RHEL 5 / 6：Satellite Server 中的 IBM Java Runtime (RHSA-2013:1456)
critical Nessus 插件 ID 78976
语言：
简介
远程 Red Hat 主机缺少一个或多个安全更新。描述
更新后的 java-1.6.0-ibm 程序包修复了多个安全问题，现在可用于 Red Hat Network Satellite Server 5.5。Red Hat 安全响应团队将此更新评级为具有低危安全影响。可从“参考”部分中的 CVE 链接获取针对每个漏洞的通用漏洞评分系统 (CVSS) 基本分数，其给出了详细的严重性等级。
此更新修正 Red Hat Network Satellite Server 5.5 随附的 IBM Java Runtime Environment 中的多个安全漏洞。在典型的操作环境中，这些问题的安全风险较低，因为不受信任的小程序上不会使用运行时。
修复了 IBM Java 2 Runtime Environment 中的多个缺陷。
（CVE-2012-0547、CVE-2012-0551、CVE-2012-1531、CVE-2012-1532、CVE-2012-1533、CVE-2012-1541、CVE-2012-1682、CVE-2012-1713、CVE-2012-1716、CVE-2012-1717、CVE-2012-1718、CVE-2012-1719、CVE-2012-1721、CVE-2012-1722、CVE-2012-1725、CVE-2012-3143、CVE-2012-3159、CVE-2012-3213、CVE-2012-3216、CVE-2012-3342、CVE-2012-4820、CVE-2012-4822、CVE-2012-4823、CVE-2012-5068、CVE-2012-5069、CVE-2012-5071、CVE-2012-5072、CVE-2012-5073、CVE-2012-5075、CVE-2012-5079、CVE-2012-5081、CVE-2012-5083、CVE-2012-5084、CVE-2012-5089、CVE-2013-0169、CVE-2013-0351、CVE-2013-0401、CVE-2013-0409、CVE-2013-0419、CVE-2013-0423、CVE-2013-0424、CVE-2013-0425、CVE-2013-0426、CVE-2013-0427、CVE-2013-0428、CVE-2013-0432、CVE-2013-0433、CVE-2013-0434、CVE-2013-0435、CVE-2013-0438、CVE-2013-0440、CVE-2013-0441、CVE-2013-0442、CVE-2013-0443、CVE-2013-0445、CVE-2013-0446、CVE-2013-0450、CVE-2013-0809、CVE-2013-1473、CVE-2013-1476、CVE-2013-1478、CVE-2013-1480、CVE-2013-1481、CVE-2013-1486、CVE-2013-1487、CVE-2013-1491、CVE-2013-1493、CVE-2013-1500、CVE-2013-1537、CVE-2013-1540、CVE-2013-1557、CVE-2013-1563、CVE-2013-1569、CVE-2013-1571、CVE-2013-2383、CVE-2013-2384、CVE-2013-2394、CVE-2013-2407、CVE-2013-2412、CVE-2013-2417、CVE-2013-2418、CVE-2013-2419、CVE-2013-2420、CVE-2013-2422、CVE-2013-2424、CVE-2013-2429、CVE-2013-2430、CVE-2013-2432、CVE-2013-2433、CVE-2013-2435、CVE-2013-2437、CVE-2013-2440、CVE-2013-2442、CVE-2013-2443、CVE-2013-2444、CVE-2013-2446、CVE-2013-2447、CVE-2013-2448、CVE-2013-2450、CVE-2013-2451、CVE-2013-2452、CVE-2013-2453、CVE-2013-2454、CVE-2013-2455、CVE-2013-2456、CVE-2013-2457、CVE-2013-2459、CVE-2013-2463、CVE-2013-2464、CVE-2013-2465、CVE-2013-2466、CVE-2013-2468、CVE-2013-2469、CVE-2013-2470、CVE-2013-2471、CVE-2013-2472、CVE-2013-2473、CVE-2013-3743）
建议 Red Hat Network Satellite Server 5.5 的用户升级这些更新后的程序包，其中包含 IBM Java SE 6 SR14 版本。为使此更新生效，必须重新启动 Red Hat Network Satellite Server(“/usr/sbin/rhn-satellite restart”) 以及所有正在运行的 IBM Java 实例。
解决方案
更新受影响的 java-1.6.0-ibm 和/或 java-1.6.0-ibm-devel 程序包。另见
https://access.redhat.com/errata/RHSA-2013:1456
https://access.redhat.com/security/cve/cve-2012-1725
https://access.redhat.com/security/cve/cve-2012-1719
https://access.redhat.com/security/cve/cve-2012-1718
https://access.redhat.com/security/cve/cve-2012-1717
https://access.redhat.com/security/cve/cve-2012-1716
https://access.redhat.com/security/cve/cve-2012-1713
https://access.redhat.com/security/cve/cve-2012-1722
https://access.redhat.com/security/cve/cve-2012-0551
https://access.redhat.com/security/cve/cve-2012-1721
https://access.redhat.com/security/cve/cve-2012-0547
https://access.redhat.com/security/cve/cve-2013-2456
https://access.redhat.com/security/cve/cve-2013-2457
https://access.redhat.com/security/cve/cve-2013-2450
https://access.redhat.com/security/cve/cve-2013-2452
https://access.redhat.com/security/cve/cve-2013-2453
https://access.redhat.com/security/cve/cve-2013-2459
https://access.redhat.com/security/cve/cve-2013-2470
https://access.redhat.com/security/cve/cve-2013-2471
https://access.redhat.com/security/cve/cve-2013-2473
https://access.redhat.com/security/cve/cve-2013-2447
https://access.redhat.com/security/cve/cve-2013-2446
https://access.redhat.com/security/cve/cve-2013-2463
https://access.redhat.com/security/cve/cve-2013-2407
https://access.redhat.com/security/cve/cve-2013-1500
https://access.redhat.com/security/cve/cve-2013-2448
https://access.redhat.com/security/cve/cve-2013-2469
https://access.redhat.com/security/cve/cve-2013-2443
https://access.redhat.com/security/cve/cve-2013-2444
https://access.redhat.com/security/cve/cve-2013-2451
https://access.redhat.com/security/cve/cve-2013-2464
https://access.redhat.com/security/cve/cve-2013-2468
https://access.redhat.com/security/cve/cve-2013-2442
https://access.redhat.com/security/cve/cve-2013-2466
https://access.redhat.com/security/cve/cve-2013-2437
https://access.redhat.com/security/cve/cve-2013-3743
https://access.redhat.com/security/cve/cve-2012-1682
https://access.redhat.com/security/cve/cve-2012-5084
https://access.redhat.com/security/cve/cve-2012-5079
https://access.redhat.com/security/cve/cve-2012-5081
https://access.redhat.com/security/cve/cve-2012-5069
https://access.redhat.com/security/cve/cve-2012-5068
https://access.redhat.com/security/cve/cve-2012-3216
https://access.redhat.com/security/cve/cve-2012-5071
https://access.redhat.com/security/cve/cve-2012-5072
https://access.redhat.com/security/cve/cve-2012-5073
https://access.redhat.com/security/cve/cve-2012-5089
https://access.redhat.com/security/cve/cve-2012-5075
https://access.redhat.com/security/cve/cve-2012-3159
https://access.redhat.com/security/cve/cve-2012-3143
https://access.redhat.com/security/cve/cve-2012-1531
https://access.redhat.com/security/cve/cve-2012-1533
https://access.redhat.com/security/cve/cve-2012-1532
https://access.redhat.com/security/cve/cve-2012-5083
https://access.redhat.com/security/cve/cve-2012-4820
https://access.redhat.com/security/cve/cve-2012-4822
https://access.redhat.com/security/cve/cve-2012-4823
https://access.redhat.com/security/cve/cve-2013-1478
https://access.redhat.com/security/cve/cve-2013-0450
https://access.redhat.com/security/cve/cve-2013-1473
https://access.redhat.com/security/cve/cve-2013-1476
https://access.redhat.com/security/cve/cve-2012-1541
https://access.redhat.com/security/cve/cve-2013-0409
https://access.redhat.com/security/cve/cve-2013-1480
https://access.redhat.com/security/cve/cve-2013-1481
https://access.redhat.com/security/cve/cve-2013-0427
https://access.redhat.com/security/cve/cve-2013-0426
https://access.redhat.com/security/cve/cve-2013-0425
https://access.redhat.com/security/cve/cve-2013-0424
https://access.redhat.com/security/cve/cve-2013-0423
https://access.redhat.com/security/cve/cve-2012-3213
https://access.redhat.com/security/cve/cve-2013-0419
https://access.redhat.com/security/cve/cve-2013-0445
https://access.redhat.com/security/cve/cve-2013-0446
https://access.redhat.com/security/cve/cve-2013-0441
https://access.redhat.com/security/cve/cve-2013-0440
https://access.redhat.com/security/cve/cve-2013-0443
https://access.redhat.com/security/cve/cve-2013-0442
https://access.redhat.com/security/cve/cve-2013-0351
https://access.redhat.com/security/cve/cve-2012-3342
https://access.redhat.com/security/cve/cve-2013-0432
https://access.redhat.com/security/cve/cve-2013-0433
https://access.redhat.com/security/cve/cve-2013-0434
https://access.redhat.com/security/cve/cve-2013-0435
https://access.redhat.com/security/cve/cve-2013-0438
https://access.redhat.com/security/cve/cve-2013-0428
https://access.redhat.com/security/cve/cve-2013-0169
https://access.redhat.com/security/cve/cve-2013-1486
https://access.redhat.com/security/cve/cve-2013-1487
https://access.redhat.com/security/cve/cve-2013-1493
https://access.redhat.com/security/cve/cve-2013-0809
https://access.redhat.com/security/cve/cve-2013-2418
https://access.redhat.com/security/cve/cve-2013-2394
https://access.redhat.com/security/cve/cve-2013-2432
https://access.redhat.com/security/cve/cve-2013-2433
https://access.redhat.com/security/cve/cve-2013-2435
https://access.redhat.com/security/cve/cve-2013-1540
https://access.redhat.com/security/cve/cve-2013-1563
https://access.redhat.com/security/cve/cve-2013-2419
https://access.redhat.com/security/cve/cve-2013-1537
https://access.redhat.com/security/cve/cve-2013-2417
https://access.redhat.com/security/cve/cve-2013-2430
https://access.redhat.com/security/cve/cve-2013-0401
https://access.redhat.com/security/cve/cve-2013-1569
https://access.redhat.com/security/cve/cve-2013-2383
https://access.redhat.com/security/cve/cve-2013-2384
https://access.redhat.com/security/cve/cve-2013-2420
https://access.redhat.com/security/cve/cve-2013-2422
https://access.redhat.com/security/cve/cve-2013-2424
https://access.redhat.com/security/cve/cve-2013-2429
https://access.redhat.com/security/cve/cve-2013-1557
https://access.redhat.com/security/cve/cve-2013-2440
https://access.redhat.com/security/cve/cve-2013-1491
https://access.redhat.com/security/cve/cve-2013-2465
https://access.redhat.com/security/cve/cve-2013-1571
https://access.redhat.com/security/cve/cve-2013-2472
https://access.redhat.com/security/cve/cve-2013-2412
插件详情
严重性: Critical
ID: 78976
文件名: redhat-RHSA-2013-1456.nasl
版本: 1.22
类型: local
代理: unix
发布时间: 2014/11/8
最近更新时间: 2022/12/5
支持的传感器: Agentless Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus
风险信息
VPR
风险因素: Critical
分数: 9.8
CVSS v2
风险因素: Critical
基本分数: 10
时间分数: 8.7
矢量: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS 分数来源: CVE-2013-2473
漏洞信息
CPE: p-cpe:/a:redhat:enterprise_linux:java-1.6.0-ibm, p-cpe:/a:redhat:enterprise_linux:java-1.6.0-ibm-devel, cpe:/o:redhat:enterprise_linux:5, cpe:/o:redhat:enterprise_linux:6
必需的 KB 项: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu
可利用: true
易利用性: Exploits are available
补丁发布日期: 2013/10/23
漏洞发布日期: 2012/5/3
CISA 已知可遭利用的漏洞到期日期: 2022/4/18
可利用的方式
Core Impact
Metasploit (Java storeImageArray() Invalid Array Indexing Vulnerability)
参考资料信息
CVE: CVE-2012-0547, CVE-2012-0551, CVE-2012-1531, CVE-2012-1532, CVE-2012-1533, CVE-2012-1541, CVE-2012-1682, CVE-2012-1713, CVE-2012-1716, CVE-2012-1717, CVE-2012-1718, CVE-2012-1719, CVE-2012-1721, CVE-2012-1722, CVE-2012-1725, CVE-2012-3143, CVE-2012-3159, CVE-2012-3213, CVE-2012-3216, CVE-2012-3342, CVE-2012-4820, CVE-2012-4822, CVE-2012-4823, CVE-2012-5068, CVE-2012-5069, CVE-2012-5071, CVE-2012-5072, CVE-2012-5073, CVE-2012-5075, CVE-2012-5079, CVE-2012-5081, CVE-2012-5083, CVE-2012-5084, CVE-2012-5089, CVE-2013-0169, CVE-2013-0351, CVE-2013-0401, CVE-2013-0409, CVE-2013-0419, CVE-2013-0423, CVE-2013-0424, CVE-2013-0425, CVE-2013-0426, CVE-2013-0427, CVE-2013-0428, CVE-2013-0432, CVE-2013-0433, CVE-2013-0434, CVE-2013-0435, CVE-2013-0438, CVE-2013-0440, CVE-2013-0441, CVE-2013-0442, CVE-2013-0443, CVE-2013-0445, CVE-2013-0446, CVE-2013-0450, CVE-2013-0809, CVE-2013-1473, CVE-2013-1476, CVE-2013-1478, CVE-2013-1480, CVE-2013-1481, CVE-2013-1486, CVE-2013-1487, CVE-2013-1491, CVE-2013-1493, CVE-2013-1500, CVE-2013-1537, CVE-2013-1540, CVE-2013-1557, CVE-2013-1563, CVE-2013-1569, CVE-2013-1571, CVE-2013-2383, CVE-2013-2384, CVE-2013-2394, CVE-2013-2407, CVE-2013-2412, CVE-2013-2417, CVE-2013-2418, CVE-2013-2419, CVE-2013-2420, CVE-2013-2422, CVE-2013-2424, CVE-2013-2429, CVE-2013-2430, CVE-2013-2432, CVE-2013-2433, CVE-2013-2435, CVE-2013-2437, CVE-2013-2440, CVE-2013-2442, CVE-2013-2443, CVE-2013-2444, CVE-2013-2446, CVE-2013-2447, CVE-2013-2448, CVE-2013-2450, CVE-2013-2451, CVE-2013-2452, CVE-2013-2453, CVE-2013-2454, CVE-2013-2455, CVE-2013-2456, CVE-2013-2457, CVE-2013-2459, CVE-2013-2463, CVE-2013-2464, CVE-2013-2465, CVE-2013-2466, CVE-2013-2468, CVE-2013-2469, CVE-2013-2470, CVE-2013-2471, CVE-2013-2472, CVE-2013-2473, CVE-2013-3743
RHSA: 2013:1456