Rapid7 Vulnerability & Exploit Database

RHSA-2008:0906: java-1.6.0-ibm security update

Back to Search

RHSA-2008:0906: java-1.6.0-ibm security update



The IBM 1.6.0 Java release includes the IBM Java 2 Runtime Environment andthe IBM Java 2 Software Development Kit.A flaw was found in the Java Management Extensions (JMX) management agent.When local monitoring is enabled, remote attackers could use this flaw toperform illegal operations. (CVE-2008-3103) Several flaws involving the handling of unsigned applets were found. Aremote attacker could misuse an unsigned applet in order to connect toservices on the host running the applet. (CVE-2008-3104)Several flaws in the Java API for XML Web Services (JAX-WS) client and theJAX-WS service implementation were found. A remote attacker who could causemalicious XML to be processed by an application could access URLs, or causea denial of service. (CVE-2008-3105, CVE-2008-3106)Several flaws within the Java Runtime Environment (JRE) scripting supportwere found. A remote attacker could grant an untrusted applet extendedprivileges, such as reading and writing local files, executinglocal programs, or querying the sensitive data of other applets.(CVE-2008-3109, CVE-2008-3110)A flaw in Java Web Start was found. Using an untrusted Java WebStart application, a remote attacker could create or delete arbitraryfiles with the permissions of the user running the untrusted application.(CVE-2008-3112)A flaw in Java Web Start when processing untrusted applications was found.An attacker could use this flaw to acquire sensitive information, such asthe location of the cache. (CVE-2008-3114)All users of java-1.6.0-ibm are advised to upgrade to these updatedpackages, containing the IBM 1.6.0 SR2 Java release, which resolves theseissues.


  • redhat-upgrade-java-1-6-0-ibm
  • redhat-upgrade-java-1-6-0-ibm-accessibility
  • redhat-upgrade-java-1-6-0-ibm-demo
  • redhat-upgrade-java-1-6-0-ibm-devel
  • redhat-upgrade-java-1-6-0-ibm-javacomm
  • redhat-upgrade-java-1-6-0-ibm-jdbc
  • redhat-upgrade-java-1-6-0-ibm-plugin
  • redhat-upgrade-java-1-6-0-ibm-src

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center