Rapid7 Vulnerability & Exploit Database

RHSA-2010:0408: java-1.4.2-ibm security update

Back to Search

RHSA-2010:0408: java-1.4.2-ibm security update



The IBM 1.4.2 SR13-FP4 Java release includes the IBM Java 2 RuntimeEnvironment and the IBM Java 2 Software Development Kit.This update fixes various vulnerabilities in the IBM Java 2 RuntimeEnvironment and the IBM Java 2 Software Development Kit. Thesevulnerabilities are summarized on the IBM "Security alerts" page listed inthe References section. (CVE-2009-3555, CVE-2009-3867, CVE-2009-3869,CVE-2009-3871, CVE-2009-3874, CVE-2009-3875)For the CVE-2009-3555 issue, this update disables renegotiation in thenon-default IBM JSSE2 provider for the Java Secure Socket Extension (JSSE)component. The default JSSE provider is not updated with this fix. Refer tothe IBMJSSE2 Provider Reference Guide, linked to in the References, forinstructions on how to configure the IBM Java 2 Runtime Environment to usethe JSSE2 provider by default.When using the JSSE2 provider, unsafe renegotiation can be re-enabled usingthe com.ibm.jsse2.renegotiate property. Refer to the followingKnowledgebase article for details:http://kbase.redhat.com/faq/docs/DOC-20491Warning: Do not install these java-1.4.2-ibm packages for SAP alongside thejava-1.4.2-ibm packages from the Red Hat Enterprise Linux Extras orSupplementary channels on the Red Hat Network. Doing so could cause yoursystem to fail to update cleanly, among other possible problems.All users of java-1.4.2-ibm for Red Hat Enterprise Linux 4 and 5 for SAPare advised to upgrade to these updated packages, which contain the IBM1.4.2 SR13-FP4 Java release. All running instances of IBM Java must berestarted for this update to take effect.


  • redhat-upgrade-java-1-4-2-ibm
  • redhat-upgrade-java-1-4-2-ibm-demo
  • redhat-upgrade-java-1-4-2-ibm-devel
  • redhat-upgrade-java-1-4-2-ibm-javacomm
  • redhat-upgrade-java-1-4-2-ibm-src

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center