufficient Socket checkListen checks (Networking, 8011786) (CVE-2014-0368)

- OpenJDK: SnmpStatusException handling issues (Serviceability, 7068126) (CVE-2014-0373)

- OpenJDK: document builder missing security checks (JAXP, 8027201, 8025018) (CVE-2014-0376)

- OpenJDK: TLS/SSL handshake timing issues (JSSE, 8023069) (CVE-2014-0411)

- OpenJDK: insecure subject principals set handling (JAAS, 8024306) (CVE-2014-0416)

- Oracle JDK: unspecified vulnerability fixed in 5.0u71, 6u71 and 7u51 (2D) (CVE-2014-0417)

- OpenJDK: insufficient package access checks in the Naming component (JNDI, 8025758) (CVE-2014-0422)

- OpenJDK: XXE issue in decoder (Beans, 8023245) (CVE-2014-0423)

- OpenJDK: insufficient security checks in IIOP streams (CORBA, 8025767) (CVE-2014-0428)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the RHEL java-1.7.0-oracle package based on the guidance in RHSA-2014:0030.

Plugin Details

Severity: Medium

ID: 71987

File Name: redhat-RHSA-2014-0030.nasl

Version: 1.19

Type: local

Agent: unix

Family: Red Hat Local Security Checks

Published: 1/16/2014

Updated: 4/24/2024

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.5

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2014-0428

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS Score Source: CVE-2013-4578

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:java-1.7.0-oracle, p-cpe:/a:redhat:enterprise_linux:java-1.7.0-oracle-devel, p-cpe:/a:redhat:enterprise_linux:java-1.7.0-oracle-javafx, p-cpe:/a:redhat:enterprise_linux:java-1.7.0-oracle-jdbc, p-cpe:/a:redhat:enterprise_linux:java-1.7.0-oracle-plugin, p-cpe:/a:redhat:enterprise_linux:java-1.7.0-oracle-src, cpe:/o:redhat:enterprise_linux:5, cpe:/o:redhat:enterprise_linux:6

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Exploit Ease: No known exploits are available

Patch Publication Date: 1/15/2014

Reference Information

CVE: CVE-2013-4578, CVE-2013-5870, CVE-2013-5878, CVE-2013-5884, CVE-2013-5887, CVE-2013-5888, CVE-2013-5889, CVE-2013-5893, CVE-2013-5895, CVE-2013-5896, CVE-2013-5898, CVE-2013-5899, CVE-2013-5902, CVE-2013-5904, CVE-2013-5905, CVE-2013-5906, CVE-2013-5907, CVE-2013-5910, CVE-2014-0368, CVE-2014-0373, CVE-2014-0375, CVE-2014-0376, CVE-2014-0382, CVE-2014-0387, CVE-2014-0403, CVE-2014-0410, CVE-2014-0411, CVE-2014-0415, CVE-2014-0416, CVE-2014-0417, CVE-2014-0418, CVE-2014-0422, CVE-2014-0423, CVE-2014-0424, CVE-2014-0428

BID: 64863, 64875, 64882, 64890, 64894, 64899, 64903, 64906, 64907, 64912, 64914, 64915, 64916, 64917, 64918, 64919, 64920, 64921, 64922, 64923, 64924, 64925, 64926, 64927, 64928, 64929, 64930, 64931, 64932, 64933, 64934, 64935, 64936, 64937

RHSA: 2014:0030

Detections

Analytics