Test ID:	1.3.6.1.4.1.25623.1.0.881713
Category:	CentOS Local Security Checks
Title:	CentOS Update for icedtea-web CESA-2013:0753 centos6
Summary:	The remote host is missing an update for the 'icedtea-web'; package(s) announced via the referenced advisory.
Description:	Summary: The remote host is missing an update for the 'icedtea-web' package(s) announced via the referenced advisory. Vulnerability Insight: The IcedTea-Web project provides a Java web browser plug-in and an implementation of Java Web Start, which is based on the Netx project. It also contains a configuration tool for managing deployment settings for the plug-in and Web Start implementations. It was discovered that the IcedTea-Web plug-in incorrectly used the same class loader instance for applets with the same value of the codebase attribute, even when they originated from different domains. A malicious applet could use this flaw to gain information about and possibly manipulate applets from different domains currently running in the browser. (CVE-2013-1926) The IcedTea-Web plug-in did not properly check the format of the downloaded Java Archive (JAR) files. This could cause the plug-in to execute code hidden in a file in a different format, possibly allowing attackers to execute code in the context of web sites that allow uploads of specific file types, known as a GIFAR attack. (CVE-2013-1927) The CVE-2013-1926 issue was discovered by Jiri Vanek of the Red Hat OpenJDK Team, and CVE-2013-1927 was discovered by the Red Hat Security Response Team. This erratum also upgrades IcedTea-Web to version 1.2.3. Refer to the NEWS file, linked to in the References, for further information. All IcedTea-Web users should upgrade to these updated packages, which resolve these issues. Web browsers using the IcedTea-Web browser plug-in must be restarted for this update to take effect. Affected Software/OS: icedtea-web on CentOS 6 Solution: Please install the updated packages. CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2013-1926 BugTraq ID: 59281 http://www.securityfocus.com/bid/59281 http://www.mandriva.com/security/advisories?name=MDVSA-2013:146 https://bugzilla.redhat.com/show_bug.cgi?id=916774 https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0123 http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-April/022790.html http://osvdb.org/92543 RedHat Security Advisories: RHSA-2013:0753 http://rhn.redhat.com/errata/RHSA-2013-0753.html http://secunia.com/advisories/53109 http://secunia.com/advisories/53117 SuSE Security Announcement: SUSE-SU-2013:0851 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00020.html SuSE Security Announcement: SUSE-SU-2013:1174 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00013.html SuSE Security Announcement: openSUSE-SU-2013:0715 (Google Search) http://lists.opensuse.org/opensuse-updates/2013-04/msg00106.html SuSE Security Announcement: openSUSE-SU-2013:0735 (Google Search) http://lists.opensuse.org/opensuse-updates/2013-05/msg00003.html SuSE Security Announcement: openSUSE-SU-2013:0826 (Google Search) http://lists.opensuse.org/opensuse-updates/2013-05/msg00032.html SuSE Security Announcement: openSUSE-SU-2013:0893 (Google Search) http://lists.opensuse.org/opensuse-updates/2013-06/msg00030.html SuSE Security Announcement: openSUSE-SU-2013:0897 (Google Search) http://lists.opensuse.org/opensuse-updates/2013-06/msg00034.html SuSE Security Announcement: openSUSE-SU-2013:0966 (Google Search) http://lists.opensuse.org/opensuse-updates/2013-06/msg00101.html http://www.ubuntu.com/usn/USN-1804-1 XForce ISS Database: icedtea-cve20131940-security-bypass(83642) https://exchange.xforce.ibmcloud.com/vulnerabilities/83642 Common Vulnerability Exposure (CVE) ID: CVE-2013-1927 BugTraq ID: 59286 http://www.securityfocus.com/bid/59286 https://bugzilla.redhat.com/show_bug.cgi?id=884705 http://osvdb.org/92544 XForce ISS Database: icedtea-cve20131927-sec-bypass(83640) https://exchange.xforce.ibmcloud.com/vulnerabilities/83640
Copyright	Copyright (C) 2013 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.