Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in the execution of arbitrary code, breakouts of the Java sandbox, information disclosure, denial of service or insecure cryptography.

The remote host is affected by the vulnerability described in GLSA-201603-11 (Oracle JRE/JDK: Multiple vulnerabilities)

    Multiple vulnerabilities exist in both Oracle&rsquo;s JRE and JDK.  Please       review the referenced CVE&rsquo;s for additional information.
  Impact :

    Remote attackers could gain access to information, remotely execute       arbitrary code, and cause Denial of Service.
  Workaround :

    There is no known workaround at this time.

The remote host is affected by the vulnerability described in GLSA-201603-14 (IcedTea: Multiple vulnerabilities)

    Various OpenJDK attack vectors in IcedTea, such as 2D, Corba, Hotspot,       Libraries, and JAXP, exist which allows remote attackers to affect the       confidentiality, integrity, and availability of vulnerable systems.  This       includes the possibility of remote execution of arbitrary code,       information disclosure, or Denial of Service.  Many of the       vulnerabilities can only be exploited through sandboxed Java Web Start       applications and java applets.  Please reference the CVEs listed for       specific details.
  Impact :

    Remote attackers may remotely execute arbitrary code, compromise       information, or cause Denial of Service.
  Workaround :

    There is no known work around at this time.

Updated java-1.7.0-openjdk packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit.

Multiple flaws were discovered in the 2D, CORBA, JMX, Libraries and RMI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions.
(CVE-2015-4760, CVE-2015-2628, CVE-2015-4731, CVE-2015-2590, CVE-2015-4732, CVE-2015-4733)

A flaw was found in the way the Libraries component of OpenJDK verified Online Certificate Status Protocol (OCSP) responses. An OCSP response with no nextUpdate date specified was incorrectly handled as having unlimited validity, possibly causing a revoked X.509 certificate to be interpreted as valid. (CVE-2015-4748)

It was discovered that the JCE component in OpenJDK failed to use constant time comparisons in multiple cases. An attacker could possibly use these flaws to disclose sensitive information by measuring the time used to perform operations using these non-constant time comparisons. (CVE-2015-2601)

A flaw was found in the RC4 encryption algorithm. When using certain keys for RC4 encryption, an attacker could obtain portions of the plain text from the cipher text without the knowledge of the encryption key. (CVE-2015-2808)

Note: With this update, OpenJDK now disables RC4 SSL/TLS cipher suites by default to address the CVE-2015-2808 issue. Refer to Red Hat Bugzilla bug 1207101, linked to in the References section, for additional details about this change.

A flaw was found in the way the TLS protocol composed the Diffie-Hellman (DH) key exchange. A man-in-the-middle attacker could use this flaw to force the use of weak 512 bit export-grade keys during the key exchange, allowing them do decrypt all traffic.
(CVE-2015-4000)

Note: This update forces the TLS/SSL client implementation in OpenJDK to reject DH key sizes below 768 bits, which prevents sessions to be downgraded to export-grade keys. Refer to Red Hat Bugzilla bug 1223211, linked to in the References section, for additional details about this change.

It was discovered that the JNDI component in OpenJDK did not handle DNS resolutions correctly. An attacker able to trigger such DNS errors could cause a Java application using JNDI to consume memory and CPU time, and possibly block further DNS resolution. (CVE-2015-4749)

Multiple information leak flaws were found in the JMX and 2D components in OpenJDK. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions.
(CVE-2015-2621, CVE-2015-2632)

A flaw was found in the way the JSSE component in OpenJDK performed X.509 certificate identity verification when establishing a TLS/SSL connection to a host identified by an IP address. In certain cases, the certificate was accepted as valid if it was issued for a host name to which the IP address resolves rather than for the IP address.
(CVE-2015-2625)

All users of java-1.7.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:1228 advisory.

    The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime     Environment and the OpenJDK 8 Java Software Development Kit.

    Multiple flaws were discovered in the 2D, CORBA, JMX, Libraries and RMI     components in OpenJDK. An untrusted Java application or applet could use     these flaws to bypass Java sandbox restrictions. (CVE-2015-4760,     CVE-2015-2628, CVE-2015-4731, CVE-2015-2590, CVE-2015-4732, CVE-2015-4733)

    A flaw was found in the way the Libraries component of OpenJDK verified     Online Certificate Status Protocol (OCSP) responses. An OCSP response with     no nextUpdate date specified was incorrectly handled as having unlimited     validity, possibly causing a revoked X.509 certificate to be interpreted as     valid. (CVE-2015-4748)

    It was discovered that the JCE component in OpenJDK failed to use constant     time comparisons in multiple cases. An attacker could possibly use these     flaws to disclose sensitive information by measuring the time used to     perform operations using these non-constant time comparisons.
    (CVE-2015-2601)

    It was discovered that the GCM (Galois Counter Mode) implementation in the     Security component of OpenJDK failed to properly perform a null check.
    This could cause the Java Virtual Machine to crash when an application     performed encryption using a block cipher in the GCM mode. (CVE-2015-2659)

    A flaw was found in the RC4 encryption algorithm. When using certain keys     for RC4 encryption, an attacker could obtain portions of the plain text     from the cipher text without the knowledge of the encryption key.
    (CVE-2015-2808)

    Note: With this update, OpenJDK now disables RC4 TLS/SSL cipher suites by     default to address the CVE-2015-2808 issue. Refer to Red Hat Bugzilla bug     1207101, linked to in the References section, for additional details about     this change.

    A flaw was found in the way the TLS protocol composed the Diffie-Hellman     (DH) key exchange. A man-in-the-middle attacker could use this flaw to     force the use of weak 512 bit export-grade keys during the key exchange,     allowing them do decrypt all traffic. (CVE-2015-4000)

    Note: This update forces the TLS/SSL client implementation in OpenJDK to     reject DH key sizes below 768 bits, which prevents sessions to be     downgraded to export-grade keys. Refer to Red Hat Bugzilla bug 1223211,     linked to in the References section, for additional details about this     change.

    It was discovered that the JNDI component in OpenJDK did not handle DNS     resolutions correctly. An attacker able to trigger such DNS errors could     cause a Java application using JNDI to consume memory and CPU time, and     possibly block further DNS resolution. (CVE-2015-4749)

    Multiple information leak flaws were found in the JMX and 2D components in     OpenJDK. An untrusted Java application or applet could use this flaw to     bypass certain Java sandbox restrictions. (CVE-2015-2621, CVE-2015-2632)

    A flaw was found in the way the JSSE component in OpenJDK performed X.509     certificate identity verification when establishing a TLS/SSL connection to     a host identified by an IP address. In certain cases, the certificate was     accepted as valid if it was issued for a host name to which the IP address     resolves rather than for the IP address. (CVE-2015-2625)

    Multiple insecure temporary file use issues were found in the way the     Hotspot component in OpenJDK created performance statistics and error log     files. A local attacker could possibly make a victim using OpenJDK     overwrite arbitrary files using a symlink attack. Note: This issue was     originally fixed as CVE-2015-0383, but the fix was regressed in the     RHSA-2015:0809 advisory. (CVE-2015-3149)

    All users of java-1.8.0-openjdk are advised to upgrade to these updated     packages, which resolve these issues. All running instances of OpenJDK Java     must be restarted for the update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 8 Update 51, 7 Update 85, or 6 Update 101. It is, therefore, affected by security vulnerabilities in the following components :

  - 2D
  - CORBA
  - Deployment
  - Hotspot
  - Install
  - JCE
  - JMX
  - JNDI
  - JSSE
  - Libraries
  - RMI
  - Security

Multiple flaws were discovered in the 2D, CORBA, JMX, Libraries and RMI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions.
(CVE-2015-4760, CVE-2015-2628, CVE-2015-4731, CVE-2015-2590, CVE-2015-4732, CVE-2015-4733)

A flaw was found in the way the Libraries component of OpenJDK verified Online Certificate Status Protocol (OCSP) responses. An OCSP response with no nextUpdate date specified was incorrectly handled as having unlimited validity, possibly causing a revoked X.509 certificate to be interpreted as valid. (CVE-2015-4748)

It was discovered that the JCE component in OpenJDK failed to use constant time comparisons in multiple cases. An attacker could possibly use these flaws to disclose sensitive information by measuring the time used to perform operations using these non-constant time comparisons. (CVE-2015-2601)

A flaw was found in the RC4 encryption algorithm. When using certain keys for RC4 encryption, an attacker could obtain portions of the plain text from the cipher text without the knowledge of the encryption key. (CVE-2015-2808)

A flaw was found in the way the TLS protocol composed the Diffie-Hellman (DH) key exchange. A man-in-the-middle attacker could use this flaw to force the use of weak 512 bit export-grade keys during the key exchange, allowing them to decrypt all traffic.
(CVE-2015-4000)

It was discovered that the JNDI component in OpenJDK did not handle DNS resolutions correctly. An attacker able to trigger such DNS errors could cause a Java application using JNDI to consume memory and CPU time, and possibly block further DNS resolution. (CVE-2015-4749)

Multiple information leak flaws were found in the JMX and 2D components in OpenJDK. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions.
(CVE-2015-2621, CVE-2015-2632)

A flaw was found in the way the JSSE component in OpenJDK performed X.509 certificate identity verification when establishing a TLS/SSL connection to a host identified by an IP address. In certain cases, the certificate was accepted as valid if it was issued for a host name to which the IP address resolves rather than for the IP address.
(CVE-2015-2625)

All running instances of OpenJDK Java must be restarted for the update to take effect.

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:1544 advisory.

  - IBM JDK: plain text data stored in memory dumps (CVE-2015-1931)

  - OpenJDK: deserialization issue in ObjectInputStream.readSerialData() (Libraries, 8076401) (CVE-2015-2590)

  - OpenJDK: non-constant time comparisons in crypto code (JCE, 8074865) (CVE-2015-2601)

  - OpenJDK: incorrect code permission checks in RMIConnectionImpl (JMX, 8075853) (CVE-2015-2621)

  - ICU: integer overflow in LETableReference verifyLength() (OpenJDK 2D, 8077520) (CVE-2015-2632)

  - Oracle JDK: unspecified vulnerability fixed in 6u101, 7u85 and 8u51 (2D) (CVE-2015-2637, CVE-2015-2638)

  - Oracle JDK: unspecified vulnerability fixed in 6u101, 7u85 and 8u51 (Deployment) (CVE-2015-2664)

  - LOGJAM: TLS connections which support export grade DHE key-exchange are vulnerable to MITM attacks     (CVE-2015-4000)

  - OpenJDK: improper permission checks in MBeanServerInvocationHandler (JMX, 8076397) (CVE-2015-4731)

  - OpenJDK: insufficient context checks during object deserialization (Libraries, 8076405) (CVE-2015-4732)

  - OpenJDK: RemoteObjectInvocationHandler allows calling finalize() (RMI, 8076409) (CVE-2015-4733)

  - OpenJDK: incorrect OCSP nextUpdate checking (Libraries, 8075374) (CVE-2015-4748)

  - OpenJDK: DnsClient fails to release request information after error (JNDI, 8075378) (CVE-2015-4749)

  - ICU: missing boundary checks in layout engine (OpenJDK 2D, 8071715) (CVE-2015-4760)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Java SDK installed on the remote AIX host is affected by multiple vulnerabilities :

  - Java Security Components store plaintext data in memory     dumps, which allows a local attacker to gain access to     sensitive information. (CVE-2015-1931)

  - A flaw exists in the readSerialData() function in     class ObjectInputStream.java when handling OIS data,     which allows an attacker to execute arbitrary code.
    (CVE-2015-2590)

  - Multiple flaws exist in the JCE component due to     various cryptographic operations using non-constant     time comparisons. A remote attacker can exploit this     to conduct timing attacks to gain access to sensitive     information. (CVE-2015-2601)

  - A flaw exists in the ECDH_Derive() function in file     ec.c due to missing EC parameter validation when     performing ECDH key derivation. A remote attacker can     exploit this to access sensitive information.
    (CVE-2015-2613)

  - An unspecified vulnerability exists in the 2D component     that allows a remote attacker to access sensitive     information. (CVE-2015-2619, CVE-2015-2637)

  - A flaw exists in the RMIConnectionImpl constructor     in class RMIConnectionImpl.java due to improper     permission checks when creating repository class     loaders. An attacker can exploit this to bypass sandbox     restrictions and access sensitive information.
    (CVE-2015-2621)

  - An unspecified flaw exists in the JSSE component when     handling the SSL/TLS protocol. A remote attacker can     exploit this to gain access to sensitive information.
    (CVE-2015-2625)

  - An integer overflow condition exists in the     International Components for Unicode for C/C++ (ICU4C).
    An attacker, using a specially crafted font, can exploit     this to crash an application using this library or     access memory contents. (CVE-2015-2632)

  - A unspecified vulnerability exists in the 2D component     that allows a remote attacker to execute arbitrary     code. (CVE-2015-2638)

  - An unspecified flaw exists in the Deployment component     that allows a local attacker to gain elevated     privileges. (CVE-2015-2664)

  - A man-in-the-middle vulnerability, known as Logjam,     exists due to a flaw in the SSL/TLS protocol. A remote     attacker can exploit this flaw to downgrade connections     using ephemeral Diffie-Hellman key exchange to 512-bit     export-grade cryptography. (CVE-2015-4000)

  - An unspecified vulnerability exists in the Deployment     component that impacts confidentiality and integrity.
    (CVE-2015-4729)

  - A flaw exists in class MBeanServerInvocationHandler.java     when handling MBean connection proxy classes. An     attacker can exploit this to bypass sandbox restrictions     and execute arbitrary code. (CVE-2015-4731)

  - Multiple flaws exist in classes ObjectInputStream.java     and SerialCallbackContext.java related to insufficient     context checking. An attacker can exploit these to     execute arbitrary code. (CVE-2015-4732)

  - A flaw exists in the invoke() method in the class     RemoteObjectInvocationHandler.java due to calls to the     finalize() method being permitted. An attacker can     exploit this to bypass sandbox protections and execute     arbitrary code. (CVE-2015-4733)

  - An unspecified flaw exists in the Deployment component     that allows a local attacker to execute arbitrary code.
    (CVE-2015-4736)

  - A flaw exists in the Security component when handling     Online Certificate Status Protocol (OCSP) responses with     no 'nextUpdate'. A remote attacker can exploit this to     cause an application to accept a revoked X.509     certificate. (CVE-2015-4748)

  - An flaw exists in the query() method in class     DnsClient.java due to a failure by the JNDI component's     exception handling to release request information. A     remote attacker can exploit this to cause a denial of     service. (CVE-2015-4749)

  - An integer overflow condition exists in the layout     engine in the International Components for Unicode for     C/C++ (ICU4C). An attacker, using a specially crafted     font, can exploit this to crash an application using     this library or execute arbitrary code. (CVE-2015-4760)

ID	Name	Product	Family	Published	Updated	Severity
85588	Debian DSA-3339-1 : openjdk-6 - security update (Bar Mitzvah) (Logjam)	Nessus	Debian Local Security Checks	8/24/2015	12/5/2022	low
89904	GLSA-201603-11 : Oracle JRE/JDK: Multiple vulnerabilities (Logjam)	Nessus	Gentoo Local Security Checks	3/14/2016	12/5/2022	low
89907	GLSA-201603-14 : IcedTea: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	3/14/2016	3/8/2022	critical
84772	CentOS 5 : java-1.7.0-openjdk (CESA-2015:1230) (Bar Mitzvah) (Logjam)	Nessus	CentOS Local Security Checks	7/16/2015	2/18/2025	medium
84787	RHEL 6 / 7 : java-1.8.0-openjdk (RHSA-2015:1228)	Nessus	Red Hat Local Security Checks	7/16/2015	4/15/2025	critical
84825	Oracle Java SE Multiple Vulnerabilities (July 2015 CPU) (Unix) (Bar Mitzvah)	Nessus	Misc.	7/17/2015	6/20/2024	critical
85212	Scientific Linux Security Update : java-1.6.0-openjdk on SL5.x, SL6.x, SL7.x i386/x86_64 (20150730) (Bar Mitzvah) (Logjam)	Nessus	Scientific Linux Local Security Checks	8/4/2015	12/5/2022	low
85238	RHEL 5 / 6 : java-1.5.0-ibm (RHSA-2015:1544)	Nessus	Red Hat Local Security Checks	8/5/2015	4/27/2024	medium
85447	AIX Java Advisory : java_july2015_advisory.asc (Logjam)	Nessus	AIX Local Security Checks	8/17/2015	4/21/2023	critical

Detections

Analytics

Plugins Search

low

low

critical

medium

critical

critical

low

medium

critical