Vulnerability Assessment & Network Security Forums



If through a vulnerability assessment, a network security issue is detected for the vulnerability below, applying the appropriate security patches in a timely matter is very important.  If you have detected that your system has already been compromised, following CERT's Network Security recovery document will assist with recommended steps for system recovery.


Home >> Browse Vulnerability Assessment Database >> SuSE Local Security Checks >> SUSE-SA:2007:003: Sun Java


Vulnerability Assessment Details

SUSE-SA:2007:003: Sun Java

Vulnerability Assessment Summary
Check for the version of the Sun Java package

Detailed Explanation for this Vulnerability Assessment

The remote host is missing the patch for the advisory SUSE-SA:2007:003 (Sun Java).


The SUN Java packages have been upgraded to fix security problems.

SUN Java was upgraded on all affected distributions:

- The Java 1.3 version to 1.3.1_19 for SUSE Linux Enterprise Server 8.

- The Java 1.4 version (also known as Java 2) to 1.4.2_13 for SUSE
Linux Enterprise Desktop 1, SUSE Linux Enterprise Server 9, SUSE
Linux 9.3, 10.0, 10.1 and openSUSE 10.2.

- The Java 1.5 version (also known as Java 5) to 1.5.0_10 for SUSE
Linux 9.3, 10.0, 10.1 and openSUSE 10.2.

While Sun does not publish the vulnerabilities fixed for this specific
update, it published the bugs fixed previously, text snippets verbatim
from the Mitre CVE DB:

CVE-2006-6731:Multiple buffer overflows in Sun Java Development
Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 7 and
earlier, Java System Development Kit (SDK) and JRE 1.4.2_12 and
earlier 1.4.x versions, and SDK and JRE 1.3.1_18 and earlier
permit attackers to develop Java applets that read, write, or
execute local files, possibly related to (1) integer overflows in
the Java_sun_awt_image_ImagingLib_convolveBI, awt_parseRaster,
and awt_parseColorModel functions
(2) a stack overflow in
the Java_sun_awt_image_ImagingLib_lookupByteRaster function

and (3) improper handling of certain negative values in the
Java_sun_font_SunLayoutEngine_nativeLayout function.

CVE-2006-6736: Unspecified vulnerability in Sun Java Development Kit
(JDK) and Java Runtime Environment (JRE) 5.0 Update 6 and earlier,
Java System Development Kit (SDK) and JRE 1.4.2_12 and earlier 1.4.x
versions, and SDK and JRE 1.3.1_18 and earlier permits attackers to
attackers to use untrusted applets to 'access data in other applets,'
aka 'The second issue.'

CVE-2006-6737: Unspecified vulnerability in Sun Java Development Kit
(JDK) and Java Runtime Environment (JRE) 5.0 Update 5 and earlier,
Java System Development Kit (SDK) and JRE 1.4.2_10 and earlier 1.4.x
versions, and SDK and JRE 1.3.1_18 and earlier permits attackers to
use untrusted applets to 'access data in other applets,' aka 'The
first issue.'

CVE-2006-6745: Multiple unspecified vulnerabilities in Sun Java
Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update
7 and earlier, and Java System Development Kit (SDK) and JRE 1.4.2_12
and earlier 1.4.x versions, permit attackers to develop Java applets or
applications that are able to gain rights, related to serialization
in JRE.


Solution : http://www.suse.de/security/http://www.novell.com/linux/security/advisories/2007_03_java.html
Network Security Threat Level: High

Networks Security ID:

Vulnerability Assessment Copyright: This script is Copyright (C) 2007 Tenable Network Security

Cables, Connectors

DELL PowerEdge R720 Server 2x 2.20Ghz E5-2660 8C 64GB 2x NEW 800GB SSD Mid-Level
$1250.7
DELL PowerEdge R720 Server 2x 2.20Ghz E5-2660 8C 64GB 2x NEW 800GB SSD Mid-Level pictureDell PowerEdge R720 Server 2x 2.00Ghz E5-2650 8C 128GB 2x 600GB 10K SAS Economy
$1081.3
Dell PowerEdge R720 Server 2x 2.00Ghz E5-2650 8C 128GB 2x 600GB 10K SAS Economy picture500212706 INTEL CPU TRAY HOLDER. (50 Piece) 37.5mm x 37.5mm
$136.0
500212706 INTEL CPU TRAY HOLDER. (50 Piece) 37.5mm x 37.5mm pictureDELL POWEREDGE R630 10 BAY TWO E5-2620V4 2.1GHZ 768GB 3 X 300GB 15K 12G H730
$10549.0
DELL POWEREDGE R630 10 BAY TWO E5-2620V4 2.1GHZ 768GB 3 X 300GB 15K 12G H730 picture


Discussions

No Discussions have been posted on this vulnerability.