ID

VAR-201302-0404

CVE

CVE-2013-1487

TITLE

Oracle Java SE of Java Runtime Environment In Deployment Processing vulnerability

DESCRIPTION

Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE 7 Update 13 and earlier and 6 Update 39 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. (DoS) An attack may be carried out. The vulnerability can be exploited over multiple protocols. This issue affects the 'Deployment' sub-component. This vulnerability affects the following supported versions: 7 Update 13 and prior 6 Update 39 and prior. ============================================================================ Ubuntu Security Notice USN-1735-1 February 21, 2013 openjdk-6, openjdk-7 vulnerabilities ============================================================================ A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 12.10 - Ubuntu 12.04 LTS - Ubuntu 11.10 - Ubuntu 10.04 LTS Summary: Several security issues were fixed in OpenJDK. Software Description: - openjdk-7: Open Source Java implementation - openjdk-6: Open Source Java implementation Details: Nadhem Alfardan and Kenny Paterson discovered that the TLS protocol as used in OpenSSL was vulnerable to a timing side-channel attack known as the "Lucky Thirteen" issue. A remote attacker could use this issue to perform plaintext-recovery attacks via analysis of timing data. (CVE-2013-0169) A vulnerability was discovered in the OpenJDK JRE related to information disclosure and data integrity. An attacker could exploit this to cause a denial of service. This issue only affected Ubuntu 12.10. (CVE-2013-1484) A data integrity vulnerability was discovered in the OpenJDK JRE. This issue only affected Ubuntu 12.10. (CVE-2013-1485) Two vulnerabilities were discovered in the OpenJDK JRE related to information disclosure and data integrity. An attacker could exploit these to cause a denial of service. (CVE-2013-1486, CVE-2013-1487) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 12.10: icedtea-7-jre-cacao 7u15-2.3.7-0ubuntu1~12.10 icedtea-7-jre-jamvm 7u15-2.3.7-0ubuntu1~12.10 openjdk-7-jre 7u15-2.3.7-0ubuntu1~12.10 openjdk-7-jre-headless 7u15-2.3.7-0ubuntu1~12.10 openjdk-7-jre-lib 7u15-2.3.7-0ubuntu1~12.10 openjdk-7-jre-zero 7u15-2.3.7-0ubuntu1~12.10 Ubuntu 12.04 LTS: icedtea-6-jre-cacao 6b27-1.12.3-0ubuntu1~12.04 icedtea-6-jre-jamvm 6b27-1.12.3-0ubuntu1~12.04 openjdk-6-jre 6b27-1.12.3-0ubuntu1~12.04 openjdk-6-jre-headless 6b27-1.12.3-0ubuntu1~12.04 openjdk-6-jre-lib 6b27-1.12.3-0ubuntu1~12.04 openjdk-6-jre-zero 6b27-1.12.3-0ubuntu1~12.04 Ubuntu 11.10: icedtea-6-jre-cacao 6b27-1.12.3-0ubuntu1~11.10 icedtea-6-jre-jamvm 6b27-1.12.3-0ubuntu1~11.10 openjdk-6-jre 6b27-1.12.3-0ubuntu1~11.10 openjdk-6-jre-headless 6b27-1.12.3-0ubuntu1~11.10 openjdk-6-jre-lib 6b27-1.12.3-0ubuntu1~11.10 openjdk-6-jre-zero 6b27-1.12.3-0ubuntu1~11.10 Ubuntu 10.04 LTS: icedtea-6-jre-cacao 6b27-1.12.3-0ubuntu1~10.04 openjdk-6-jre 6b27-1.12.3-0ubuntu1~10.04 openjdk-6-jre-headless 6b27-1.12.3-0ubuntu1~10.04 openjdk-6-jre-lib 6b27-1.12.3-0ubuntu1~10.04 openjdk-6-jre-zero 6b27-1.12.3-0ubuntu1~10.04 This update uses a new upstream release which includes additional bug fixes. After a standard system update you need to restart any Java applications or applets to make all the necessary changes. In a typical operating environment, these are of low security risk as the runtime is not used on untrusted applets. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2013:014 http://www.mandriva.com/security/ _______________________________________________________________________ Package : java-1.6.0-openjdk Date : February 22, 2013 Affected: 2011., Enterprise Server 5.0 _______________________________________________________________________ Problem Description: Multiple security issues were identified and fixed in OpenJDK (icedtea6): * S8006446: Restrict MBeanServer access * S8006777: Improve TLS handling of invalid messages * S8007688: Blacklist known bad certificate * S7123519: problems with certification path * S8007393: Possible race condition after JDK-6664509 * S8007611: logging behavior in applet changed The updated packages provides icedtea6-1.11.8 which is not vulnerable to these issues. The verification of md5 checksums and GPG signatures is performed automatically for you. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iD8DBQFRJ3F2mqjQ0CJFipgRAve3AKD19brDHUrIafN4QXGupxztDvVEgACggeN8 1+i8uSMYhYal8D4zQ/aF88s= =x4rn -----END PGP SIGNATURE----- . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: java-1.6.0-sun security update Advisory ID: RHSA-2013:0531-01 Product: Red Hat Enterprise Linux Extras Advisory URL: https://rhn.redhat.com/errata/RHSA-2013-0531.html Issue date: 2013-02-20 CVE Names: CVE-2013-0169 CVE-2013-1486 CVE-2013-1487 ===================================================================== 1. Summary: Updated java-1.6.0-sun packages that fix three security issues are now available for Red Hat Enterprise Linux 5 and 6 Supplementary. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux HPC Node Supplementary (v. 6) - x86_64 Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. Further information about these flaws can be found on the Oracle Java SE Critical Patch Update Advisory page, listed in the References section. (CVE-2013-0169, CVE-2013-1486, CVE-2013-1487) All users of java-1.6.0-sun are advised to upgrade to these updated packages, which provide Oracle Java 6 Update 41. All running instances of Oracle Java must be restarted for the update to take effect. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258 5. Bugs fixed (http://bugzilla.redhat.com/): 907589 - CVE-2013-0169 SSL/TLS: CBC padding timing attack (lucky-13) 913014 - CVE-2013-1486 OpenJDK: MBeanServer insufficient privilege restrictions (JMX, 8006446) 913030 - CVE-2013-1487 Oracle JDK: unspecified vulnerability fixed in 6u41 and 7u15 (Deployment) 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 5): i386: java-1.6.0-sun-1.6.0.41-1jpp.1.el5_9.i586.rpm java-1.6.0-sun-demo-1.6.0.41-1jpp.1.el5_9.i586.rpm java-1.6.0-sun-devel-1.6.0.41-1jpp.1.el5_9.i586.rpm java-1.6.0-sun-jdbc-1.6.0.41-1jpp.1.el5_9.i586.rpm java-1.6.0-sun-plugin-1.6.0.41-1jpp.1.el5_9.i586.rpm java-1.6.0-sun-src-1.6.0.41-1jpp.1.el5_9.i586.rpm x86_64: java-1.6.0-sun-1.6.0.41-1jpp.1.el5_9.i586.rpm java-1.6.0-sun-1.6.0.41-1jpp.1.el5_9.x86_64.rpm java-1.6.0-sun-demo-1.6.0.41-1jpp.1.el5_9.i586.rpm java-1.6.0-sun-demo-1.6.0.41-1jpp.1.el5_9.x86_64.rpm java-1.6.0-sun-devel-1.6.0.41-1jpp.1.el5_9.i586.rpm java-1.6.0-sun-devel-1.6.0.41-1jpp.1.el5_9.x86_64.rpm java-1.6.0-sun-jdbc-1.6.0.41-1jpp.1.el5_9.i586.rpm java-1.6.0-sun-jdbc-1.6.0.41-1jpp.1.el5_9.x86_64.rpm java-1.6.0-sun-plugin-1.6.0.41-1jpp.1.el5_9.i586.rpm java-1.6.0-sun-plugin-1.6.0.41-1jpp.1.el5_9.x86_64.rpm java-1.6.0-sun-src-1.6.0.41-1jpp.1.el5_9.i586.rpm java-1.6.0-sun-src-1.6.0.41-1jpp.1.el5_9.x86_64.rpm Red Hat Enterprise Linux Server Supplementary (v. 5): i386: java-1.6.0-sun-1.6.0.41-1jpp.1.el5_9.i586.rpm java-1.6.0-sun-demo-1.6.0.41-1jpp.1.el5_9.i586.rpm java-1.6.0-sun-devel-1.6.0.41-1jpp.1.el5_9.i586.rpm java-1.6.0-sun-jdbc-1.6.0.41-1jpp.1.el5_9.i586.rpm java-1.6.0-sun-plugin-1.6.0.41-1jpp.1.el5_9.i586.rpm java-1.6.0-sun-src-1.6.0.41-1jpp.1.el5_9.i586.rpm x86_64: java-1.6.0-sun-1.6.0.41-1jpp.1.el5_9.i586.rpm java-1.6.0-sun-1.6.0.41-1jpp.1.el5_9.x86_64.rpm java-1.6.0-sun-demo-1.6.0.41-1jpp.1.el5_9.i586.rpm java-1.6.0-sun-demo-1.6.0.41-1jpp.1.el5_9.x86_64.rpm java-1.6.0-sun-devel-1.6.0.41-1jpp.1.el5_9.i586.rpm java-1.6.0-sun-devel-1.6.0.41-1jpp.1.el5_9.x86_64.rpm java-1.6.0-sun-jdbc-1.6.0.41-1jpp.1.el5_9.i586.rpm java-1.6.0-sun-jdbc-1.6.0.41-1jpp.1.el5_9.x86_64.rpm java-1.6.0-sun-plugin-1.6.0.41-1jpp.1.el5_9.i586.rpm java-1.6.0-sun-plugin-1.6.0.41-1jpp.1.el5_9.x86_64.rpm java-1.6.0-sun-src-1.6.0.41-1jpp.1.el5_9.i586.rpm java-1.6.0-sun-src-1.6.0.41-1jpp.1.el5_9.x86_64.rpm Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: java-1.6.0-sun-1.6.0.41-1jpp.1.el6_3.i686.rpm java-1.6.0-sun-demo-1.6.0.41-1jpp.1.el6_3.i686.rpm java-1.6.0-sun-devel-1.6.0.41-1jpp.1.el6_3.i686.rpm java-1.6.0-sun-jdbc-1.6.0.41-1jpp.1.el6_3.i686.rpm java-1.6.0-sun-plugin-1.6.0.41-1jpp.1.el6_3.i686.rpm java-1.6.0-sun-src-1.6.0.41-1jpp.1.el6_3.i686.rpm x86_64: java-1.6.0-sun-1.6.0.41-1jpp.1.el6_3.i686.rpm java-1.6.0-sun-1.6.0.41-1jpp.1.el6_3.x86_64.rpm java-1.6.0-sun-demo-1.6.0.41-1jpp.1.el6_3.x86_64.rpm java-1.6.0-sun-devel-1.6.0.41-1jpp.1.el6_3.i686.rpm java-1.6.0-sun-devel-1.6.0.41-1jpp.1.el6_3.x86_64.rpm java-1.6.0-sun-jdbc-1.6.0.41-1jpp.1.el6_3.x86_64.rpm java-1.6.0-sun-plugin-1.6.0.41-1jpp.1.el6_3.x86_64.rpm java-1.6.0-sun-src-1.6.0.41-1jpp.1.el6_3.x86_64.rpm Red Hat Enterprise Linux HPC Node Supplementary (v. 6): x86_64: java-1.6.0-sun-1.6.0.41-1jpp.1.el6_3.i686.rpm java-1.6.0-sun-1.6.0.41-1jpp.1.el6_3.x86_64.rpm java-1.6.0-sun-demo-1.6.0.41-1jpp.1.el6_3.x86_64.rpm java-1.6.0-sun-devel-1.6.0.41-1jpp.1.el6_3.i686.rpm java-1.6.0-sun-devel-1.6.0.41-1jpp.1.el6_3.x86_64.rpm java-1.6.0-sun-src-1.6.0.41-1jpp.1.el6_3.x86_64.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: java-1.6.0-sun-1.6.0.41-1jpp.1.el6_3.i686.rpm java-1.6.0-sun-demo-1.6.0.41-1jpp.1.el6_3.i686.rpm java-1.6.0-sun-devel-1.6.0.41-1jpp.1.el6_3.i686.rpm java-1.6.0-sun-jdbc-1.6.0.41-1jpp.1.el6_3.i686.rpm java-1.6.0-sun-plugin-1.6.0.41-1jpp.1.el6_3.i686.rpm java-1.6.0-sun-src-1.6.0.41-1jpp.1.el6_3.i686.rpm x86_64: java-1.6.0-sun-1.6.0.41-1jpp.1.el6_3.i686.rpm java-1.6.0-sun-1.6.0.41-1jpp.1.el6_3.x86_64.rpm java-1.6.0-sun-demo-1.6.0.41-1jpp.1.el6_3.x86_64.rpm java-1.6.0-sun-devel-1.6.0.41-1jpp.1.el6_3.i686.rpm java-1.6.0-sun-devel-1.6.0.41-1jpp.1.el6_3.x86_64.rpm java-1.6.0-sun-jdbc-1.6.0.41-1jpp.1.el6_3.x86_64.rpm java-1.6.0-sun-plugin-1.6.0.41-1jpp.1.el6_3.x86_64.rpm java-1.6.0-sun-src-1.6.0.41-1jpp.1.el6_3.x86_64.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: java-1.6.0-sun-1.6.0.41-1jpp.1.el6_3.i686.rpm java-1.6.0-sun-demo-1.6.0.41-1jpp.1.el6_3.i686.rpm java-1.6.0-sun-devel-1.6.0.41-1jpp.1.el6_3.i686.rpm java-1.6.0-sun-jdbc-1.6.0.41-1jpp.1.el6_3.i686.rpm java-1.6.0-sun-plugin-1.6.0.41-1jpp.1.el6_3.i686.rpm java-1.6.0-sun-src-1.6.0.41-1jpp.1.el6_3.i686.rpm x86_64: java-1.6.0-sun-1.6.0.41-1jpp.1.el6_3.i686.rpm java-1.6.0-sun-1.6.0.41-1jpp.1.el6_3.x86_64.rpm java-1.6.0-sun-demo-1.6.0.41-1jpp.1.el6_3.x86_64.rpm java-1.6.0-sun-devel-1.6.0.41-1jpp.1.el6_3.i686.rpm java-1.6.0-sun-devel-1.6.0.41-1jpp.1.el6_3.x86_64.rpm java-1.6.0-sun-jdbc-1.6.0.41-1jpp.1.el6_3.x86_64.rpm java-1.6.0-sun-plugin-1.6.0.41-1jpp.1.el6_3.x86_64.rpm java-1.6.0-sun-src-1.6.0.41-1jpp.1.el6_3.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://www.redhat.com/security/data/cve/CVE-2013-0169.html https://www.redhat.com/security/data/cve/CVE-2013-1486.html https://www.redhat.com/security/data/cve/CVE-2013-1487.html https://access.redhat.com/security/updates/classification/#critical http://www.oracle.com/technetwork/topics/security/javacpufeb2013update-1905892.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2013 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFRJUSJXlSAg2UNWIIRAqZqAJ9hvATJWqwSeMoSsrxGmt92LQwBIQCgtob6 /WIXayD/MZRyZEm2ZDUESrc= =2/wy -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

Unknown

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES