ID de Prueba:	1.3.6.1.4.1.25623.1.0.881713
Categoría:	CentOS Local Security Checks
Título:	CentOS Update for icedtea-web CESA-2013:0753 centos6
Resumen:	The remote host is missing an update for the 'icedtea-web'; package(s) announced via the referenced advisory.
Descripción:	Summary: The remote host is missing an update for the 'icedtea-web' package(s) announced via the referenced advisory. Vulnerability Insight: The IcedTea-Web project provides a Java web browser plug-in and an implementation of Java Web Start, which is based on the Netx project. It also contains a configuration tool for managing deployment settings for the plug-in and Web Start implementations. It was discovered that the IcedTea-Web plug-in incorrectly used the same class loader instance for applets with the same value of the codebase attribute, even when they originated from different domains. A malicious applet could use this flaw to gain information about and possibly manipulate applets from different domains currently running in the browser. (CVE-2013-1926) The IcedTea-Web plug-in did not properly check the format of the downloaded Java Archive (JAR) files. This could cause the plug-in to execute code hidden in a file in a different format, possibly allowing attackers to execute code in the context of web sites that allow uploads of specific file types, known as a GIFAR attack. (CVE-2013-1927) The CVE-2013-1926 issue was discovered by Jiri Vanek of the Red Hat OpenJDK Team, and CVE-2013-1927 was discovered by the Red Hat Security Response Team. This erratum also upgrades IcedTea-Web to version 1.2.3. Refer to the NEWS file, linked to in the References, for further information. All IcedTea-Web users should upgrade to these updated packages, which resolve these issues. Web browsers using the IcedTea-Web browser plug-in must be restarted for this update to take effect. Affected Software/OS: icedtea-web on CentOS 6 Solution: Please install the updated packages. CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2013-1926 BugTraq ID: 59281 http://www.securityfocus.com/bid/59281 http://www.mandriva.com/security/advisories?name=MDVSA-2013:146 https://bugzilla.redhat.com/show_bug.cgi?id=916774 https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0123 http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-April/022790.html http://osvdb.org/92543 RedHat Security Advisories: RHSA-2013:0753 http://rhn.redhat.com/errata/RHSA-2013-0753.html http://secunia.com/advisories/53109 http://secunia.com/advisories/53117 SuSE Security Announcement: SUSE-SU-2013:0851 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00020.html SuSE Security Announcement: SUSE-SU-2013:1174 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00013.html SuSE Security Announcement: openSUSE-SU-2013:0715 (Google Search) http://lists.opensuse.org/opensuse-updates/2013-04/msg00106.html SuSE Security Announcement: openSUSE-SU-2013:0735 (Google Search) http://lists.opensuse.org/opensuse-updates/2013-05/msg00003.html SuSE Security Announcement: openSUSE-SU-2013:0826 (Google Search) http://lists.opensuse.org/opensuse-updates/2013-05/msg00032.html SuSE Security Announcement: openSUSE-SU-2013:0893 (Google Search) http://lists.opensuse.org/opensuse-updates/2013-06/msg00030.html SuSE Security Announcement: openSUSE-SU-2013:0897 (Google Search) http://lists.opensuse.org/opensuse-updates/2013-06/msg00034.html SuSE Security Announcement: openSUSE-SU-2013:0966 (Google Search) http://lists.opensuse.org/opensuse-updates/2013-06/msg00101.html http://www.ubuntu.com/usn/USN-1804-1 XForce ISS Database: icedtea-cve20131940-security-bypass(83642) https://exchange.xforce.ibmcloud.com/vulnerabilities/83642 Common Vulnerability Exposure (CVE) ID: CVE-2013-1927 BugTraq ID: 59286 http://www.securityfocus.com/bid/59286 https://bugzilla.redhat.com/show_bug.cgi?id=884705 http://osvdb.org/92544 XForce ISS Database: icedtea-cve20131927-sec-bypass(83640) https://exchange.xforce.ibmcloud.com/vulnerabilities/83640
Copyright	Copyright (C) 2013 Greenbone AG

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.