The remote Mac OS X 10.5 host is running a version of Java for Mac OS X that is missing Update 4.

The remote version of this software contains several security vulnerabilities.  A remote attacker could exploit these issues to bypass security restrictions, disclose sensitive information, cause a denial of service, or escalate privileges.

a. Service Console update for DHCP and third-party library update    for DHCP client.

   DHCP is an Internet-standard protocol by which a computer can be    connected to a local network, ask to be given configuration    information, and receive from a server enough information to    configure itself as a member of that network.

   A stack-based buffer overflow in the script_write_params method in    ISC DHCP dhclient allows remote DHCP servers to execute arbitrary    code via a crafted subnet-mask option.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-0692 to this issue.

   An insecure temporary file use flaw was discovered in the DHCP    daemon's init script ('/etc/init.d/dhcpd'). A local attacker could    use this flaw to overwrite an arbitrary file with the output of the    'dhcpd -t' command via a symbolic link attack, if a system    administrator executed the DHCP init script with the 'configtest',    'restart', or 'reload' option.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-1893 to this issue.

b. Updated Service Console package kernel

   Service Console package kernel update to version    kernel-2.4.21-58.EL.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2008-4210, CVE-2008-3275, CVE-2008-0598,    CVE-2008-2136, CVE-2008-2812, CVE-2007-6063, CVE-2008-3525 to the    security issues fixed in kernel-2.4.21-58.EL

c. JRE Security Update

   JRE update to version 1.5.0_18, which addresses multiple security    issues that existed in earlier releases of JRE.

   The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the following names to the security issues fixed in    JRE 1.5.0_17: CVE-2008-2086, CVE-2008-5347, CVE-2008-5348,    CVE-2008-5349, CVE-2008-5350, CVE-2008-5351, CVE-2008-5352,    CVE-2008-5353, CVE-2008-5354, CVE-2008-5356, CVE-2008-5357,    CVE-2008-5358, CVE-2008-5359, CVE-2008-5360, CVE-2008-5339,    CVE-2008-5342, CVE-2008-5344, CVE-2008-5345, CVE-2008-5346,    CVE-2008-5340, CVE-2008-5341, CVE-2008-5343, and CVE-2008-5355.

   The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the following names to the security issues fixed in    JRE 1.5.0_18: CVE-2009-1093, CVE-2009-1094, CVE-2009-1095,    CVE-2009-1096, CVE-2009-1097, CVE-2009-1098, CVE-2009-1099,    CVE-2009-1100, CVE-2009-1101, CVE-2009-1102, CVE-2009-1103,    CVE-2009-1104, CVE-2009-1105, CVE-2009-1106, and CVE-2009-1107.

Updated java-1.6.0-ibm packages that fix several security issues are now available for Red Hat Network Satellite Server 5.3.

This update has been rated as having low security impact by the Red Hat Security Response Team.

This update corrects several security vulnerabilities in the IBM Java Runtime Environment shipped as part of Red Hat Network Satellite Server 5.3. In a typical operating environment, these are of low security risk as the runtime is not used on untrusted applets.

Several flaws were fixed in the IBM Java 2 Runtime Environment.
(CVE-2009-0217, CVE-2009-1093, CVE-2009-1094, CVE-2009-1095, CVE-2009-1096, CVE-2009-1097, CVE-2009-1098, CVE-2009-1099, CVE-2009-1100, CVE-2009-1101, CVE-2009-1103, CVE-2009-1104, CVE-2009-1105, CVE-2009-1106, CVE-2009-1107, CVE-2009-2625, CVE-2009-2670, CVE-2009-2671, CVE-2009-2672, CVE-2009-2673, CVE-2009-2674, CVE-2009-2675, CVE-2009-2676, CVE-2009-3865, CVE-2009-3866, CVE-2009-3867, CVE-2009-3868, CVE-2009-3869, CVE-2009-3871, CVE-2009-3872, CVE-2009-3873, CVE-2009-3874, CVE-2009-3875, CVE-2009-3876, CVE-2009-3877)

Users of Red Hat Network Satellite Server 5.3 are advised to upgrade to these updated java-1.6.0-ibm packages, which resolve these issues.
For this update to take effect, Red Hat Network Satellite Server must be restarted ('/usr/sbin/rhn-satellite restart'), as well as all running instances of IBM Java.

ID	名稱	產品	系列	已發布	已更新	嚴重性
39435	Mac OS X : Java for Mac OS X 10.5 Update 4	Nessus	MacOS X Local Security Checks	2009/6/17	2024/7/24	high
42179	VMSA-2009-0014 : VMware ESX patches for DHCP, Service Console kernel, and JRE resolve multiple security issues	Nessus	VMware ESX Local Security Checks	2009/10/19	2021/1/6	high
44029	RHEL 4 / 5 : IBM Java Runtime in Satellite Server (RHSA-2010:0043)	Nessus	Red Hat Local Security Checks	2010/1/15	2021/1/14	critical

偵測

搜尋 Plugin

high

high

critical