ID

VAR-201205-0058

CVE

CVE-2012-0551

TITLE

Oracle GlassFish Server In Web Container handling vulnerabilities

DESCRIPTION

Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE 7 update 4 and earlier and 6 update 32 and earlier, and the GlassFish Enterprise Server component in Oracle Sun Products Suite GlassFish Enterprise Server 3.1.1, allows remote attackers to affect confidentiality and integrity via unknown vectors related to Web Container or Deployment. Oracle GlassFish Server Is Web There are vulnerabilities that affect confidentiality and integrity due to incomplete handling of containers.There is a possibility that information will be leaked or altered by a third party. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible. This vulnerability affects the following supported versions: GlassFish Enterprise Server 3.1.1. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: java-1.6.0-ibm security update Advisory ID: RHSA-2012:1238-01 Product: Red Hat Enterprise Linux Extras Advisory URL: https://rhn.redhat.com/errata/RHSA-2012-1238.html Issue date: 2012-09-06 CVE Names: CVE-2012-0551 CVE-2012-1713 CVE-2012-1716 CVE-2012-1717 CVE-2012-1718 CVE-2012-1719 CVE-2012-1721 CVE-2012-1722 CVE-2012-1725 ===================================================================== 1. Summary: Updated java-1.6.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6 Supplementary. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux HPC Node Supplementary (v. 6) - x86_64 Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, ppc, s390x, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. Description: IBM Java SE version 6 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Detailed vulnerability descriptions are linked from the IBM Security alerts page, listed in the References section. (CVE-2012-0551, CVE-2012-1713, CVE-2012-1716, CVE-2012-1717, CVE-2012-1718, CVE-2012-1719, CVE-2012-1721, CVE-2012-1722, CVE-2012-1725) All users of java-1.6.0-ibm are advised to upgrade to these updated packages, containing the IBM Java SE 6 SR11 release. All running instances of IBM Java must be restarted for the update to take effect. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258 5. Bugs fixed (http://bugzilla.redhat.com/): 829358 - CVE-2012-1717 OpenJDK: insecure temporary file permissions (JRE, 7143606) 829360 - CVE-2012-1716 OpenJDK: SynthLookAndFeel application context bypass (Swing, 7143614) 829361 - CVE-2012-1713 OpenJDK: fontmanager layout lookup code memory corruption (2D, 7143617) 829371 - CVE-2012-1719 OpenJDK: mutable repository identifiers in generated stub code (CORBA, 7143851) 829372 - CVE-2012-1718 OpenJDK: CRL and certificate extensions handling improvements (Security, 7143872) 829376 - CVE-2012-1725 OpenJDK: insufficient invokespecial <init> verification (HotSpot, 7160757) 831353 - CVE-2012-1721 Oracle JDK: unspecified vulnerability fixed in 6u33 and 7u5 (Deployment) 831354 - CVE-2012-1722 Oracle JDK: unspecified vulnerability fixed in 6u33 and 7u5 (Deployment) 831355 - CVE-2012-0551 Oracle JDK: unspecified vulnerability fixed in 6u33 and 7u5 (Deployment) 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 5): i386: java-1.6.0-ibm-1.6.0.11.0-1jpp.1.el5_8.i386.rpm java-1.6.0-ibm-accessibility-1.6.0.11.0-1jpp.1.el5_8.i386.rpm java-1.6.0-ibm-demo-1.6.0.11.0-1jpp.1.el5_8.i386.rpm java-1.6.0-ibm-devel-1.6.0.11.0-1jpp.1.el5_8.i386.rpm java-1.6.0-ibm-javacomm-1.6.0.11.0-1jpp.1.el5_8.i386.rpm java-1.6.0-ibm-jdbc-1.6.0.11.0-1jpp.1.el5_8.i386.rpm java-1.6.0-ibm-plugin-1.6.0.11.0-1jpp.1.el5_8.i386.rpm java-1.6.0-ibm-src-1.6.0.11.0-1jpp.1.el5_8.i386.rpm x86_64: java-1.6.0-ibm-1.6.0.11.0-1jpp.1.el5_8.i386.rpm java-1.6.0-ibm-1.6.0.11.0-1jpp.1.el5_8.x86_64.rpm java-1.6.0-ibm-accessibility-1.6.0.11.0-1jpp.1.el5_8.x86_64.rpm java-1.6.0-ibm-demo-1.6.0.11.0-1jpp.1.el5_8.i386.rpm java-1.6.0-ibm-demo-1.6.0.11.0-1jpp.1.el5_8.x86_64.rpm java-1.6.0-ibm-devel-1.6.0.11.0-1jpp.1.el5_8.i386.rpm java-1.6.0-ibm-devel-1.6.0.11.0-1jpp.1.el5_8.x86_64.rpm java-1.6.0-ibm-javacomm-1.6.0.11.0-1jpp.1.el5_8.i386.rpm java-1.6.0-ibm-javacomm-1.6.0.11.0-1jpp.1.el5_8.x86_64.rpm java-1.6.0-ibm-jdbc-1.6.0.11.0-1jpp.1.el5_8.i386.rpm java-1.6.0-ibm-jdbc-1.6.0.11.0-1jpp.1.el5_8.x86_64.rpm java-1.6.0-ibm-plugin-1.6.0.11.0-1jpp.1.el5_8.i386.rpm java-1.6.0-ibm-plugin-1.6.0.11.0-1jpp.1.el5_8.x86_64.rpm java-1.6.0-ibm-src-1.6.0.11.0-1jpp.1.el5_8.i386.rpm java-1.6.0-ibm-src-1.6.0.11.0-1jpp.1.el5_8.x86_64.rpm Red Hat Enterprise Linux Server Supplementary (v. 5): i386: java-1.6.0-ibm-1.6.0.11.0-1jpp.1.el5_8.i386.rpm java-1.6.0-ibm-accessibility-1.6.0.11.0-1jpp.1.el5_8.i386.rpm java-1.6.0-ibm-demo-1.6.0.11.0-1jpp.1.el5_8.i386.rpm java-1.6.0-ibm-devel-1.6.0.11.0-1jpp.1.el5_8.i386.rpm java-1.6.0-ibm-javacomm-1.6.0.11.0-1jpp.1.el5_8.i386.rpm java-1.6.0-ibm-jdbc-1.6.0.11.0-1jpp.1.el5_8.i386.rpm java-1.6.0-ibm-plugin-1.6.0.11.0-1jpp.1.el5_8.i386.rpm java-1.6.0-ibm-src-1.6.0.11.0-1jpp.1.el5_8.i386.rpm ppc: java-1.6.0-ibm-1.6.0.11.0-1jpp.1.el5_8.ppc.rpm java-1.6.0-ibm-1.6.0.11.0-1jpp.1.el5_8.ppc64.rpm java-1.6.0-ibm-accessibility-1.6.0.11.0-1jpp.1.el5_8.ppc.rpm java-1.6.0-ibm-demo-1.6.0.11.0-1jpp.1.el5_8.ppc.rpm java-1.6.0-ibm-demo-1.6.0.11.0-1jpp.1.el5_8.ppc64.rpm java-1.6.0-ibm-devel-1.6.0.11.0-1jpp.1.el5_8.ppc.rpm java-1.6.0-ibm-devel-1.6.0.11.0-1jpp.1.el5_8.ppc64.rpm java-1.6.0-ibm-javacomm-1.6.0.11.0-1jpp.1.el5_8.ppc.rpm java-1.6.0-ibm-javacomm-1.6.0.11.0-1jpp.1.el5_8.ppc64.rpm java-1.6.0-ibm-jdbc-1.6.0.11.0-1jpp.1.el5_8.ppc.rpm java-1.6.0-ibm-jdbc-1.6.0.11.0-1jpp.1.el5_8.ppc64.rpm java-1.6.0-ibm-plugin-1.6.0.11.0-1jpp.1.el5_8.ppc.rpm java-1.6.0-ibm-src-1.6.0.11.0-1jpp.1.el5_8.ppc.rpm java-1.6.0-ibm-src-1.6.0.11.0-1jpp.1.el5_8.ppc64.rpm s390x: java-1.6.0-ibm-1.6.0.11.0-1jpp.1.el5_8.s390.rpm java-1.6.0-ibm-1.6.0.11.0-1jpp.1.el5_8.s390x.rpm java-1.6.0-ibm-accessibility-1.6.0.11.0-1jpp.1.el5_8.s390x.rpm java-1.6.0-ibm-demo-1.6.0.11.0-1jpp.1.el5_8.s390.rpm java-1.6.0-ibm-demo-1.6.0.11.0-1jpp.1.el5_8.s390x.rpm java-1.6.0-ibm-devel-1.6.0.11.0-1jpp.1.el5_8.s390.rpm java-1.6.0-ibm-devel-1.6.0.11.0-1jpp.1.el5_8.s390x.rpm java-1.6.0-ibm-jdbc-1.6.0.11.0-1jpp.1.el5_8.s390.rpm java-1.6.0-ibm-jdbc-1.6.0.11.0-1jpp.1.el5_8.s390x.rpm java-1.6.0-ibm-src-1.6.0.11.0-1jpp.1.el5_8.s390.rpm java-1.6.0-ibm-src-1.6.0.11.0-1jpp.1.el5_8.s390x.rpm x86_64: java-1.6.0-ibm-1.6.0.11.0-1jpp.1.el5_8.i386.rpm java-1.6.0-ibm-1.6.0.11.0-1jpp.1.el5_8.x86_64.rpm java-1.6.0-ibm-accessibility-1.6.0.11.0-1jpp.1.el5_8.x86_64.rpm java-1.6.0-ibm-demo-1.6.0.11.0-1jpp.1.el5_8.i386.rpm java-1.6.0-ibm-demo-1.6.0.11.0-1jpp.1.el5_8.x86_64.rpm java-1.6.0-ibm-devel-1.6.0.11.0-1jpp.1.el5_8.i386.rpm java-1.6.0-ibm-devel-1.6.0.11.0-1jpp.1.el5_8.x86_64.rpm java-1.6.0-ibm-javacomm-1.6.0.11.0-1jpp.1.el5_8.i386.rpm java-1.6.0-ibm-javacomm-1.6.0.11.0-1jpp.1.el5_8.x86_64.rpm java-1.6.0-ibm-jdbc-1.6.0.11.0-1jpp.1.el5_8.i386.rpm java-1.6.0-ibm-jdbc-1.6.0.11.0-1jpp.1.el5_8.x86_64.rpm java-1.6.0-ibm-plugin-1.6.0.11.0-1jpp.1.el5_8.i386.rpm java-1.6.0-ibm-plugin-1.6.0.11.0-1jpp.1.el5_8.x86_64.rpm java-1.6.0-ibm-src-1.6.0.11.0-1jpp.1.el5_8.i386.rpm java-1.6.0-ibm-src-1.6.0.11.0-1jpp.1.el5_8.x86_64.rpm Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: java-1.6.0-ibm-1.6.0.11.0-1jpp.1.el6_3.i686.rpm java-1.6.0-ibm-demo-1.6.0.11.0-1jpp.1.el6_3.i686.rpm java-1.6.0-ibm-devel-1.6.0.11.0-1jpp.1.el6_3.i686.rpm java-1.6.0-ibm-javacomm-1.6.0.11.0-1jpp.1.el6_3.i686.rpm java-1.6.0-ibm-jdbc-1.6.0.11.0-1jpp.1.el6_3.i686.rpm java-1.6.0-ibm-plugin-1.6.0.11.0-1jpp.1.el6_3.i686.rpm java-1.6.0-ibm-src-1.6.0.11.0-1jpp.1.el6_3.i686.rpm x86_64: java-1.6.0-ibm-1.6.0.11.0-1jpp.1.el6_3.x86_64.rpm java-1.6.0-ibm-demo-1.6.0.11.0-1jpp.1.el6_3.x86_64.rpm java-1.6.0-ibm-devel-1.6.0.11.0-1jpp.1.el6_3.i686.rpm java-1.6.0-ibm-devel-1.6.0.11.0-1jpp.1.el6_3.x86_64.rpm java-1.6.0-ibm-javacomm-1.6.0.11.0-1jpp.1.el6_3.x86_64.rpm java-1.6.0-ibm-jdbc-1.6.0.11.0-1jpp.1.el6_3.x86_64.rpm java-1.6.0-ibm-plugin-1.6.0.11.0-1jpp.1.el6_3.x86_64.rpm java-1.6.0-ibm-src-1.6.0.11.0-1jpp.1.el6_3.x86_64.rpm Red Hat Enterprise Linux HPC Node Supplementary (v. 6): x86_64: java-1.6.0-ibm-1.6.0.11.0-1jpp.1.el6_3.x86_64.rpm java-1.6.0-ibm-demo-1.6.0.11.0-1jpp.1.el6_3.x86_64.rpm java-1.6.0-ibm-devel-1.6.0.11.0-1jpp.1.el6_3.i686.rpm java-1.6.0-ibm-devel-1.6.0.11.0-1jpp.1.el6_3.x86_64.rpm java-1.6.0-ibm-javacomm-1.6.0.11.0-1jpp.1.el6_3.x86_64.rpm java-1.6.0-ibm-src-1.6.0.11.0-1jpp.1.el6_3.x86_64.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: java-1.6.0-ibm-1.6.0.11.0-1jpp.1.el6_3.i686.rpm java-1.6.0-ibm-demo-1.6.0.11.0-1jpp.1.el6_3.i686.rpm java-1.6.0-ibm-devel-1.6.0.11.0-1jpp.1.el6_3.i686.rpm java-1.6.0-ibm-javacomm-1.6.0.11.0-1jpp.1.el6_3.i686.rpm java-1.6.0-ibm-jdbc-1.6.0.11.0-1jpp.1.el6_3.i686.rpm java-1.6.0-ibm-plugin-1.6.0.11.0-1jpp.1.el6_3.i686.rpm java-1.6.0-ibm-src-1.6.0.11.0-1jpp.1.el6_3.i686.rpm ppc64: java-1.6.0-ibm-1.6.0.11.0-1jpp.1.el6_3.ppc64.rpm java-1.6.0-ibm-demo-1.6.0.11.0-1jpp.1.el6_3.ppc64.rpm java-1.6.0-ibm-devel-1.6.0.11.0-1jpp.1.el6_3.ppc.rpm java-1.6.0-ibm-devel-1.6.0.11.0-1jpp.1.el6_3.ppc64.rpm java-1.6.0-ibm-javacomm-1.6.0.11.0-1jpp.1.el6_3.ppc64.rpm java-1.6.0-ibm-jdbc-1.6.0.11.0-1jpp.1.el6_3.ppc64.rpm java-1.6.0-ibm-src-1.6.0.11.0-1jpp.1.el6_3.ppc64.rpm s390x: java-1.6.0-ibm-1.6.0.11.0-1jpp.1.el6_3.s390x.rpm java-1.6.0-ibm-demo-1.6.0.11.0-1jpp.1.el6_3.s390x.rpm java-1.6.0-ibm-devel-1.6.0.11.0-1jpp.1.el6_3.s390.rpm java-1.6.0-ibm-devel-1.6.0.11.0-1jpp.1.el6_3.s390x.rpm java-1.6.0-ibm-jdbc-1.6.0.11.0-1jpp.1.el6_3.s390x.rpm java-1.6.0-ibm-src-1.6.0.11.0-1jpp.1.el6_3.s390x.rpm x86_64: java-1.6.0-ibm-1.6.0.11.0-1jpp.1.el6_3.x86_64.rpm java-1.6.0-ibm-demo-1.6.0.11.0-1jpp.1.el6_3.x86_64.rpm java-1.6.0-ibm-devel-1.6.0.11.0-1jpp.1.el6_3.i686.rpm java-1.6.0-ibm-devel-1.6.0.11.0-1jpp.1.el6_3.x86_64.rpm java-1.6.0-ibm-javacomm-1.6.0.11.0-1jpp.1.el6_3.x86_64.rpm java-1.6.0-ibm-jdbc-1.6.0.11.0-1jpp.1.el6_3.x86_64.rpm java-1.6.0-ibm-plugin-1.6.0.11.0-1jpp.1.el6_3.x86_64.rpm java-1.6.0-ibm-src-1.6.0.11.0-1jpp.1.el6_3.x86_64.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: java-1.6.0-ibm-1.6.0.11.0-1jpp.1.el6_3.i686.rpm java-1.6.0-ibm-demo-1.6.0.11.0-1jpp.1.el6_3.i686.rpm java-1.6.0-ibm-devel-1.6.0.11.0-1jpp.1.el6_3.i686.rpm java-1.6.0-ibm-javacomm-1.6.0.11.0-1jpp.1.el6_3.i686.rpm java-1.6.0-ibm-jdbc-1.6.0.11.0-1jpp.1.el6_3.i686.rpm java-1.6.0-ibm-plugin-1.6.0.11.0-1jpp.1.el6_3.i686.rpm java-1.6.0-ibm-src-1.6.0.11.0-1jpp.1.el6_3.i686.rpm x86_64: java-1.6.0-ibm-1.6.0.11.0-1jpp.1.el6_3.x86_64.rpm java-1.6.0-ibm-demo-1.6.0.11.0-1jpp.1.el6_3.x86_64.rpm java-1.6.0-ibm-devel-1.6.0.11.0-1jpp.1.el6_3.i686.rpm java-1.6.0-ibm-devel-1.6.0.11.0-1jpp.1.el6_3.x86_64.rpm java-1.6.0-ibm-javacomm-1.6.0.11.0-1jpp.1.el6_3.x86_64.rpm java-1.6.0-ibm-jdbc-1.6.0.11.0-1jpp.1.el6_3.x86_64.rpm java-1.6.0-ibm-plugin-1.6.0.11.0-1jpp.1.el6_3.x86_64.rpm java-1.6.0-ibm-src-1.6.0.11.0-1jpp.1.el6_3.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://www.redhat.com/security/data/cve/CVE-2012-0551.html https://www.redhat.com/security/data/cve/CVE-2012-1713.html https://www.redhat.com/security/data/cve/CVE-2012-1716.html https://www.redhat.com/security/data/cve/CVE-2012-1717.html https://www.redhat.com/security/data/cve/CVE-2012-1718.html https://www.redhat.com/security/data/cve/CVE-2012-1719.html https://www.redhat.com/security/data/cve/CVE-2012-1721.html https://www.redhat.com/security/data/cve/CVE-2012-1722.html https://www.redhat.com/security/data/cve/CVE-2012-1725.html https://access.redhat.com/security/updates/classification/#critical https://www.ibm.com/developerworks/java/jdk/alerts/ 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2012 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFQSMw4XlSAg2UNWIIRAshKAJ49SpnZkzi3qYDcliO3TJKzvAplQACgrwFW 2JWskMzQ+QkQ0agc+HQAbwo= =LO3L -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . ---------------------------------------------------------------------- Become a PSI 3.0 beta tester! Test-drive the new beta version and tell us what you think about its extended automatic update function and significantly enhanced user-interface. Download it here! http://secunia.com/psi_30_beta_launch ---------------------------------------------------------------------- TITLE: Oracle GlassFish Enterprise Server Cross-Site Scripting and Request Forgery SECUNIA ADVISORY ID: SA48798 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/48798/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=48798 RELEASE DATE: 2012-04-18 DISCUSS ADVISORY: http://secunia.com/advisories/48798/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/48798/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=48798 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: Security-Assessment.com has reported some vulnerabilities in Oracle GlassFish Enterprise Server, which can be exploited by malicious people to conduct cross-site scripting and request forgery attacks. 1) The application allows users to perform certain actions via HTTP requests without performing proper validity checks to verify the requests. This can be exploited to e.g. uploading an arbitrary WAR archive by tricking a logged-in administrator into visiting a specially crafted web page. 2) Input passed via multiple parameters to various scripts is not properly sanitised before being returned to the user. The vulnerabilities are reported in version 3.1.1 (build 12). SOLUTION: Apply patch (please see the vendor's advisory for details). PROVIDED AND/OR DISCOVERED BY: Roberto Suggi Liverani, Security-Assessment.com. ORIGINAL ADVISORY: Oracle: https://blogs.oracle.com/security/entry/april_2012_critical_patch_update http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html#AppendixSUNS Security-Assessment.com: http://www.security-assessment.com/files/documents/advisory/Oracle_GlassFish_Server_REST_CSRF.pdf http://www.security-assessment.com/files/documents/advisory/Oracle_GlassFish_Server_Multiple_XSS.pdf OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . In a typical operating environment, these are of low security risk as the runtime is not used on untrusted applets. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20566.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c03441075 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03441075 Version: 1 HPSBUX02805 SSRT100919 rev.1 - HP-UX Running Java, Remote Unauthorized Access, Disclosure of Information, and Other Vulnerabilities NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release Date: 2012-08-13 Last Updated: 2012-08-13 - ----------------------------------------------------------------------------- Potential Security Impact: Remote unauthorized access, disclosure of information, and other vulnerabilities Source: Hewlett-Packard Company, HP Software Security Response Team VULNERABILITY SUMMARY Potential security vulnerabilities have been identified in Java Runtime Environment (JRE) and Java Developer Kit (JDK) running on HP-UX. These vulnerabilities could allow remote unauthorized access, disclosure of information, and other vulnerabilities. References: CVE-2012-0508, CVE-2012-0551, CVE-2012-1711, CVE-2012-1713, CVE-2012-1716, CVE-2012-1718, CVE-2012-1719, CVE-2012-1720, CVE-2012-1721, CVE-2012-1722, CVE-2012-1723, CVE-2012-1724, CVE-2012-1725, CVE-2012-1726 SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. HP-UX B.11.11, B.11.23, and B.11.31 running HP JDK and JRE 7.0.02 and 6.0.15 BACKGROUND CVSS 2.0 Base Metrics =========================================================== Reference Base Vector Base Score CVE-2012-0508 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2012-0551 (AV:N/AC:M/Au:N/C:P/I:P/A:N) 5.8 CVE-2012-1711 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5 CVE-2012-1713 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2012-1716 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2012-1718 (AV:N/AC:L/Au:N/C:N/I:N/A:P) 5.0 CVE-2012-1719 (AV:N/AC:L/Au:N/C:N/I:P/A:N) 5.0 CVE-2012-1720 (AV:L/AC:H/Au:N/C:P/I:P/A:P) 3.7 CVE-2012-1721 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2012-1722 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2012-1723 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2012-1724 (AV:N/AC:L/Au:N/C:N/I:N/A:P) 5.0 CVE-2012-1725 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2012-1726 (AV:N/AC:L/Au:N/C:P/I:P/A:N) 6.4 =========================================================== Information on CVSS is documented in HP Customer Notice: HPSN-2008-002 RESOLUTION HP has provided the following Java version upgrade to resolve these vulnerabilities. The upgrade is available from the following location http://www.hp.com/go/java HP-UX B.11.23, B.11.31 / JDK and JRE v7.0.02 or subsequent HP-UX B.11.23, B.11.31 / JDK and JRE v6.0.15 or subsequent HP-UX B.11.11, B.11.23 / JDK and JRE v6.0.15 or subsequent MANUAL ACTIONS: Yes - Update For Java v7.0 update to Java v7.0.02 or subsequent For Java v6.0 update to Java v6.0.15 or subsequent PRODUCT SPECIFIC INFORMATION HP-UX Software Assistant: HP-UX Software Assistant is an enhanced application that replaces HP-UX Security Patch Check. It analyzes all Security Bulletins issued by HP and lists recommended actions that may apply to a specific HP-UX system. It can also download patches and create a depot automatically. For more information see https://www.hp.com/go/swa The following text is for use by the HP-UX Software Assistant. AFFECTED VERSIONS HP-UX B.11.23 HP-UX B.11.31 =========== Jdk70.JDK70-COM Jdk70.JDK70-DEMO Jdk70.JDK70-IPF32 Jdk70.JDK70-IPF64 Jre70.JRE70-COM Jre70.JRE70-IPF32 Jre70.JRE70-IPF32-HS Jre70.JRE70-IPF64 Jre70.JRE70-IPF64-HS action: install revision 1.7.0.02.00 or subsequent HP-UX B.11.23 HP-UX B.11.31 =========== Jdk60.JDK60-COM Jdk60.JDK60-DEMO Jdk60.JDK60-IPF32 Jdk60.JDK60-IPF64 Jre60.JRE60-COM Jre60.JRE60-IPF32 Jre60.JRE60-IPF32-HS Jre60.JRE60-IPF64 Jre60.JRE60-IPF64-HS action: install revision 1.6.0.15.00 or subsequent HP-UX B.11.11 HP-UX B.11.23 =========== Jdk60.JDK60-COM Jdk60.JDK60-DEMO Jdk60.JDK60-PA20 Jdk60.JDK60-PA20W Jre60.JRE60-COM Jre60.JRE60-COM-DOC Jre60.JRE60-PA20 Jre60.JRE60-PA20-HS Jre60.JRE60-PA20W Jre60.JRE60-PA20W-HS action: install revision 1.6.0.15.00 or subsequent END AFFECTED VERSIONS HISTORY Version:1 (rev.1) - 13 August 2012 Initial release Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HP Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hp.com. Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com Subscribe: To initiate a subscription to receive future HP Security Bulletin alerts via Email: http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins Security Bulletin List: A list of HP Security Bulletins, updated periodically, is contained in HP Security Notice HPSN-2011-001: https://h20566.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c02964430 Security Bulletin Archive: A list of recently released Security Bulletins is available here: http://h20566.www2.hp.com/portal/site/hpsc/public/kb/secBullArchive/ Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB. 3C = 3COM 3P = 3rd Party Software GN = HP General Software HF = HP Hardware and Firmware MP = MPE/iX MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PI = Printing and Imaging PV = ProCurve ST = Storage Software TU = Tru64 UNIX UX = HP-UX Copyright 2012 Hewlett-Packard Development Company, L.P. Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits;damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

lack of information

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Oracle

SOURCES

LAST UPDATE DATE

2024-11-21T19:56:29.741000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE