Security fix for CVE-2014-6585 CVE-2014-6591 CVE-2014-7923 CVE-2014-7926 CVE-2014-9654

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in the execution of arbitrary code, information disclosure or denial of service.

The version of Oracle Java SE or Java for Business installed on the remote host is prior to 8 Update 31, 7 Update 75, 6 Update 91, or 5 Update 81. It is, therefore, affected by security vulnerabilities in the following components :

  - 2D
  - Deployment
  - Hotspot
  - Install
  - JAX-WS
  - JSSE
  - Libraries
  - RMI
  - Security
  - Serviceability
  - Swing

The remote Redhat Enterprise Linux 5 / 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:0085 advisory.

    The java-1.6.0-openjdk packages provide the OpenJDK 6 Java Runtime     Environment and the OpenJDK 6 Java Software Development Kit.

    A flaw was found in the way the Hotspot component in OpenJDK verified     bytecode from the class files. An untrusted Java application or applet     could possibly use this flaw to bypass Java sandbox restrictions.
    (CVE-2014-6601)

    Multiple improper permission check issues were discovered in the JAX-WS,     and RMI components in OpenJDK. An untrusted Java application or applet     could use these flaws to bypass Java sandbox restrictions. (CVE-2015-0412,     CVE-2015-0408)

    A flaw was found in the way the Hotspot garbage collector handled phantom     references. An untrusted Java application or applet could use this flaw to     corrupt the Java Virtual Machine memory and, possibly, execute arbitrary     code, bypassing Java sandbox restrictions. (CVE-2015-0395)

    A flaw was found in the way the DER (Distinguished Encoding Rules) decoder     in the Security component in OpenJDK handled negative length values. A     specially crafted, DER-encoded input could cause a Java application to     enter an infinite loop when decoded. (CVE-2015-0410)

    A flaw was found in the way the SSL 3.0 protocol handled padding bytes when     decrypting messages that were encrypted using block ciphers in cipher block     chaining (CBC) mode. This flaw could possibly allow a man-in-the-middle     (MITM) attacker to decrypt portions of the cipher text using a padding     oracle attack. (CVE-2014-3566)

    Note: This update disables SSL 3.0 by default to address this issue.
    The jdk.tls.disabledAlgorithms security property can be used to re-enable     SSL 3.0 support if needed. For additional information, refer to the Red Hat     Bugzilla bug linked to in the References section.

    It was discovered that the SSL/TLS implementation in the JSSE component in     OpenJDK failed to properly check whether the ChangeCipherSpec was received     during the SSL/TLS connection handshake. An MITM attacker could possibly     use this flaw to force a connection to be established without encryption     being enabled. (CVE-2014-6593)

    An information leak flaw was found in the Swing component in OpenJDK. An     untrusted Java application or applet could use this flaw to bypass certain     Java sandbox restrictions. (CVE-2015-0407)

    A NULL pointer dereference flaw was found in the MulticastSocket     implementation in the Libraries component of OpenJDK. An untrusted Java     application or applet could possibly use this flaw to bypass certain Java     sandbox restrictions. (CVE-2014-6587)

    Multiple boundary check flaws were found in the font parsing code in the 2D     component in OpenJDK. A specially crafted font file could allow an     untrusted Java application or applet to disclose portions of the Java     Virtual Machine memory. (CVE-2014-6585, CVE-2014-6591)

    Multiple insecure temporary file use issues were found in the way the     Hotspot component in OpenJDK created performance statistics and error log     files. A local attacker could possibly make a victim using OpenJDK     overwrite arbitrary files using a symlink attack. (CVE-2015-0383)

    The CVE-2015-0383 issue was discovered by Red Hat.

    All users of java-1.6.0-openjdk are advised to upgrade to these updated     packages, which resolve these issues. All running instances of OpenJDK Java     must be restarted for the update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated java-1.7.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 5 Supplementary.

Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

IBM Java SE version 7 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Detailed vulnerability descriptions are linked from the IBM Security alerts page, listed in the References section. (CVE-2014-6549, CVE-2014-6585, CVE-2014-6587, CVE-2014-6591, CVE-2014-6593, CVE-2014-8891, CVE-2014-8892, CVE-2015-0403, CVE-2015-0406, CVE-2015-0407, CVE-2015-0408, CVE-2015-0410, CVE-2015-0412)

All users of java-1.7.0-ibm are advised to upgrade to these updated packages, containing the IBM Java SE 7 SR8-FP10 release. All running instances of IBM Java must be restarted for the update to take effect.

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:0136 advisory.

  - ICU: font parsing OOB read (OpenJDK 2D, 8055489) (CVE-2014-6585)

  - ICU: font parsing OOB read (OpenJDK 2D, 8056276) (CVE-2014-6591)

  - OpenJDK: incorrect tracking of ChangeCipherSpec during SSL/TLS handshake (JSSE, 8057555) (CVE-2014-6593)

  - IBM JDK: unspecified full Java sandbox bypass fixed in Feb 2015 update (CVE-2014-8891)

  - IBM JDK: unspecified partial Java sandbox bypass fixed in Feb 2015 update (CVE-2014-8892)

  - OpenJDK: phantom references handling issue in garbage collector (Hotspot, 8047125) (CVE-2015-0395)

  - OpenJDK: directory information leak via file chooser (Swing, 8055304) (CVE-2015-0407)

  - OpenJDK: incorrect context class loader use in RMI transport (RMI, 8055309) (CVE-2015-0408)

  - OpenJDK: DER decoder infinite loop  (Security, 8059485) (CVE-2015-0410)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The VMware Workspace Portal (formerly known as VMware Horizon Workspace) installed on the remote host is version 2.x prior to 2.1.1.
It is, therefore, affected by a man-in-the-middle (MitM) information disclosure vulnerability known as POODLE. The vulnerability is due to the way SSL 3.0 handles padding bytes when decrypting messages encrypted using block ciphers in cipher block chaining (CBC) mode.
MitM attackers can decrypt a selected byte of a cipher text in as few as 256 tries if they are able to force a victim application to repeatedly send the same data over newly created SSL 3.0 connections.
(CVE-2014-3566)

Additionally, unspecified vulnerabilities also exist in the following bundled Java components :

  - 2D (CVE-2014-6585, CVE-2014-6591)

  - Deployment (CVE-2015-0403, CVE-2015-0406)

  - Hotspot (CVE-2014-6601, CVE-2015-0383, CVE-2015-0395,     CVE-2015-0437)

  - Installation (CVE-2015-0421)

  - JAX-WS (CVE-2015-0412)

  - JSSE (CVE-2014-6593)

  - Libraries (CVE-2014-6549, CVE-2014-6587, CVE-2015-0400)

  - RMI (CVE-2015-0408)

  - Security (CVE-2015-0410)

  - Serviceability (CVE-2015-0413)

  - Swing (CVE-2015-0407)

This update fixes 13 security issues.

These security issues were fixed :

  - CVE-2015-0395: Unspecified vulnerability in Oracle Java     SE 5.0u75, 6u85, 7u72, and 8u25 allowed remote attackers     to affect confidentiality, integrity, and availability     via unknown vectors related to Hotspot (bnc#914041).

  - CVE-2015-0400: Unspecified vulnerability in Oracle Java     SE 6u85, 7u72, and 8u25 allowed remote attackers to     affect confidentiality via unknown vectors related to     Libraries (bnc#914041).

  - CVE-2015-0383: Unspecified vulnerability in Oracle Java     SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71     and 8u6; and JRockit R27.8.4 and R28.3.4 allowed local     users to affect integrity and availability via unknown     vectors related to Hotspot (bnc#914041).

  - CVE-2015-0412: Unspecified vulnerability in Oracle Java     SE 6u85, 7u72, and 8u25 allowed remote attackers to     affect confidentiality, integrity, and availability via     vectors related to JAX-WS (bnc#914041).

  - CVE-2015-0407: Unspecified vulnerability in Oracle Java     SE 5.0u75, 6u85, 7u72, and 8u25 allowed remote attackers     to affect confidentiality via unknown vectors related to     Swing (bnc#914041).

  - CVE-2015-0408: Unspecified vulnerability in Oracle Java     SE 5.0u75, 6u85, 7u72, and 8u25 allowed remote attackers     to affect confidentiality, integrity, and availability     via vectors related to RMI (bnc#914041).

  - CVE-2014-6585: Unspecified vulnerability in Oracle Java     SE 5.0u75, 6u85, 7u72, and 8u25 allowed remote attackers     to affect confidentiality via unknown vectors reelated     to 2D, a different vulnerability than CVE-2014-6591     (bnc#914041).

  - CVE-2014-6587: Unspecified vulnerability in Oracle Java     SE 6u85, 7u72, and 8u25 allowed local users to affect     confidentiality, integrity, and availability via unknown     vectors related to Libraries (bnc#914041).

  - CVE-2014-6591: Unspecified vulnerability in the Java SE     component in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25     allowed remote attackers to affect confidentiality via     unknown vectors related to 2D, a different vulnerability     than CVE-2014-6585 (bnc#914041).

  - CVE-2014-6593: Unspecified vulnerability in Oracle Java     SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71     and 8u6; and JRockit 27.8.4 and 28.3.4 allowed remote     attackers to affect confidentiality and integrity via     vectors related to JSSE (bnc#914041).

  - CVE-2014-6601: Unspecified vulnerability in Oracle Java     SE 6u85, 7u72, and 8u25 allowed remote attackers to     affect confidentiality, integrity, and availability via     unknown vectors related to Hotspot (bnc#914041).

  - CVE-2015-0410: Unspecified vulnerability in the Java SE,     Java SE Embedded, JRockit component in Oracle Java SE     5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and     8u6; and JRockit R27.8.4 and R28.3.4 allowed remote     attackers to affect availability via unknown vectors     related to Security (bnc#914041).

  - CVE-2014-3566: The SSL protocol 3.0, as used in OpenSSL     through 1.0.1i and other products, used nondeterministic     CBC padding, which made it easier for man-in-the-middle     attackers to obtain cleartext data via a padding-oracle     attack, aka the 'POODLE' issue (bnc#901223).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A flaw was found in the way the Hotspot component in OpenJDK verified bytecode from the class files. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
(CVE-2014-6601)

Multiple improper permission check issues were discovered in the JAX-WS, and RMI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions.
(CVE-2015-0412 , CVE-2015-0408)

A flaw was found in the way the Hotspot garbage collector handled phantom references. An untrusted Java application or applet could use this flaw to corrupt the Java Virtual Machine memory and, possibly, execute arbitrary code, bypassing Java sandbox restrictions.
(CVE-2015-0395)

A flaw was found in the way the DER (Distinguished Encoding Rules) decoder in the Security component in OpenJDK handled negative length values. A specially crafted, DER-encoded input could cause a Java application to enter an infinite loop when decoded. (CVE-2015-0410)

A flaw was found in the way the SSL 3.0 protocol handled padding bytes when decrypting messages that were encrypted using block ciphers in cipher block chaining (CBC) mode. This flaw could possibly allow a man-in-the-middle (MITM) attacker to decrypt portions of the cipher text using a padding oracle attack. (CVE-2014-3566)

Note: This update disables SSL 3.0 by default to address this issue.
The jdk.tls.disabledAlgorithms security property can be used to re-enable SSL 3.0 support if needed. For additional information, refer to the Red Hat Bugzilla bug linked to in the References section.

It was discovered that the SSL/TLS implementation in the JSSE component in OpenJDK failed to properly check whether the ChangeCipherSpec was received during the SSL/TLS connection handshake.
An MITM attacker could possibly use this flaw to force a connection to be established without encryption being enabled. (CVE-2014-6593)

An information leak flaw was found in the Swing component in OpenJDK.
An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. (CVE-2015-0407)

A NULL pointer dereference flaw was found in the MulticastSocket implementation in the Libraries component of OpenJDK. An untrusted Java application or applet could possibly use this flaw to bypass certain Java sandbox restrictions. (CVE-2014-6587)

Multiple boundary check flaws were found in the font parsing code in the 2D component in OpenJDK. A specially crafted font file could allow an untrusted Java application or applet to disclose portions of the Java Virtual Machine memory. (CVE-2014-6585 , CVE-2014-6591)

Multiple insecure temporary file use issues were found in the way the Hotspot component in OpenJDK created performance statistics and error log files. A local attacker could possibly make a victim using OpenJDK overwrite arbitrary files using a symlink attack. (CVE-2015-0383)

Updated java-1.6.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6 Supplementary.

Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

IBM Java SE version 6 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Detailed vulnerability descriptions are linked from the IBM Security alerts page, listed in the References section. (CVE-2014-6585, CVE-2014-6587, CVE-2014-6591, CVE-2014-6593, CVE-2014-8891, CVE-2014-8892, CVE-2015-0395, CVE-2015-0403, CVE-2015-0406, CVE-2015-0407, CVE-2015-0408, CVE-2015-0410, CVE-2015-0412)

All users of java-1.6.0-ibm are advised to upgrade to these updated packages, containing the IBM Java SE 6 SR16-FP3 release. All running instances of IBM Java must be restarted for the update to take effect.

The version of VMware vCenter Operations Manager installed on the remote host has a bundled version of the Java JRE prior to version 1.7.0_76-b13 (aka 7.0.760). It is, therefore, affected by a man-in-the-middle (MitM) information disclosure vulnerability known as POODLE. The vulnerability is due to the way SSL 3.0 handles padding bytes when decrypting messages encrypted using block ciphers in cipher block chaining (CBC) mode. MitM attackers can decrypt a selected byte of a cipher text in as few as 256 tries if they are able to force a victim application to repeatedly send the same data over newly created SSL 3.0 connections. (CVE-2014-3566)

Additionally, unspecified vulnerabilities also exist in the following bundled Java components :

  - 2D (CVE-2014-6585, CVE-2014-6591)

  - Deployment (CVE-2015-0403, CVE-2015-0406)

  - Hotspot (CVE-2014-6601, CVE-2015-0383, CVE-2015-0395,     CVE-2015-0437)

  - Installation (CVE-2015-0421)

  - JAX-WS (CVE-2015-0412)

  - JSSE (CVE-2014-6593)

  - Libraries (CVE-2014-6549, CVE-2014-6587, CVE-2015-0400)

  - RMI (CVE-2015-0408)

  - Security (CVE-2015-0410)

  - Serviceability (CVE-2015-0413)

  - Swing (CVE-2015-0407)

VMware has released a patch that updates the JRE bundled with the appliance.

The VMware Horizon View installed on the remote Windows host is version 5.x prior to 5.3.4 or version 6.x prior to 6.1. It is, therefore, affected by the following vulnerabilities :

  - A man-in-the-middle (MitM) information disclosure     vulnerability, known as POODLE, exists due to the way     SSL 3.0 handles padding bytes when decrypting messages     encrypted using block ciphers in cipher block chaining     (CBC) mode. A MitM attacker can decrypt a selected byte     of a cipher text in as few as 256 tries if they are able     to force a victim application to repeatedly send the     same data over newly created SSL 3.0 connections.
    (CVE-2014-3566)

  - An XML external entity (XXE) injection vulnerability     exists in the included Flex BlazeDS component due to an     incorrect configuration of the XML parser that allows     external XML entities to be accepted from untrusted     sources. An unauthenticated, remote attacker can exploit     this vulnerability, via a via a crafted AMF message, to     gain access to sensitive information. (CVE-2015-3269)

  - A flaw exists in the bundled Adobe ColdFusion and     LiveCycle Data Services components related to request     handling between a user and the server. A remote     attacker can exploit this, via a specially crafted     request, to bypass access restrictions (e.g. host or     network ACLs), conduct port scanning of internal     networks, enumerate internal hosts, or possibly invoke     additional protocols (e.g. Gopher, TFTP).
    (CVE-2015-5255)

Additionally, unspecified vulnerabilities also exist in the following bundled Java components :

  - 2D (CVE-2014-6585, CVE-2014-6591)

  - Deployment (CVE-2015-0403, CVE-2015-0406)

  - Hotspot (CVE-2014-6601, CVE-2015-0383, CVE-2015-0395,     CVE-2015-0437)

  - Installation (CVE-2015-0421)

  - JAX-WS (CVE-2015-0412)

  - JSSE (CVE-2014-6593)

  - Libraries (CVE-2014-6549, CVE-2014-6587, CVE-2015-0400)

  - RMI (CVE-2015-0408)

  - Security (CVE-2015-0410)

  - Serviceability (CVE-2015-0413)

  - Swing (CVE-2015-0407)

The remote host is affected by the vulnerability described in GLSA-201603-14 (IcedTea: Multiple vulnerabilities)

    Various OpenJDK attack vectors in IcedTea, such as 2D, Corba, Hotspot,       Libraries, and JAXP, exist which allows remote attackers to affect the       confidentiality, integrity, and availability of vulnerable systems.  This       includes the possibility of remote execution of arbitrary code,       information disclosure, or Denial of Service.  Many of the       vulnerabilities can only be exploited through sandboxed Java Web Start       applications and java applets.  Please reference the CVEs listed for       specific details.
  Impact :

    Remote attackers may remotely execute arbitrary code, compromise       information, or cause Denial of Service.
  Workaround :

    There is no known work around at this time.

ID	Name	Product	Family	Published	Updated	Severity
86376	Fedora 22 : icu-54.1-4.fc22 (2015-16314)	Nessus	Fedora Local Security Checks	10/14/2015	1/11/2021	critical
81111	Debian DSA-3147-1 : openjdk-6 - security update (POODLE)	Nessus	Debian Local Security Checks	2/2/2015	1/11/2021	low
80908	Oracle Java SE Multiple Vulnerabilities (January 2015 CPU) (POODLE)	Nessus	Windows	1/22/2015	12/19/2024	critical
81013	RHEL 5 / 6 / 7 : java-1.6.0-openjdk (RHSA-2015:0085)	Nessus	Red Hat Local Security Checks	1/27/2015	3/20/2025	low
81202	RHEL 5 : java-1.7.0-ibm (RHSA-2015:0134)	Nessus	Red Hat Local Security Checks	2/6/2015	10/24/2019	critical
81204	RHEL 5 / 6 : java-1.5.0-ibm (RHSA-2015:0136)	Nessus	Red Hat Local Security Checks	2/6/2015	4/24/2024	critical
82742	VMware Workspace Portal Multiple Java Vulnerabilities (VMSA-2015-0003) (POODLE)	Nessus	Misc.	4/13/2015	11/15/2018	critical
83699	SUSE SLED12 / SLES12 Security Update : java-1_7_0-openjdk (SUSE-SU-2015:0503-1) (POODLE)	Nessus	SuSE Local Security Checks	5/20/2015	1/6/2021	low
80921	Amazon Linux AMI : java-1.7.0-openjdk (ALAS-2015-471) (POODLE)	Nessus	Amazon Linux Local Security Checks	1/23/2015	6/28/2023	low
81203	RHEL 5 / 6 : java-1.6.0-ibm (RHSA-2015:0135)	Nessus	Red Hat Local Security Checks	2/6/2015	2/5/2021	critical
82706	VMware vCenter Operations Management vApp JRE Update 1.7.0_76-b13 (VMSA-2015-0003) (POODLE)	Nessus	Misc.	4/10/2015	11/15/2018	critical
82741	VMware Horizon View Multiple Vulnerabilities (VMSA-2015-0003) (VMSA-2015-0008) (POODLE)	Nessus	Windows	4/13/2015	11/15/2018	critical
89907	GLSA-201603-14 : IcedTea: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	3/14/2016	3/8/2022	critical

Detections

Analytics

Plugins Search

critical

low

critical

low

critical

critical

critical

low

low

critical

critical

critical

critical