The remote Mac OS X 10.5 host is running a version of Java for Mac OS X that is missing Update 4.

The remote version of this software contains several security vulnerabilities.  A remote attacker could exploit these issues to bypass security restrictions, disclose sensitive information, cause a denial of service, or escalate privileges.

It was discovered that font creation could leak temporary files. If a user were tricked into loading a malicious program or applet, a remote attacker could consume disk space, leading to a denial of service.
(CVE-2006-2426, CVE-2009-1100)

It was discovered that the lightweight HttpServer did not correctly close files on dataless connections. A remote attacker could send specially crafted requests, leading to a denial of service.
(CVE-2009-1101)

The Java Runtime Environment did not correctly validate certain generated code. If a user were tricked into running a malicious applet a remote attacker could execute arbitrary code. (CVE-2009-1102)

It was discovered that LDAP connections did not close correctly. A remote attacker could send specially crafted requests, leading to a denial of service. (CVE-2009-1093)

Java LDAP routines did not unserialize certain data correctly. A remote attacker could send specially crafted requests that could lead to arbitrary code execution. (CVE-2009-1094)

Java did not correctly check certain JAR headers. If a user or automated system were tricked into processing a malicious JAR file, a remote attacker could crash the application, leading to a denial of service. (CVE-2009-1095, CVE-2009-1096)

It was discovered that PNG and GIF decoding in Java could lead to memory corruption. If a user or automated system were tricked into processing a specially crafted image, a remote attacker could crash the application, leading to a denial of service. (CVE-2009-1097, CVE-2009-1098).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated java-1.6.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 4 Extras and 5 Supplementary.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

The IBM 1.6.0 Java release includes the IBM Java 2 Runtime Environment and the IBM Java 2 Software Development Kit.

This update fixes several vulnerabilities in the IBM Java 2 Runtime Environment and the IBM Java 2 Software Development Kit. These vulnerabilities are summarized on the IBM 'Security alerts' page listed in the References section. (CVE-2009-1093, CVE-2009-1094, CVE-2009-1095, CVE-2009-1096, CVE-2009-1097, CVE-2009-1098, CVE-2009-1099, CVE-2009-1100, CVE-2009-1101, CVE-2009-1103, CVE-2009-1104, CVE-2009-1105, CVE-2009-1106, CVE-2009-1107)

All users of java-1.6.0-ibm are advised to upgrade to these updated packages, containing the IBM 1.6.0 SR5 Java release. All running instances of IBM Java must be restarted for the update to take effect.

IBM Java 6 SR 5 was released fixing various bugs and critical security issues :

  - A vulnerability in the Java Runtime Environment (JRE)     with initializing LDAP connections may be exploited by a     remote client to cause a denial-of-service condition on     the LDAP service. (CVE-2009-1093)

  - A vulnerability in Java Runtime Environment LDAP client     implementation may allow malicious data from an LDAP     server to cause malicious code to be unexpectedly loaded     and executed on an LDAP client. (CVE-2009-1094)

  - Buffer overflow vulnerabilities in the Java Runtime     Environment (JRE) with unpacking applets and Java Web     Start applications using the unpack200 JAR unpacking     utility may allow an untrusted applet or application to     escalate privileges. For example, an untrusted applet     may grant itself permissions to read and write local     files or execute local applications that are accessible     to the user running the untrusted applet. (CVE-2009-1095     / CVE-2009-1096)

  - A buffer overflow vulnerability in the Java Runtime     Environment with processing PNG images may allow an     untrusted Java Web Start application to escalate     privileges. For example, an untrusted application may     grant itself permissions to read and write local files     or execute local applications that are accessible to the     user running the untrusted application. (CVE-2009-1097)

  - A buffer overflow vulnerability in the Java Runtime     Environment with processing GIF images may allow an     untrusted Java Web Start application to escalate     privileges. For example, an untrusted application may     grant itself permissions to read and write local files     or execute local applications that are accessible to the     user running the untrusted application. (CVE-2009-1097)

  - A buffer overflow vulnerability in the Java Runtime     Environment with processing GIF images may allow an     untrusted applet or Java Web Start application to     escalate privileges. For example, an untrusted applet     may grant itself permissions to read and write local     files or execute local applications that are accessible     to the user running the untrusted applet.
    (CVE-2009-1098)

  - A buffer overflow vulnerability in the Java Runtime     Environment with processing fonts may allow an untrusted     applet or Java Web Start application to escalate     privileges. For example, an untrusted applet may grant     itself permissions to read and write local files or     execute local applications that are accessible to the     user running the untrusted applet. (CVE-2009-1099)

  - A vulnerability in the Java Runtime Environment (JRE)     with storing temporary font files may allow an untrusted     applet or application to consume a disproportionate     amount of disk space resulting in a denial-of-service     condition. (CVE-2009-1100)

  - A vulnerability in the Java Runtime Environment (JRE)     with processing temporary font files may allow an     untrusted applet or application to retain temporary     files resulting in a denial-of-service condition.
    (CVE-2009-1100)

  - A vulnerability in the Java Runtime Environment (JRE)     HTTP server implementation may allow a remote client to     create a denial-of-service condition on a JAX-WS service     endpoint that runs on the JRE. (CVE-2009-1101)

  - A vulnerability in the Java Plug-in with deserializing     applets may allow an untrusted applet to escalate     privileges. For example, an untrusted applet may grant     itself permissions to read and write local files or     execute local applications that are accessible to the     user running the untrusted applet. (CVE-2009-1103)

  - The Java Plug-in allows JavaScript code that is loaded     from the localhost to connect to any port on the system.
    This may be leveraged together with XSS vulnerabilities     in a blended attack to access other applications     listening on ports other than the one where the     JavaScript code was served from. (CVE-2009-1104)

  - The Java Plug-in allows a trusted applet to be launched     on an earlier version of the Java Runtime Environment     (JRE) provided the user that downloaded the applet     allows it to run on the requested release. A     vulnerability allows JavaScript code that is present in     the same web page as the applet to exploit known     vulnerabilities of the requested JRE. (CVE-2009-1105)

  - A vulnerability in the Java Runtime Environment with     parsing crossdomain.xml files may allow an untrusted     applet to connect to any site that provides a     crossdomain.xml file instead of sites that allow the     domain that the applet is running on. (CVE-2009-1106)

  - The Java Plugin displays a warning dialog for signed     applets. A signed applet can obscure the contents of the     dialog and trick a user into trusting the applet.
    (CVE-2009-1107)

a. Service Console update for DHCP and third-party library update    for DHCP client.

   DHCP is an Internet-standard protocol by which a computer can be    connected to a local network, ask to be given configuration    information, and receive from a server enough information to    configure itself as a member of that network.

   A stack-based buffer overflow in the script_write_params method in    ISC DHCP dhclient allows remote DHCP servers to execute arbitrary    code via a crafted subnet-mask option.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-0692 to this issue.

   An insecure temporary file use flaw was discovered in the DHCP    daemon's init script ('/etc/init.d/dhcpd'). A local attacker could    use this flaw to overwrite an arbitrary file with the output of the    'dhcpd -t' command via a symbolic link attack, if a system    administrator executed the DHCP init script with the 'configtest',    'restart', or 'reload' option.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-1893 to this issue.

b. Updated Service Console package kernel

   Service Console package kernel update to version    kernel-2.4.21-58.EL.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2008-4210, CVE-2008-3275, CVE-2008-0598,    CVE-2008-2136, CVE-2008-2812, CVE-2007-6063, CVE-2008-3525 to the    security issues fixed in kernel-2.4.21-58.EL

c. JRE Security Update

   JRE update to version 1.5.0_18, which addresses multiple security    issues that existed in earlier releases of JRE.

   The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the following names to the security issues fixed in    JRE 1.5.0_17: CVE-2008-2086, CVE-2008-5347, CVE-2008-5348,    CVE-2008-5349, CVE-2008-5350, CVE-2008-5351, CVE-2008-5352,    CVE-2008-5353, CVE-2008-5354, CVE-2008-5356, CVE-2008-5357,    CVE-2008-5358, CVE-2008-5359, CVE-2008-5360, CVE-2008-5339,    CVE-2008-5342, CVE-2008-5344, CVE-2008-5345, CVE-2008-5346,    CVE-2008-5340, CVE-2008-5341, CVE-2008-5343, and CVE-2008-5355.

   The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the following names to the security issues fixed in    JRE 1.5.0_18: CVE-2009-1093, CVE-2009-1094, CVE-2009-1095,    CVE-2009-1096, CVE-2009-1097, CVE-2009-1098, CVE-2009-1099,    CVE-2009-1100, CVE-2009-1101, CVE-2009-1102, CVE-2009-1103,    CVE-2009-1104, CVE-2009-1105, CVE-2009-1106, and CVE-2009-1107.

Updated java-1.6.0-ibm packages that fix several security issues are now available for Red Hat Network Satellite Server 5.3.

This update has been rated as having low security impact by the Red Hat Security Response Team.

This update corrects several security vulnerabilities in the IBM Java Runtime Environment shipped as part of Red Hat Network Satellite Server 5.3. In a typical operating environment, these are of low security risk as the runtime is not used on untrusted applets.

Several flaws were fixed in the IBM Java 2 Runtime Environment.
(CVE-2009-0217, CVE-2009-1093, CVE-2009-1094, CVE-2009-1095, CVE-2009-1096, CVE-2009-1097, CVE-2009-1098, CVE-2009-1099, CVE-2009-1100, CVE-2009-1101, CVE-2009-1103, CVE-2009-1104, CVE-2009-1105, CVE-2009-1106, CVE-2009-1107, CVE-2009-2625, CVE-2009-2670, CVE-2009-2671, CVE-2009-2672, CVE-2009-2673, CVE-2009-2674, CVE-2009-2675, CVE-2009-2676, CVE-2009-3865, CVE-2009-3866, CVE-2009-3867, CVE-2009-3868, CVE-2009-3869, CVE-2009-3871, CVE-2009-3872, CVE-2009-3873, CVE-2009-3874, CVE-2009-3875, CVE-2009-3876, CVE-2009-3877)

Users of Red Hat Network Satellite Server 5.3 are advised to upgrade to these updated java-1.6.0-ibm packages, which resolve these issues.
For this update to take effect, Red Hat Network Satellite Server must be restarted ('/usr/sbin/rhn-satellite restart'), as well as all running instances of IBM Java.

ID	Name	Product	Family	Published	Updated	Severity
39435	Mac OS X : Java for Mac OS X 10.5 Update 4	Nessus	MacOS X Local Security Checks	6/17/2009	7/24/2024	high
36366	Ubuntu 8.10 : openjdk-6 vulnerabilities (USN-748-1)	Nessus	Ubuntu Local Security Checks	4/23/2009	1/19/2021	critical
40747	RHEL 4 / 5 : java-1.6.0-ibm (RHSA-2009:1198)	Nessus	Red Hat Local Security Checks	8/24/2009	1/14/2021	critical
41406	SuSE 11 Security Update : IBM Java 1.6.0 (SAT Patch Number 1058)	Nessus	SuSE Local Security Checks	9/24/2009	1/14/2021	critical
42179	VMSA-2009-0014 : VMware ESX patches for DHCP, Service Console kernel, and JRE resolve multiple security issues	Nessus	VMware ESX Local Security Checks	10/19/2009	1/6/2021	high
44029	RHEL 4 / 5 : IBM Java Runtime in Satellite Server (RHSA-2010:0043)	Nessus	Red Hat Local Security Checks	1/15/2010	1/14/2021	critical

Detections

Analytics

Plugins Search

high

critical

critical

critical

high

critical