It was discovered that OpenJDK improperly re-used cached NTLM connections in some situations. A remote attacker could possibly use this to cause a Java application to perform actions with the credentials of a different user. (CVE-2017-3509)

It was discovered that an untrusted library search path flaw existed in the Java Cryptography Extension (JCE) component of OpenJDK. A local attacker could possibly use this to gain the privileges of a Java application. (CVE-2017-3511)

It was discovered that the Java API for XML Processing (JAXP) component in OpenJDK did not properly enforce size limits when parsing XML documents. An attacker could use this to cause a denial of service (processor and memory consumption). (CVE-2017-3526)

It was discovered that the FTP client implementation in OpenJDK did not properly sanitize user inputs. If a user was tricked into opening a specially crafted FTP URL, a remote attacker could use this to manipulate the FTP connection. (CVE-2017-3533)

It was discovered that OpenJDK allowed MD5 to be used as an algorithm for JAR integrity verification. An attacker could possibly use this to modify the contents of a JAR file without detection. (CVE-2017-3539)

It was discovered that the SMTP client implementation in OpenJDK did not properly sanitize sender and recipient addresses. A remote attacker could use this to specially craft email addresses and gain control of a Java application's SMTP connections. (CVE-2017-3544).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:3453 advisory.

  - zlib: Out-of-bounds pointer arithmetic in inftrees.c (CVE-2016-9840)

  - zlib: Out-of-bounds pointer arithmetic in inffast.c (CVE-2016-9841)

  - zlib: Undefined left shift of negative number (CVE-2016-9842)

  - zlib: Big-endian out-of-bounds pointer (CVE-2016-9843)

  - lcms2: Out-of-bounds read in Type_MLU_Read() (CVE-2016-10165)

  - IBM JDK: XML External Entity Injection (XXE) error when processing XML data (CVE-2017-1289)

  - OpenJDK: improper re-use of NTLM authenticated connections (Networking, 8163520) (CVE-2017-3509)

  - OpenJDK: untrusted extension directories search path in Launcher (JCE, 8163528) (CVE-2017-3511)

  - OpenJDK: newline injection in the FTP client (Networking, 8170222) (CVE-2017-3533)

  - OpenJDK: MD5 allowed for jar verification (Security, 8171121) (CVE-2017-3539)

  - OpenJDK: newline injection in the SMTP client (Networking, 8171533) (CVE-2017-3544)

  - OpenJDK: reading of unprocessed image data in JPEGImageReader (2D, 8169209) (CVE-2017-10053)

  - OpenJDK: JAR verifier incorrect handling of missing digest (Security, 8169392) (CVE-2017-10067)

  - OpenJDK: Nashorn incompletely blocking access to Java APIs (Scripting, 8171539) (CVE-2017-10078)

  - OpenJDK: insufficient access control checks in ThreadPoolExecutor (Libraries, 8172204) (CVE-2017-10087)

  - OpenJDK: insufficient access control checks in ServiceRegistry (ImageIO, 8172461) (CVE-2017-10089)

  - OpenJDK: insufficient access control checks in AsynchronousChannelGroupImpl (8172465, Libraries)     (CVE-2017-10090)

  - OpenJDK: insufficient access control checks in XML transformations (JAXP, 8172469) (CVE-2017-10096)

  - OpenJDK: unrestricted access to com.sun.org.apache.xml.internal.resolver (JAXP, 8173286) (CVE-2017-10101)

  - OpenJDK: incorrect handling of references in DGC (RMI, 8163958) (CVE-2017-10102)

  - Oracle JDK: unspecified vulnerability fixed in 6u161, 7u151, and 8u141 (Deployment) (CVE-2017-10105)

  - OpenJDK: insufficient access control checks in ActivationID (RMI, 8173697) (CVE-2017-10107)

  - OpenJDK: unbounded memory allocation in BasicAttribute deserialization (Serialization, 8174105)     (CVE-2017-10108)

  - OpenJDK: unbounded memory allocation in CodeSource deserialization (Serialization, 8174113)     (CVE-2017-10109)

  - OpenJDK: insufficient access control checks in ImageWatched (AWT, 8174098) (CVE-2017-10110)

  - OpenJDK: DSA implementation timing attack (JCE, 8175106) (CVE-2017-10115)

  - OpenJDK: LDAPCertStore following referrals to non-LDAP URLs (Security, 8176067) (CVE-2017-10116)

  - OpenJDK: insecure XML parsing in wsdlimport (JAX-WS, 8182054) (CVE-2017-10243)

  - OpenJDK: multiple unbounded memory allocations in deserialization (Serialization, 8174109)     (CVE-2017-10281)

  - OpenJDK: incorrect privilege use when handling unreferenced objects (RMI, 8174966) (CVE-2017-10285)

  - OpenJDK: HTTP client insufficient check for newline in URLs (Networking, 8176751) (CVE-2017-10295)

  - Oracle JDK: unspecified vulnerability fixed in 8u151 and 9.0.1 (Deployment) (CVE-2017-10309)

  - OpenJDK: unbounded resource use in JceKeyStore deserialization (Serialization, 8181370) (CVE-2017-10345)

  - OpenJDK: insufficient loader constraints checks for invokespecial (Hotspot, 8180711) (CVE-2017-10346)

  - OpenJDK: unbounded memory allocation in SimpleTimeZone deserialization (Serialization, 8181323)     (CVE-2017-10347)

  - OpenJDK: multiple unbounded memory allocations in deserialization (Libraries, 8181432) (CVE-2017-10348)

  - OpenJDK: unbounded memory allocation in PredicatedNodeTest deserialization (JAXP, 8181327)     (CVE-2017-10349)

  - OpenJDK: unbounded memory allocation in JAXWSExceptionBase deserialization (JAX-WS, 8181100)     (CVE-2017-10350)

  - OpenJDK: no default network operations timeouts in FtpClient (Networking, 8181612) (CVE-2017-10355)

  - OpenJDK: weak protection of key stores against brute forcing (Security, 8181692) (CVE-2017-10356)

  - OpenJDK: unbounded memory allocation in ObjectInputStream deserialization (Serialization, 8181597)     (CVE-2017-10357)

  - OpenJDK: use of unprotected sname in Kerberos client (Libraries, 8178794) (CVE-2017-10388)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - OpenJDK: untrusted extension directories search path in Launcher (JCE, 8163528) (CVE-2017-3511)

  - OpenJDK: newline injection in the SMTP client (Networking, 8171533) (CVE-2017-3544)

  - Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking).
    Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded: 8u121.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a     person other than the attacker. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as     unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). (CVE-2017-3509)

  - Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JAXP).
    Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded: 8u121;
    JRockit: R28.3.13. Difficult to exploit vulnerability allows unauthenticated attacker with network access     via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this     vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete     DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This     vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets.
    It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java     Web Start applications or sandboxed Java applets, such as through a web service. (CVE-2017-3526)

  - Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent:
    Networking). Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded:
    8u121; JRockit: R28.3.13. Difficult to exploit vulnerability allows unauthenticated attacker with network     access via FTP to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability     can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded, JRockit     accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be     exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be     exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start     applications or sandboxed Java applets, such as through a web service. (CVE-2017-3533)

  - Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security).
    Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded: 8u121.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a     person other than the attacker. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). (CVE-2017-3539)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The version of Oracle Java SE installed on the remote host is prior to 6 Update 151, 7 Update 141, or 8 Update 131, and is therefore affected by multiple vulnerabilities :

  - An unspecified flaw exists in the Networking subcomponent that allows an unauthenticated, remote attacker to impact confidentiality and integrity. (CVE-2017-3509)
  - An unspecified flaw exists in the JCE subcomponent that allows a local attacker to gain elevated privileges. This vulnerability does not affect Java SE version 6. (CVE-2017-3511)
  - An unspecified flaw exists in the AWT subcomponent that allows an unauthenticated, remote attacker to execute arbitrary code. This vulnerability does not affect Java SE version 6. (CVE-2017-3512)
  - An unspecified flaw exists in the AWT subcomponent that allows an unauthenticated, remote attacker to execute arbitrary code. (CVE-2017-3514)
  - An unspecified flaw exists in the JAXP subcomponent that allows an unauthenticated, remote attacker to cause a denial of service condition. (CVE-2017-3526)
  - Multiple unspecified flaws exist in the Networking subcomponent that allow an unauthenticated, remote attacker to gain update, insert, or delete access to unauthorized data. (CVE-2017-3533, CVE-2017-3544)
  - An unspecified flaw exists in the Security subcomponent that allows an unauthenticated, remote attacker to gain update, insert, or delete access to unauthorized data. (CVE-2017-3539)

ID	Name	Product	Family	Published	Updated	Severity
100154	Ubuntu 16.04 LTS : OpenJDK 8 vulnerabilities (USN-3275-1)	Nessus	Ubuntu Local Security Checks	5/12/2017	10/20/2023	high
105267	RHEL 6 : java-1.8.0-ibm (RHSA-2017:3453)	Nessus	Red Hat Local Security Checks	12/15/2017	4/27/2024	critical
196486	RHEL 5 : openjdk (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	5/11/2024	5/11/2024	high
700090	Oracle Java SE 6 < Update 151 / 7 < Update 141 / 8 < Update 131 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	5/10/2017	3/6/2019	high

Detections

Analytics

Plugins Search

high

critical

high

high