Test ID:	1.3.6.1.4.1.25623.1.0.870384
Category:	Red Hat Local Security Checks
Title:	RedHat Update for java-1.6.0-openjdk RHSA-2011:0176-01
Summary:	The remote host is missing an update for the 'java-1.6.0-openjdk'; package(s) announced via the referenced advisory.
Description:	Summary: The remote host is missing an update for the 'java-1.6.0-openjdk' package(s) announced via the referenced advisory. Vulnerability Insight: These packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Software Development Kit. The javaws command can be used to launch Java Web Start applications. A public static field declaration allowed untrusted JNLP (Java Network Launching Protocol) applications to read privileged data. A remote attacker could directly or indirectly read the values of restricted system properties, such as 'user.name', 'user.home', and 'java.home', which untrusted applications should not be allowed to read. (CVE-2010-3860) It was found that JNLPSecurityManager could silently return without throwing an exception when permission was denied. If the javaws command was used to launch a Java Web Start application that relies on this exception being thrown, it could result in that application being run with elevated privileges, allowing it to bypass security manager restrictions and gain access to privileged functionality. (CVE-2010-4351) Note: The RHSA-2010:0339 java-1.6.0-openjdk update installed javaws by mistake. As part of the fixes for CVE-2010-3860 and CVE-2010-4351, this update removes javaws. Red Hat would like to thank the TippingPoint Zero Day Initiative project for reporting CVE-2010-4351. The original issue reporter wishes to stay anonymous. This erratum also upgrades the OpenJDK package to IcedTea6 1.7.7. Refer to the NEWS file, linked to in the References, for further information. All users of java-1.6.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect. Affected Software/OS: java-1.6.0-openjdk on Red Hat Enterprise Linux (v. 5 server) Solution: Please Install the Updated Packages. CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2010-3860 42412 http://secunia.com/advisories/42412 42417 http://secunia.com/advisories/42417 43085 http://secunia.com/advisories/43085 45114 http://www.securityfocus.com/bid/45114 ADV-2010-3090 http://www.vupen.com/english/advisories/2010/3090 ADV-2010-3108 http://www.vupen.com/english/advisories/2010/3108 ADV-2011-0215 http://www.vupen.com/english/advisories/2011/0215 FEDORA-2010-18393 http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051711.html GLSA-201406-32 http://security.gentoo.org/glsa/glsa-201406-32.xml RHSA-2011:0176 http://www.redhat.com/support/errata/RHSA-2011-0176.html SUSE-SR:2010:023 http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00000.html USN-1024-1 http://www.ubuntu.com/usn/USN-1024-1 http://blog.fuseyism.com/index.php/2010/11/24/icedtea6-176-183-and-192-released/ http://icedtea.classpath.org/hg/release/icedtea6-1.9/rev/9aa0018d8c28 https://bugzilla.redhat.com/show_bug.cgi?id=645843 Common Vulnerability Exposure (CVE) ID: CVE-2010-4351 43002 http://secunia.com/advisories/43002 43078 http://secunia.com/advisories/43078 43135 http://secunia.com/advisories/43135 45894 http://www.securityfocus.com/bid/45894 70605 http://osvdb.org/70605 ADV-2011-0165 http://www.vupen.com/english/advisories/2011/0165 ADV-2011-0166 http://www.vupen.com/english/advisories/2011/0166 ADV-2011-0239 http://www.vupen.com/english/advisories/2011/0239 DSA-2224 http://www.debian.org/security/2011/dsa-2224 FEDORA-2011-0500 http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053288.html FEDORA-2011-0521 http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053276.html MDVSA-2011:054 http://www.mandriva.com/security/advisories?name=MDVSA-2011:054 USN-1052-1 http://www.ubuntu.com/usn/USN-1052-1 USN-1055-1 http://www.ubuntu.com/usn/USN-1055-1 http://blog.fuseyism.com/index.php/2011/01/18/security-icedtea6-177-184-194-released/ http://www.zerodayinitiative.com/advisories/ZDI-11-014/ https://bugzilla.redhat.com/show_bug.cgi?id=663680 icedtea-jnlp-code-execution(64893) https://exchange.xforce.ibmcloud.com/vulnerabilities/64893
Copyright	Copyright (C) 2011 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.