| Descripción: | Summary:
The remote host is missing an update for the 'java'
package(s) announced via the referenced advisory.
Vulnerability Insight:
These packages provide the OpenJDK 6 Java Runtime Environment and the
OpenJDK 6 Software Development Kit. The Java Runtime Environment (JRE)
contains the software and tools that users need to run applications written
using the Java programming language.
An integer overflow flaw and buffer overflow flaws were found in the way
the JRE processed image files. An untrusted applet or application could use
these flaws to extend its privileges, allowing it to read and write local
files, as well as to execute local applications with the privileges of the
user running the applet or application. (CVE-2009-3869, CVE-2009-3871,
CVE-2009-3873, CVE-2009-3874)
An information leak was found in the JRE. An untrusted applet or
application could use this flaw to extend its privileges, allowing it to
read and write local files, as well as to execute local applications with
the privileges of the user running the applet or application. (CVE-2009-3881)
It was discovered that the JRE still accepts certificates with MD2 hash
signatures, even though MD2 is no longer considered a cryptographically
strong algorithm. This could make it easier for an attacker to create a
malicious certificate that would be treated as trusted by the JRE. With
this update, the JRE disables the use of the MD2 algorithm inside
signatures by default. (CVE-2009-2409)
A timing attack flaw was found in the way the JRE processed HMAC digests.
This flaw could aid an attacker using forged digital signatures to bypass
authentication checks. (CVE-2009-3875)
Two denial of service flaws were found in the JRE. These could be exploited
in server-side application scenarios that process DER-encoded
(Distinguished Encoding Rules) data. (CVE-2009-3876, CVE-2009-3877)
An information leak was found in the way the JRE handled color profiles. An
attacker could use this flaw to discover the existence of files outside of
the color profiles directory. (CVE-2009-3728)
A flaw in the JRE with passing arrays to the X11GraphicsDevice API was
found. An untrusted applet or application could use this flaw to access and
modify the list of supported graphics configurations. This flaw could also
lead to sensitive information being leaked to unprivileged code.
(CVE-2009-3879)
It was discovered that the JRE passed entire objects to the logging API.
This could lead to sensitive information being leaked to either untrusted
or lower-privileged code from an attacker-controlled applet which has
access to the logging API and is therefore able to manipulate (read and/or
call) the passed object ...
Description truncated, please see the referenced URL(s) for more information.
Affected Software/OS:
java on CentOS 5
Solution:
Please install the updated packages.
CVSS Score:
9.3
CVSS Vector:
AV:N/AC:M/Au:N/C:C/I:C/A:C
|
