Rapid7 Vulnerability & Exploit Database

RHSA-2010:0155: java-1.4.2-ibm security and bug fix update

Back to Search

RHSA-2010:0155: java-1.4.2-ibm security and bug fix update

Severity
6
CVSS
(AV:N/AC:M/Au:N/C:N/I:P/A:P)
Published
11/09/2009
Created
07/25/2018
Added
03/24/2010
Modified
07/04/2017

Description

The IBM 1.4.2 SR13-FP4 Java release includes the IBM Java 2 RuntimeEnvironment and the IBM Java 2 Software Development Kit.A flaw was found in the way the TLS/SSL (Transport Layer Security/SecureSockets Layer) protocols handle session renegotiation. A man-in-the-middleattacker could use this flaw to prefix arbitrary plain text to a client'ssession (for example, an HTTPS connection to a website). This could forcethe server to process an attacker's request as if authenticated using thevictim's credentials. (CVE-2009-3555)This update disables renegotiation in the non-default IBM JSSE2 providerfor the Java Secure Socket Extension (JSSE) component. The default JSSEprovider is not updated with this fix. Refer to the IBMJSSE2 ProviderReference Guide, linked to in the References, for instructions on how toconfigure the IBM Java 2 Runtime Environment to use the JSSE2 provider bydefault.When using the JSSE2 provider, unsafe renegotiation can be re-enabled usingthe com.ibm.jsse2.renegotiate property. Refer to the followingKnowledgebase article for details:http://kbase.redhat.com/faq/docs/DOC-20491This update also fixes the following bug:All users of java-1.4.2-ibm are advised to upgrade to these updatedpackages, which contain the IBM 1.4.2 SR13-FP4 Java release. All runninginstances of IBM Java must be restarted for this update to take effect.

Solution(s)

  • redhat-upgrade-java-1-4-2-ibm
  • redhat-upgrade-java-1-4-2-ibm-demo
  • redhat-upgrade-java-1-4-2-ibm-devel
  • redhat-upgrade-java-1-4-2-ibm-javacomm
  • redhat-upgrade-java-1-4-2-ibm-jdbc
  • redhat-upgrade-java-1-4-2-ibm-plugin
  • redhat-upgrade-java-1-4-2-ibm-src

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;