Updated java-1.6.0-openjdk packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5, 6, and 7.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The java-1.6.0-openjdk packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Java Software Development Kit.

Multiple flaws were discovered in the 2D, CORBA, JMX, Libraries and RMI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions.
(CVE-2015-4760, CVE-2015-2628, CVE-2015-4731, CVE-2015-2590, CVE-2015-4732, CVE-2015-4733)

A flaw was found in the way the Libraries component of OpenJDK verified Online Certificate Status Protocol (OCSP) responses. An OCSP response with no nextUpdate date specified was incorrectly handled as having unlimited validity, possibly causing a revoked X.509 certificate to be interpreted as valid. (CVE-2015-4748)

It was discovered that the JCE component in OpenJDK failed to use constant time comparisons in multiple cases. An attacker could possibly use these flaws to disclose sensitive information by measuring the time used to perform operations using these non-constant time comparisons. (CVE-2015-2601)

A flaw was found in the RC4 encryption algorithm. When using certain keys for RC4 encryption, an attacker could obtain portions of the plain text from the cipher text without the knowledge of the encryption key. (CVE-2015-2808)

Note: With this update, OpenJDK now disables RC4 TLS/SSL cipher suites by default to address the CVE-2015-2808 issue. Refer to Red Hat Bugzilla bug 1207101, linked to in the References section, for additional details about this change.

A flaw was found in the way the TLS protocol composed the Diffie-Hellman (DH) key exchange. A man-in-the-middle attacker could use this flaw to force the use of weak 512 bit export-grade keys during the key exchange, allowing them to decrypt all traffic.
(CVE-2015-4000)

Note: This update forces the TLS/SSL client implementation in OpenJDK to reject DH key sizes below 768 bits, which prevents sessions to be downgraded to export-grade keys. Refer to Red Hat Bugzilla bug 1223211, linked to in the References section, for additional details about this change.

It was discovered that the JNDI component in OpenJDK did not handle DNS resolutions correctly. An attacker able to trigger such DNS errors could cause a Java application using JNDI to consume memory and CPU time, and possibly block further DNS resolution. (CVE-2015-4749)

Multiple information leak flaws were found in the JMX and 2D components in OpenJDK. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions.
(CVE-2015-2621, CVE-2015-2632)

A flaw was found in the way the JSSE component in OpenJDK performed X.509 certificate identity verification when establishing a TLS/SSL connection to a host identified by an IP address. In certain cases, the certificate was accepted as valid if it was issued for a host name to which the IP address resolves rather than for the IP address.
(CVE-2015-2625)

All users of java-1.6.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect.

OpenJDK was updated to 2.6.1 - OpenJDK 7u85 to fix security issues and bugs.

The following vulnerabilities were fixed :

  - CVE-2015-2590: Easily exploitable vulnerability in the     Libraries component allowed successful unauthenticated     network attacks via multiple protocols. Successful     attack of this vulnerability could have resulted in     unauthorized Operating System takeover including     arbitrary code execution.

  - CVE-2015-2596: Difficult to exploit vulnerability in the     Hotspot component allowed successful unauthenticated     network attacks via multiple protocols. Successful     attack of this vulnerability could have resulted in     unauthorized update, insert or delete access to some     Java accessible data.

  - CVE-2015-2597: Easily exploitable vulnerability in the     Install component requiring logon to Operating System.
    Successful attack of this vulnerability could have     resulted in unauthorized Operating System takeover     including arbitrary code execution.

  - CVE-2015-2601: Easily exploitable vulnerability in the     JCE component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java accessible data.

  - CVE-2015-2613: Easily exploitable vulnerability in the     JCE component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java SE, Java SE Embedded     accessible data.

  - CVE-2015-2619: Easily exploitable vulnerability in the     2D component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java accessible data.

  - CVE-2015-2621: Easily exploitable vulnerability in the     JMX component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java accessible data.

  - CVE-2015-2625: Very difficult to exploit vulnerability     in the JSSE component allowed successful unauthenticated     network attacks via SSL/TLS. Successful attack of this     vulnerability could have resulted in unauthorized read     access to a subset of Java accessible data.

  - CVE-2015-2627: Very difficult to exploit vulnerability     in the Install component allowed successful     unauthenticated network attacks via multiple protocols.
    Successful attack of this vulnerability could have     resulted in unauthorized read access to a subset of Java     accessible data.

  - CVE-2015-2628: Easily exploitable vulnerability in the     CORBA component allowed successful unauthenticated     network attacks via multiple protocols. Successful     attack of this vulnerability could have resulted in     unauthorized Operating System takeover including     arbitrary code execution.

  - CVE-2015-2632: Easily exploitable vulnerability in the     2D component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java accessible data.

  - CVE-2015-2637: Easily exploitable vulnerability in the     2D component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java accessible data.

  - CVE-2015-2638: Easily exploitable vulnerability in the     2D component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     Operating System takeover including arbitrary code     execution.

  - CVE-2015-2664: Difficult to exploit vulnerability in the     Deployment component requiring logon to Operating     System. Successful attack of this vulnerability could     have resulted in unauthorized Operating System takeover     including arbitrary code execution.

  - CVE-2015-2808: Very difficult to exploit vulnerability     in the JSSE component allowed successful unauthenticated     network attacks via SSL/TLS. Successful attack of this     vulnerability could have resulted in unauthorized     update, insert or delete access to some Java accessible     data as well as read access to a subset of Java     accessible data.

  - CVE-2015-4000: Very difficult to exploit vulnerability     in the JSSE component allowed successful unauthenticated     network attacks via SSL/TLS. Successful attack of this     vulnerability could have resulted in unauthorized     update, insert or delete access to some Java accessible     data as well as read access to a subset of Java Embedded     accessible data.

  - CVE-2015-4729: Very difficult to exploit vulnerability     in the Deployment component allowed successful     unauthenticated network attacks via multiple protocols.
    Successful attack of this vulnerability could have     resulted in unauthorized update, insert or delete access     to some Java SE accessible data as well as read access     to a subset of Java SE accessible data.

  - CVE-2015-4731: Easily exploitable vulnerability in the     JMX component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     Operating System takeover including arbitrary code     execution.

  - CVE-2015-4732: Easily exploitable vulnerability in the     Libraries component allowed successful unauthenticated     network attacks via multiple protocols. Successful     attack of this vulnerability could have resulted in     unauthorized Operating System takeover including     arbitrary code execution.

  - CVE-2015-4733: Easily exploitable vulnerability in the     RMI component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     Operating System takeover including arbitrary code     execution.

  - CVE-2015-4736: Difficult to exploit vulnerability in the     Deployment component allowed successful unauthenticated     network attacks via multiple protocols. Successful     attack of this vulnerability could have resulted in     unauthorized Operating System takeover including     arbitrary code execution.

  - CVE-2015-4748: Very difficult to exploit vulnerability     in the Security component allowed successful     unauthenticated network attacks via OCSP. Successful     attack of this vulnerability could have resulted in     unauthorized Operating System takeover including     arbitrary code execution.

  - CVE-2015-4749: Difficult to exploit vulnerability in the     JNDI component allowed successful unauthenticated     network attacks via multiple protocols. Successful     attack of this vulnerability could have resulted in     unauthorized ability to cause a partial denial of     service (partial DOS).

  - CVE-2015-4760: Easily exploitable vulnerability in the     2D component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     Operating System takeover including arbitrary code     execution.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

IBM Java was updated to 7.1-3.10 to fix several security issues.

The following vulnerabilities were fixed :

  - CVE-2015-1931: IBM Java Security Components store plain     text data in memory dumps, which could allow a local     attacker to obtain information to aid in further attacks     against the system.

  - CVE-2015-2590: Easily exploitable vulnerability in the     Libraries component allowed successful unauthenticated     network attacks via multiple protocols. Successful     attack of this vulnerability could have resulted in     unauthorized Operating System takeover including     arbitrary code execution.

  - CVE-2015-2601: Easily exploitable vulnerability in the     JCE component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java accessible data.

  - CVE-2015-2613: Easily exploitable vulnerability in the     JCE component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java SE, Java SE Embedded     accessible data.

  - CVE-2015-2619: Easily exploitable vulnerability in the     2D component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java accessible data.

  - CVE-2015-2621: Easily exploitable vulnerability in the     JMX component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java accessible data.

  - CVE-2015-2625: Very difficult to exploit vulnerability     in the JSSE component allowed successful unauthenticated     network attacks via SSL/TLS. Successful attack of this     vulnerability could have resulted in unauthorized read     access to a subset of Java accessible data.

  - CVE-2015-2632: Easily exploitable vulnerability in the     2D component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java accessible data.

  - CVE-2015-2637: Easily exploitable vulnerability in the     2D component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java accessible data.

  - CVE-2015-2638: Easily exploitable vulnerability in the     2D component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     Operating System takeover including arbitrary code     execution.

  - CVE-2015-2664: Difficult to exploit vulnerability in the     Deployment component requiring logon to Operating     System. Successful attack of this vulnerability could     have resulted in unauthorized Operating System takeover     including arbitrary code execution.

  - CVE-2015-2808: Very difficult to exploit vulnerability     in the JSSE component allowed successful unauthenticated     network attacks via SSL/TLS. Successful attack of this     vulnerability could have resulted in unauthorized     update, insert or delete access to some Java accessible     data as well as read access to a subset of Java     accessible data.

  - CVE-2015-4000: Very difficult to exploit vulnerability     in the JSSE component allowed successful unauthenticated     network attacks via SSL/TLS. Successful attack of this     vulnerability could have resulted in unauthorized     update, insert or delete access to some Java accessible     data as well as read access to a subset of Java Embedded     accessible data.

  - CVE-2015-4729: Very difficult to exploit vulnerability     in the Deployment component allowed successful     unauthenticated network attacks via multiple protocols.
    Successful attack of this vulnerability could have     resulted in unauthorized update, insert or delete access     to some Java SE accessible data as well as read access     to a subset of Java SE accessible data.

  - CVE-2015-4731: Easily exploitable vulnerability in the     JMX component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     Operating System takeover including arbitrary code     execution.

  - CVE-2015-4732: Easily exploitable vulnerability in the     Libraries component allowed successful unauthenticated     network attacks via multiple protocols. Successful     attack of this vulnerability could have resulted in     unauthorized Operating System takeover including     arbitrary code execution.

  - CVE-2015-4733: Easily exploitable vulnerability in the     RMI component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     Operating System takeover including arbitrary code     execution.

  - CVE-2015-4748: Very difficult to exploit vulnerability     in the Security component allowed successful     unauthenticated network attacks via OCSP. Successful     attack of this vulnerability could have resulted in     unauthorized Operating System takeover including     arbitrary code execution.

  - CVE-2015-4749: Difficult to exploit vulnerability in the     JNDI component allowed successful unauthenticated     network attacks via multiple protocols. Successful     attack of this vulnerability could have resulted in     unauthorized ability to cause a partial denial of     service (partial DOS).

  - CVE-2015-4760: Easily exploitable vulnerability in the     2D component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     Operating System takeover including arbitrary code     execution.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in the execution of arbitrary code, breakouts of the Java sandbox, information disclosure, denial of service or insecure cryptography.

The remote host is affected by the vulnerability described in GLSA-201603-11 (Oracle JRE/JDK: Multiple vulnerabilities)

    Multiple vulnerabilities exist in both Oracle&rsquo;s JRE and JDK.  Please       review the referenced CVE&rsquo;s for additional information.
  Impact :

    Remote attackers could gain access to information, remotely execute       arbitrary code, and cause Denial of Service.
  Workaround :

    There is no known workaround at this time.

The remote host is affected by the vulnerability described in GLSA-201603-14 (IcedTea: Multiple vulnerabilities)

    Various OpenJDK attack vectors in IcedTea, such as 2D, Corba, Hotspot,       Libraries, and JAXP, exist which allows remote attackers to affect the       confidentiality, integrity, and availability of vulnerable systems.  This       includes the possibility of remote execution of arbitrary code,       information disclosure, or Denial of Service.  Many of the       vulnerabilities can only be exploited through sandboxed Java Web Start       applications and java applets.  Please reference the CVEs listed for       specific details.
  Impact :

    Remote attackers may remotely execute arbitrary code, compromise       information, or cause Denial of Service.
  Workaround :

    There is no known work around at this time.

ID	名稱	產品	系列	已發布	已更新	嚴重性
85127	CentOS 5 / 6 / 7 : java-1.6.0-openjdk (CESA-2015:1526) (Bar Mitzvah) (Logjam)	Nessus	CentOS Local Security Checks	2015/7/31	2025/2/18	medium
85152	SUSE SLED12 / SLES12 Security Update : java-1_7_0-openjdk (SUSE-SU-2015:1319-1) (Bar Mitzvah) (Logjam)	Nessus	SuSE Local Security Checks	2015/7/31	2022/12/5	low
85214	SUSE SLES12 Security Update : java-1_7_1-ibm (SUSE-SU-2015:1331-1) (Bar Mitzvah) (Logjam)	Nessus	SuSE Local Security Checks	2015/8/4	2022/12/5	low
85588	Debian DSA-3339-1 : openjdk-6 - security update (Bar Mitzvah) (Logjam)	Nessus	Debian Local Security Checks	2015/8/24	2022/12/5	low
89904	GLSA-201603-11 : Oracle JRE/JDK: Multiple vulnerabilities (Logjam)	Nessus	Gentoo Local Security Checks	2016/3/14	2022/12/5	low
89907	GLSA-201603-14 : IcedTea: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2016/3/14	2022/3/8	critical

偵測

搜尋 Plugin

medium

low

low

low

low

critical