- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200911-02 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Sun JDK/JRE: Multiple vulnerabilites Date: November 17, 2009 Bugs: #182824, #231337, #250012, #263810, #280409, #291817 ID: 200911-02 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilites in the Sun JDK and JRE allow for several attacks, including the remote execution of arbitrary code. Background ========== The Sun Java Development Kit (JDK) and the Sun Java Runtime Environment (JRE) provide the Sun Java platform. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 sun-jre-bin < 1.6.0.17 *>= 1.5.0.22 >= 1.6.0.17 2 sun-jdk < 1.6.0.17 *>= 1.5.0.22 >= 1.6.0.17 3 blackdown-jre <= 1.4.2.03-r14 Vulnerable! 4 blackdown-jdk <= 1.4.2.03-r16 Vulnerable! 5 emul-linux-x86-java < 1.6.0.17 *>= 1.5.0.22 >= 1.6.0.17 ------------------------------------------------------------------- NOTE: Certain packages are still vulnerable. Users should migrate to another package if one is available or wait for the existing packages to be marked stable by their architecture maintainers. ------------------------------------------------------------------- 5 affected packages on all of their supported architectures. ------------------------------------------------------------------- Description =========== Multiple vulnerabilites have been reported in the Sun Java implementation. Please review the CVE identifiers referenced below and the associated Sun Alerts for details. Impact ====== A remote attacker could entice a user to open a specially crafted JAR archive, applet, or Java Web Start application, possibly resulting in the execution of arbitrary code with the privileges of the user running the application. Furthermore, a remote attacker could cause a Denial of Service affecting multiple services via several vectors, disclose information and memory contents, write or execute local files, conduct session hijacking attacks via GIFAR files, steal cookies, bypass the same-origin policy, load untrusted JAR files, establish network connections to arbitrary hosts and posts via several vectors, modify the list of supported graphics configurations, bypass HMAC-based authentication systems, escalate privileges via several vectors and cause applet code to be executed with older, possibly vulnerable versions of the JRE. NOTE: Some vulnerabilities require a trusted environment, user interaction, a DNS Man-in-the-Middle or Cross-Site-Scripting attack. Workaround ========== There is no known workaround at this time. Resolution ========== All Sun JRE 1.5.x users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose =dev-java/sun-jre-bin-1.5.0.22 All Sun JRE 1.6.x users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose =dev-java/sun-jre-bin-1.6.0.17 All Sun JDK 1.5.x users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose =dev-java/sun-jdk-1.5.0.22 All Sun JDK 1.6.x users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose =dev-java/sun-jdk-1.6.0.17 All users of the precompiled 32bit Sun JRE 1.5.x should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose =app-emulation/emul-linux-x86-java-1.5.0.22 All users of the precompiled 32bit Sun JRE 1.6.x should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose =app-emulation/emul-linux-x86-java-1.6.0.17 All Sun JRE 1.4.x, Sun JDK 1.4.x, Blackdown JRE, Blackdown JDK and precompiled 32bit Sun JRE 1.4.x users are strongly advised to unmerge Java 1.4: # emerge --unmerge =app-emulation/emul-linux-x86-java-1.4* # emerge --unmerge =dev-java/sun-jre-bin-1.4* # emerge --unmerge =dev-java/sun-jdk-1.4* # emerge --unmerge dev-java/blackdown-jdk # emerge --unmerge dev-java/blackdown-jre Gentoo is ceasing support for the 1.4 generation of the Sun Java Platform in accordance with upstream. All 1.4 JRE and JDK versions are masked and will be removed shortly. References ========== [ 1 ] CVE-2008-2086 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2086 [ 2 ] CVE-2008-3103 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3103 [ 3 ] CVE-2008-3104 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3104 [ 4 ] CVE-2008-3105 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3105 [ 5 ] CVE-2008-3106 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3106 [ 6 ] CVE-2008-3107 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3107 [ 7 ] CVE-2008-3108 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3108 [ 8 ] CVE-2008-3109 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3109 [ 9 ] CVE-2008-3110 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3110 [ 10 ] CVE-2008-3111 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3111 [ 11 ] CVE-2008-3112 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3112 [ 12 ] CVE-2008-3113 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3113 [ 13 ] CVE-2008-3114 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3114 [ 14 ] CVE-2008-3115 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3115 [ 15 ] CVE-2008-5339 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5339 [ 16 ] CVE-2008-5340 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5340 [ 17 ] CVE-2008-5341 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5341 [ 18 ] CVE-2008-5342 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5342 [ 19 ] CVE-2008-5343 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5343 [ 20 ] CVE-2008-5344 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5344 [ 21 ] CVE-2008-5345 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5345 [ 22 ] CVE-2008-5346 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5346 [ 23 ] CVE-2008-5347 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5347 [ 24 ] CVE-2008-5348 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5348 [ 25 ] CVE-2008-5349 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5349 [ 26 ] CVE-2008-5350 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5350 [ 27 ] CVE-2008-5351 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5351 [ 28 ] CVE-2008-5352 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5352 [ 29 ] CVE-2008-5353 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5353 [ 30 ] CVE-2008-5354 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5354 [ 31 ] CVE-2008-5355 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5355 [ 32 ] CVE-2008-5356 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5356 [ 33 ] CVE-2008-5357 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5357 [ 34 ] CVE-2008-5358 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5358 [ 35 ] CVE-2008-5359 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5359 [ 36 ] CVE-2008-5360 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5360 [ 37 ] CVE-2009-1093 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1093 [ 38 ] CVE-2009-1094 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1094 [ 39 ] CVE-2009-1095 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1095 [ 40 ] CVE-2009-1096 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1096 [ 41 ] CVE-2009-1097 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1097 [ 42 ] CVE-2009-1098 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1098 [ 43 ] CVE-2009-1099 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1099 [ 44 ] CVE-2009-1100 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1100 [ 45 ] CVE-2009-1101 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1101 [ 46 ] CVE-2009-1102 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1102 [ 47 ] CVE-2009-1103 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1103 [ 48 ] CVE-2009-1104 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1104 [ 49 ] CVE-2009-1105 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1105 [ 50 ] CVE-2009-1106 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1106 [ 51 ] CVE-2009-1107 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1107 [ 52 ] CVE-2009-2409 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2409 [ 53 ] CVE-2009-2475 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2475 [ 54 ] CVE-2009-2476 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2476 [ 55 ] CVE-2009-2670 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2670 [ 56 ] CVE-2009-2671 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2671 [ 57 ] CVE-2009-2672 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2672 [ 58 ] CVE-2009-2673 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2673 [ 59 ] CVE-2009-2674 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2674 [ 60 ] CVE-2009-2675 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2675 [ 61 ] CVE-2009-2676 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2676 [ 62 ] CVE-2009-2689 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2689 [ 63 ] CVE-2009-2690 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2690 [ 64 ] CVE-2009-2716 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2716 [ 65 ] CVE-2009-2718 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2718 [ 66 ] CVE-2009-2719 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2719 [ 67 ] CVE-2009-2720 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2720 [ 68 ] CVE-2009-2721 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2721 [ 69 ] CVE-2009-2722 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2722 [ 70 ] CVE-2009-2723 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2723 [ 71 ] CVE-2009-2724 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2724 [ 72 ] CVE-2009-3728 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3728 [ 73 ] CVE-2009-3729 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3729 [ 74 ] CVE-2009-3865 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3865 [ 75 ] CVE-2009-3866 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3866 [ 76 ] CVE-2009-3867 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3867 [ 77 ] CVE-2009-3868 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3868 [ 78 ] CVE-2009-3869 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3869 [ 79 ] CVE-2009-3871 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3871 [ 80 ] CVE-2009-3872 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3872 [ 81 ] CVE-2009-3873 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3873 [ 82 ] CVE-2009-3874 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3874 [ 83 ] CVE-2009-3875 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3875 [ 84 ] CVE-2009-3876 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3876 [ 85 ] CVE-2009-3877 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3877 [ 86 ] CVE-2009-3879 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3879 [ 87 ] CVE-2009-3880 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3880 [ 88 ] CVE-2009-3881 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3881 [ 89 ] CVE-2009-3882 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3882 [ 90 ] CVE-2009-3883 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3883 [ 91 ] CVE-2009-3884 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3884 [ 92 ] CVE-2009-3886 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3886 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200911-02.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2009 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5