Oracle Java SE Multiple Vulnerabilities (April 2017 CPU)

Medium Nessus Plugin ID 99588

Synopsis

The remote Windows host contains a programming platform that is affected by multiple vulnerabilities.

Description

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 6 Update 151, 7 Update 141, or 8 Update 131. It is, therefore, affected by multiple vulnerabilities :

- An unspecified flaw exists in the Networking subcomponent that allows an unauthenticated, remote attacker to impact confidentiality and integrity.
(CVE-2017-3509)

- An unspecified flaw exists in the JCE subcomponent that allows a local attacker to gain elevated privileges.
This vulnerability does not affect Java SE version 6.
(CVE-2017-3511)

- An unspecified flaw exists in the AWT subcomponent that allows an unauthenticated, remote attacker to execute arbitrary code. This vulnerability does not affect Java SE version 6. (CVE-2017-3512)

- An unspecified flaw exists in the AWT subcomponent that allows an unauthenticated, remote attacker to execute arbitrary code. (CVE-2017-3514)

- An unspecified flaw exists in the JAXP subcomponent that allows an unauthenticated, remote attacker to cause a denial of service condition. (CVE-2017-3526)

- Multiple unspecified flaws exist in the Networking subcomponent that allow an unauthenticated, remote attacker to gain update, insert, or delete access to unauthorized data. (CVE-2017-3533, CVE-2017-3544)

- An unspecified flaw exists in the Security subcomponent that allows an unauthenticated, remote attacker to gain update, insert, or delete access to unauthorized data.
(CVE-2017-3539)

Solution

Upgrade to Oracle JDK / JRE 6 Update 151 / 7 Update 141 / 8 Update 131 or later. If necessary, remove any affected versions.

Note that an Extended Support contract with Oracle is needed to obtain JDK / JRE 6 Update 95 or later.

See Also

http://www.nessus.org/u?02dc6498

http://www.nessus.org/u?ce35fa3a

http://www.nessus.org/u?2fbcacca

http://www.nessus.org/u?726f7054

http://www.nessus.org/u?eb4db3c7

Plugin Details

Severity: Medium

ID: 99588

File Name: oracle_java_cpu_apr_2017.nasl

Version: 1.8

Type: local

Agent: windows

Family: Windows

Published: 2017/04/21

Updated: 2019/11/14

Dependencies: 33545

Risk Information

Risk Factor: Medium

CVSS Score Source: CVE-2017-3514

CVSS v2.0

Base Score: 5.1

Temporal Score: 4

Vector: CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:POC/RL:OF/RC:C

CVSS v3.0

Base Score: 8.3

Temporal Score: 7.5

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:oracle:jre, cpe:/a:oracle:jdk

Required KB Items: SMB/Java/JRE/Installed

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2017/04/18

Vulnerability Publication Date: 2017/04/18

Reference Information

CVE: CVE-2017-3509, CVE-2017-3511, CVE-2017-3512, CVE-2017-3514, CVE-2017-3526, CVE-2017-3533, CVE-2017-3539, CVE-2017-3544

BID: 97727, 97729, 97731, 97733, 97737, 97740, 97745, 97752