AIX Java Advisory : java_apr2014_advisory.asc

critical Nessus Plugin ID 76870

Language:

New! Vulnerability Priority Rating (VPR)

Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it is different from CVSS.

VPR Score: 6.5

Synopsis

The remote AIX host has a version of Java SDK installed that is potentially affected by multiple vulnerabilities.

Description

The version of Java SDK installed on the remote host is potentially affected by the following vulnerabilities :

 - There is an information disclosure flaw in libjpeg and libjpeg-turbo allowing remote attackers access to uninitialized memory via crafted JPEG images.
 (CVE-2013-6629)

 - A vulnerability in libpng allows denial of service attacks via a flaw in pngtran.c pngset.c.
 (CVE-2013-6954)

 - Vulnerabilities in Oracle Java allow remote code execution via flaws in 2D image handling.
 (CVE-2014-0429, CVE-2014-2401, CVE-2014-2421)

 - A vulnerability in Oracle Java allows remote code execution via a flaw in logger handling.
 (CVE-2014-0446)

 - Vulnerabilities in Oracle Java allow remote code execution via flaws in the Deployment subcomponent.
 (CVE-2014-0448, CVE-2014-0449, CVE-2014-2409, CVE-2014-2420, CVE-2014-2428)

 - A vulnerability in Oracle Java allows a remote attacker to bypass security features through flaws in AWT.
 (CVE-2014-0451, CVE-2014-2412)

 - A vulnerability in Oracle Java allows a remote attacker to bypass security features through flaws in W3CEndpointReference.java. (CVE-2014-0452)

 - An information disclosure vulnerability in Oracle Java RSAPadding allows a remote attacker to view timing information protected by encryption. (CVE-2014-0452)

 - A vulnerability in Oracle Java allows a remote attacker to modify the SIGNATURE_PRIMITIVE_SET through flaws in SignatureAndHalshAlgorithm and AlgorithmChecker.
 (CVE-2014-0454)

 - A vulnerability in Oracle Java allows remote code execution via a flaw in MethodHandles.java.
 (CVE-2014-0455)

 - A vulnerability in Oracle Java allows remote code execution via a flaw in exception handling.
 (CVE-2014-0457)

 - Vulnerabilities in Oracle Java allow a remote attacker to bypass security features through flaws in JAX-WS.
 (CVE-2014-0458, CVE-2014-2423)

 - An unspecified vulnerability exists in Oracle Java via sandboxed applications.
 (CVE-2014-0459)

 - A vulnerability in Oracle Java allows remote attackers to conduct spoofing attacks via a flaw in the DnsClient component. (CVE-2014-0460)

 - A vulnerability in Oracle Java allows remote code execution via a flaw in ScriptEngineManager.java.
 (CVE-2014-0461)

 - A vulnerability in Oracle Java allows a remote attacker to bypass security features through flaws in the random number generation of cryptographic protection.
 (CVE-2014-0878)

 - A privilege escalation vulnerability in Oracle Java allows remote attacks to overwrite arbitrary files via a flaw in unpack200. (CVE-2014-1876)

 - A vulnerability in Oracle Java allows remote code execution via a flaw in Javadoc. (CVE-2014-2398)

 - A vulnerability in Oracle Java allows a remote attacker to bypass security features through flaws in asynchronous channel handling across threads.
 (CVE-2014-2402)

 - Vulnerabilities in Oracle Java allow a remote attacker to bypass security features through flaws in JAXB.
 (CVE-2014-2414)

 - A vulnerability in Oracle Java allows a remote attacker to bypass security features through flaws in Java sound libraries. (CVE-2014-2427)

Solution

Fixes are available by version and can be downloaded from the AIX website.

See Also

http://www.nessus.org/u?63277512

http://www.nessus.org/u?aacaab25

http://www.nessus.org/u?70623e16

http://www.nessus.org/u?1d08dc51

http://www.nessus.org/u?4ca2561a

http://www.nessus.org/u?a624fae8

http://www.nessus.org/u?aa3fc787

http://www.nessus.org/u?e42e2673

http://www.nessus.org/u?ae6bb0ba

http://www.ibm.com/developerworks/java/jdk/aix/service.html#levels

Plugin Details

Severity: Critical

ID: 76870

File Name: aix_java_apr2014_advisory.nasl

Version: 1.13

Type: local

Published: 7/28/2014

Updated: 1/4/2021

Dependencies: ssh_get_info.nasl

Risk Information

Risk Factor: Critical

VPR Score: 6.5

CVSS v2.0

Base Score: 10

Temporal Score: 8.7

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: E:ND/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/o:ibm:aix, cpe:/a:oracle:java

Required KB Items: Host/AIX/lslpp, Host/local_checks_enabled, Host/AIX/version

Exploit Ease: No known exploits are available

Patch Publication Date: 6/19/2014

Vulnerability Publication Date: 10/28/2013

Reference Information

CVE: CVE-2013-6629, CVE-2013-6954, CVE-2014-0429, CVE-2014-0446, CVE-2014-0448, CVE-2014-0449, CVE-2014-0451, CVE-2014-0452, CVE-2014-0453, CVE-2014-0454, CVE-2014-0455, CVE-2014-0457, CVE-2014-0458, CVE-2014-0459, CVE-2014-0460, CVE-2014-0461, CVE-2014-0878, CVE-2014-1876, CVE-2014-2398, CVE-2014-2401, CVE-2014-2402, CVE-2014-2409, CVE-2014-2412, CVE-2014-2414, CVE-2014-2420, CVE-2014-2421, CVE-2014-2423, CVE-2014-2427, CVE-2014-2428

BID: 63676, 64493, 65568, 66856, 66866, 66870, 66873, 66879, 66881, 66883, 66887, 66891, 66894, 66898, 66899, 66902, 66903, 66904, 66905, 66907, 66909, 66910, 66911, 66914, 66915, 66916, 66919, 66920, 67601