According to its self-reported version, the MySQL Enterprise Monitor application running on the remote host is 3.3.x prior to 3.3.1.1112.
It is, therefore, affected by multiple vulnerabilities in the bundled version of OpenSSL :

  - Multiple integer overflow conditions exist in s3_srvr.c,     ssl_sess.c, and t1_lib.c due to improper use of pointer     arithmetic for heap-buffer boundary checks. An     unauthenticated, remote attacker can exploit this to     cause a denial of service. (CVE-2016-2177)

  - An information disclosure vulnerability exists in the     dsa_sign_setup() function in dsa_ossl.c due to a failure     to properly ensure the use of constant-time operations.
    An unauthenticated, remote attacker can exploit this,     via a timing side-channel attack, to disclose DSA key     information. (CVE-2016-2178)

  - A denial of service vulnerability exists in the DTLS     implementation due to a failure to properly restrict the     lifetime of queue entries associated with unused     out-of-order messages. An unauthenticated, remote     attacker can exploit this, by maintaining multiple     crafted DTLS sessions simultaneously, to exhaust memory.
    (CVE-2016-2179)

  - An out-of-bounds read error exists in the X.509 Public     Key Infrastructure Time-Stamp Protocol (TSP)     implementation. An unauthenticated, remote attacker can     exploit this, via a crafted time-stamp file that is     mishandled by the 'openssl ts' command, to cause     denial of service or to disclose sensitive information.
    (CVE-2016-2180)

  - A denial of service vulnerability exists in the     Anti-Replay feature in the DTLS implementation due to     improper handling of epoch sequence numbers in records.
    An unauthenticated, remote attacker can exploit this,     via spoofed DTLS records, to cause legitimate packets to     be dropped. (CVE-2016-2181)

  - An overflow condition exists in the BN_bn2dec() function     in bn_print.c due to improper validation of     user-supplied input when handling BIGNUM values. An     unauthenticated, remote attacker can exploit this to     crash the process. (CVE-2016-2182)

  - A vulnerability exists, known as SWEET32, in the 3DES     and Blowfish algorithms due to the use of weak 64-bit     block ciphers by default. A man-in-the-middle attacker     who has sufficient resources can exploit this     vulnerability, via a 'birthday' attack, to detect a     collision that leaks the XOR between the fixed secret     and a known plaintext, allowing the disclosure of the     secret text, such as secure HTTPS cookies, and possibly     resulting in the hijacking of an authenticated session.
    (CVE-2016-2183)

  - A flaw exists in the tls_decrypt_ticket() function in     t1_lib.c due to improper handling of ticket HMAC     digests. An unauthenticated, remote attacker can exploit     this, via a ticket that is too short, to crash the     process, resulting in a denial of service.
    (CVE-2016-6302)

  - An integer overflow condition exists in the     MDC2_Update() function in mdc2dgst.c due to improper     validation of user-supplied input. An unauthenticated,     remote attacker can exploit this to cause a heap-based     buffer overflow, resulting in a denial of service     condition or possibly the execution of arbitrary code.
    (CVE-2016-6303)

  - A denial of service vulnerability exists in the     ssl_parse_clienthello_tlsext() function in t1_lib.c due     to improper handling of overly large OCSP Status Request     extensions from clients. An unauthenticated, remote     attacker can exploit this, via large OCSP Status Request     extensions, to exhaust memory resources. (CVE-2016-6304)

  - An out-of-bounds read error exists in the certificate     parser that allows an unauthenticated, remote attacker     to cause a denial of service via crafted certificate     operations. (CVE-2016-6306)

This update for java-1_8_0-openjdk fixes the following issues: Oracle Critical Patch Update of January 2017 (bsc#1020905) Upgrade to version jdk8u121 (icedtea 3.3.0) :

  - S8138725: Add options for Javadoc generation

  - S8140353: Improve signature checking

  - S8151934, CVE-2017-3231: Resolve class resolution

  - S8156804, CVE-2017-3241: Better constraint checking

  - S8158406: Limited Parameter Processing

  - S8158997: JNDI Protocols Switch

  - S8159507: RuntimeVisibleAnnotation validation

  - S8161218: Better bytecode loading

  - S8161743, CVE-2017-3252: Provide proper login context

  - S8162577: Standardize logging levels

  - S8162973: Better component components

  - S8164143, CVE-2017-3260: Improve components for menu     items

  - S8164147, CVE-2017-3261: Improve streaming socket output

  - S8165071, CVE-2016-2183: Expand TLS support

  - S8165344, CVE-2017-3272: Update concurrency support

  - S8166988, CVE-2017-3253: Improve image processing     performance

  - S8167104, CVE-2017-3289: Additional class construction     refinements

  - S8167223, CVE-2016-5552: URL handling improvements

  - S8168705, CVE-2016-5547: Better ObjectIdentifier     validation

  - S8168714, CVE-2016-5546: Tighten ECDSA validation

  - S8168728, CVE-2016-5548: DSA signing improvements

  - S8168724, CVE-2016-5549: ECDSA signing improvements

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3194-1 advisory.

    Karthik Bhargavan and Gaetan Leurent discovered that the DES and Triple DES ciphers were vulnerable to     birthday attacks.

    A remote attacker could possibly use this flaw to obtain clear text data from long encrypted sessions.
    This update moves those algorithms to the legacy algorithm set and causes them to be used only if no non-     legacy algorithms can be negotiated. (CVE-2016-2183)

    It was discovered that OpenJDK accepted ECSDA signatures using non-canonical DER encoding. An attacker     could use this to modify or expose sensitive data. (CVE-2016-5546)

    It was discovered that OpenJDK did not properly verify object identifier (OID) length when reading     Distinguished Encoding Rules (DER) records, as used in x.509 certificates and elsewhere. An attacker could     use this to cause a denial of service (memory consumption). (CVE-2016-5547)

    It was discovered that covert timing channel vulnerabilities existed in the DSA implementations in     OpenJDK. A remote attacker could use this to expose sensitive information. (CVE-2016-5548)

    It was discovered that the URLStreamHandler class in OpenJDK did not properly parse user information from     a URL. A remote attacker could use this to expose sensitive information. (CVE-2016-5552)

    It was discovered that the URLClassLoader class in OpenJDK did not properly check access control context     when downloading class files. A remote attacker could use this to expose sensitive information.
    (CVE-2017-3231)

    It was discovered that the Remote Method Invocation (RMI) implementation in OpenJDK performed     deserialization of untrusted inputs. A remote attacker could use this to execute arbitrary code.
    (CVE-2017-3241)

    It was discovered that the Java Authentication and Authorization Service (JAAS) component of OpenJDK did     not properly perform user search LDAP queries. An attacker could use a specially constructed LDAP entry to     expose or modify sensitive information. (CVE-2017-3252)

    It was discovered that the PNGImageReader class in OpenJDK did not properly handle iTXt and zTXt chunks.
    An attacker could use this to cause a denial of service (memory consumption). (CVE-2017-3253)

    It was discovered that integer overflows existed in the SocketInputStream and SocketOutputStream classes     of OpenJDK. An attacker could use this to expose sensitive information. (CVE-2017-3261)

    It was discovered that the atomic field updaters in the java.util.concurrent.atomic package in OpenJDK did     not properly restrict access to protected field members. An attacker could use this to specially craft a     Java application or applet that could bypass Java sandbox restrictions. (CVE-2017-3272)

    It was discovered that a vulnerability existed in the class construction implementation in OpenJDK. An     attacker could use this to specially craft a Java application or applet that could bypass Java sandbox     restrictions. (CVE-2017-3289)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for java-1_7_0-openjdk fixes the following issues :

  - Oracle Critical Patch Update of January 2017 to OpenJDK     7u131 (bsc#1020905) :

  - Security Fixes

  - S8138725: Add options for Javadoc generation

  - S8140353: Improve signature checking

  - S8151934, CVE-2017-3231: Resolve class resolution

  - S8156804, CVE-2017-3241: Better constraint checking

  - S8158406: Limited Parameter Processing

  - S8158997: JNDI Protocols Switch

  - S8159507: RuntimeVisibleAnnotation validation

  - S8161218: Better bytecode loading

  - S8161743, CVE-2017-3252: Provide proper login context

  - S8162577: Standardize logging levels

  - S8162973: Better component components

  - S8164143, CVE-2017-3260: Improve components for menu     items

  - S8164147, CVE-2017-3261: Improve streaming socket output

  - S8165071, CVE-2016-2183: Expand TLS support

  - S8165344, CVE-2017-3272: Update concurrency support

  - S8166988, CVE-2017-3253: Improve image processing     performance

  - S8167104, CVE-2017-3289: Additional class construction     refinements

  - S8167223, CVE-2016-5552: URL handling improvements

  - S8168705, CVE-2016-5547: Better ObjectIdentifier     validation

  - S8168714, CVE-2016-5546: Tighten ECDSA validation

  - S8168728, CVE-2016-5548: DSA signing improvments

  - S8168724, CVE-2016-5549: ECDSA signing improvments

  - S6253144: Long narrowing conversion should describe the     algorithm used and implied 'risks'

  - S6328537: Improve javadocs for Socket class by adding     references to SocketOptions

  - S6978886: javadoc shows stacktrace after print error     resulting from disk full

  - S6995421: Eliminate the static dependency to     sun.security.ec.ECKeyFactory

  - S6996372: synchronizing handshaking hash

  - S7027045: (doc) java/awt/Window.java has several typos     in javadoc

  - S7054969: Null-check-in-finally pattern in java/security     documentation

  - S7072353: JNDI libraries do not build with javac
    -Xlint:all -Werror

  - S7075563: Broken link in 'javax.swing.SwingWorker'

  - S7077672: jdk8_tl nightly fail in step-2 build on     8/10/11

  - S7088502: Security libraries don't build with javac
    -Werror

  - S7092447: Clarify the default locale used in each locale     sensitive operation

  - S7093640: Enable client-side TLS 1.2 by default

  - S7103570: AtomicIntegerFieldUpdater does not work when     SecurityManager is installed

  - S7117360: Warnings in java.util.concurrent.atomic     package

  - S7117465: Warning cleanup for IMF classes

  - S7187144: JavaDoc for ScriptEngineFactory.getProgram()     contains an error

  - S8000418: javadoc should used a standard 'generated by     javadoc' string

  - S8000666: javadoc should write directly to Writer     instead of composing strings

  - S8000673: remove dead code from HtmlWriter and subtypes

  - S8000970: break out auxiliary classes that will prevent     multi-core compilation of the JDK

  - S8001669: javadoc internal DocletAbortException should     set cause when appropriate

  - S8008949: javadoc stopped copying doc-files

  - S8011402: Move blacklisting certificate logic from hard     code to data

  - S8011547: Update XML Signature implementation to Apache     Santuario 1.5.4

  - S8012288: XML DSig API allows wrong tag names and extra     elements in SignedInfo

  - S8016217: More javadoc warnings

  - S8017325: Cleanup of the javadoc <code> tag in     java.security.cert

  - S8017326: Cleanup of the javadoc <code> tag in     java.security.spec

  - S8019772: Fix doclint issues in javax.crypto and     javax.security subpackages

  - S8020557: javadoc cleanup in javax.security

  - S8020688: Broken links in documentation at     http://docs.oracle.com/javase/6/docs/api/index.

  - S8021108: Clean up doclint warnings and errors in     java.text package

  - S8021417: Fix doclint issues in java.util.concurrent

  - S8021833: javadoc cleanup in java.net

  - S8022120: JCK test     api/javax_xml/crypto/dsig/TransformService/index_ParamMe     thods fails

  - S8022175: Fix doclint warnings in javax.print

  - S8022406: Fix doclint issues in java.beans

  - S8022746: List of spelling errors in API doc

  - S8024779: [macosx] SwingNode crashes on exit

  - S8025085: [javadoc] some errors in javax/swing

  - S8025218: [javadoc] some errors in java/awt classes

  - S8025249: [javadoc] fix some javadoc errors in     javax/swing/

  - S8025409: Fix javadoc comments errors and warning     reported by doclint report

  - S8026021: more fix of javadoc errors and warnings     reported by doclint, see the description

  - S8037099: [macosx] Remove all references to GC from     native OBJ-C code

  - S8038184: XMLSignature throws     StringIndexOutOfBoundsException if ID attribute value is     empty String

  - S8038349: Signing XML with DSA throws Exception when key     is larger than 1024 bits

  - S8049244: XML Signature performance issue caused by     unbuffered signature data

  - S8049432: New tests for TLS property     jdk.tls.client.protocols

  - S8050893: (smartcardio) Invert reset argument in tests     in sun/security/smartcardio

  - S8059212: Modify regression tests so that they do not     just fail if no cardreader found

  - S8068279: (typo in the spec)     javax.script.ScriptEngineFactory.getLanguageName

  - S8068491: Update the protocol for references of     docs.oracle.com to HTTPS.

  - S8069038: javax/net/ssl/TLS/TLSClientPropertyTest.java     needs to be updated for JDK-8061210

  - S8076369: Introduce the jdk.tls.client.protocols system     property for JDK 7u

  - S8139565: Restrict certificates with DSA keys less than     1024 bits

  - S8140422: Add mechanism to allow non default root CAs to     be not subject to algorithm restrictions

  - S8140587: Atomic*FieldUpdaters should use     Class.isInstance instead of direct class check

  - S8143959: Certificates requiring blacklisting

  - S8145984: [macosx] sun.lwawt.macosx.CAccessible leaks

  - S8148516: Improve the default strength of EC in JDK

  - S8149029: Secure validation of XML based digital     signature always enabled when checking wrapping attacks

  - S8151893: Add security property to configure XML     Signature secure validation mode

  - S8155760: Implement Serialization Filtering

  - S8156802: Better constraint checking

  - S8161228: URL objects with custom protocol handlers have     port changed after deserializing

  - S8161571: Verifying ECDSA signatures permits trailing     bytes

  - S8163304: jarsigner -verbose -verify should print the     algorithms used to sign the jar

  - S8164908: ReflectionFactory support for IIOP and custom     serialization

  - S8165230: RMIConnection addNotificationListeners failing     with specific inputs

  - S8166393: disabledAlgorithms property should not be     strictly parsed

  - S8166591: [macos 10.12] Trackpad scrolling of text on OS     X 10.12 Sierra is very fast (Trackpad, Retina only)

  - S8166739: Improve extensibility of ObjectInputFilter     information passed to the filter

  - S8166875: (tz) Support tzdata2016g

  - S8166878: Connection reset during TLS handshake

  - S8167356: Follow up fix for jdk8 backport of 8164143.
    Changes for CMenuComponent.m were missed

  - S8167459: Add debug output for indicating if a chosen     ciphersuite was legacy

  - S8167472: Chrome interop regression with JDK-8148516

  - S8167591: Add MD5 to signed JAR restrictions

  - S8168861: AnchorCertificates uses hard-coded password     for cacerts keystore

  - S8168993: JDK8u121 L10n resource file update

  - S8169191: (tz) Support tzdata2016i

  - S8169688: Backout (remove) MD5 from     jdk.jar.disabledAlgorithms for January CPU

  - S8169911: Enhanced tests for jarsigner -verbose -verify     after JDK-8163304

  - S8170131: Certificates not being blocked by     jdk.tls.disabledAlgorithms property

  - S8170268: 8u121 L10n resource file update - msgdrop 20

  - S8173622: Backport of 7180907 is incomplete

  - S8173849: Fix use of java.util.Base64 in test cases

  - S8173854: [TEST] Update DHEKeySizing test case following     8076328 & 8081760

  - CVE-2017-3259 Vulnerability allows unauthenticated     attacker with network access via multiple protocols to     compromise Java SE.

  - Backports

  - S7102489, PR3316, RH1390708: RFE: cleanup jlong typedef     on __APPLE__and _LLP64 systems.

  - S8000351, PR3316, RH1390708: Tenuring threshold should     be unsigned

  - S8153711, PR3315, RH1284948: [REDO] GlobalRefs never     deleted when processing invokeMethod command

  - S8170888, PR3316, RH1390708: [linux] support for cgroup     memory limits in container (ie Docker) environments

  - Bug fixes

  - PR3318: Replace 'infinality' with 'improved font     rendering' (--enable-improved-font-rendering)

  - PR3318: Fix compatibility with vanilla Fontconfig

  - PR3318: Fix glyph y advance

  - PR3318: Always round glyph advance in 26.6 space

  - PR3318: Simplify glyph advance handling

  - PR3324: Fix NSS_LIBDIR substitution in     make_generic_profile.sh broken by PR1989

  - AArch64 port

  - S8165673, PR3320: AArch64: Fix JNI floating point     argument handling</code></code>

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for java-1.7.1-ibm is now available for Red Hat Satellite 5.7 and Red Hat Satellite 5.6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

This update upgrades IBM Java SE 7 to version 7R1 SR4-FP1.

Security Fix(es) :

* This update fixes multiple vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Further information about these flaws can be found on the IBM Java Security alerts page, listed in the References section. (CVE-2016-2183, CVE-2017-3272, CVE-2017-3289, CVE-2017-3253, CVE-2017-3261, CVE-2017-3231, CVE-2016-5547, CVE-2016-5552, CVE-2017-3252, CVE-2016-5546, CVE-2016-5548, CVE-2016-5549, CVE-2017-3241, CVE-2017-3259, CVE-2016-5573, CVE-2016-5554, CVE-2016-5542, CVE-2016-5597, CVE-2016-5556, CVE-2016-3598, CVE-2016-3511, CVE-2016-0363, CVE-2016-0686, CVE-2016-0687, CVE-2016-3426, CVE-2016-3427, CVE-2016-3443, CVE-2016-3449, CVE-2016-3422, CVE-2016-0376, CVE-2016-0264)

ID	Name	Product	Family	Published	Updated	Severity
96771	MySQL Enterprise Monitor 3.3.x < 3.3.1.1112 Multiple Vulnerabilities (SWEET32) (January 2017 CPU)	Nessus	CGI abuses	1/25/2017	11/13/2019	critical
96926	SUSE SLED12 / SLES12 Security Update : java-1_8_0-openjdk (SUSE-SU-2017:0346-1)	Nessus	SuSE Local Security Checks	2/1/2017	1/2/2026	critical
97084	Ubuntu 14.04 LTS : OpenJDK 7 vulnerabilities (USN-3194-1)	Nessus	Ubuntu Local Security Checks	2/9/2017	8/27/2024	critical
97296	SUSE SLED12 / SLES12 Security Update : java-1_7_0-openjdk (SUSE-SU-2017:0490-1)	Nessus	SuSE Local Security Checks	2/21/2017	12/31/2025	critical
100094	RHEL 6 : java-1.7.1-ibm (RHSA-2017:1216)	Nessus	Red Hat Local Security Checks	5/10/2017	12/19/2025	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical