Rapid7 VulnDB

RHSA-2013:0275: java-1.7.0-openjdk security update

Back to Search

RHSA-2013:0275: java-1.7.0-openjdk security update

Severity
10
CVSS
(AV:N/AC:L/Au:N/C:C/I:C/A:C)
Published
02/08/2013
Created
07/25/2018
Added
02/21/2013
Modified
07/04/2017

Description

These packages provide the OpenJDK 7 Java Runtime Environment and theOpenJDK 7 Software Development Kit.Multiple improper permission check issues were discovered in the JMX andLibraries components in OpenJDK. An untrusted Java application or appletcould use these flaws to bypass Java sandbox restrictions. (CVE-2013-1486,CVE-2013-1484)An improper permission check issue was discovered in the Librariescomponent in OpenJDK. An untrusted Java application or applet could usethis flaw to bypass certain Java sandbox restrictions. (CVE-2013-1485)It was discovered that OpenJDK leaked timing information when decryptingTLS/SSL protocol encrypted records when CBC-mode cipher suites were used.A remote attacker could possibly use this flaw to retrieve plain text fromthe encrypted packets by using a TLS/SSL server as a padding oracle.(CVE-2013-0169)This erratum also upgrades the OpenJDK package to IcedTea7 2.3.7. Refer tothe NEWS file, linked to in the References, for further information.All users of java-1.7.0-openjdk are advised to upgrade to these updatedpackages, which resolve these issues. All running instances of OpenJDK Javamust be restarted for the update to take effect.

Solution(s)

  • redhat-upgrade-java-1-7-0-openjdk
  • redhat-upgrade-java-1-7-0-openjdk-debuginfo
  • redhat-upgrade-java-1-7-0-openjdk-demo
  • redhat-upgrade-java-1-7-0-openjdk-devel
  • redhat-upgrade-java-1-7-0-openjdk-javadoc
  • redhat-upgrade-java-1-7-0-openjdk-src

References

  • redhat-upgrade-java-1-7-0-openjdk
  • redhat-upgrade-java-1-7-0-openjdk-debuginfo
  • redhat-upgrade-java-1-7-0-openjdk-demo
  • redhat-upgrade-java-1-7-0-openjdk-devel
  • redhat-upgrade-java-1-7-0-openjdk-javadoc
  • redhat-upgrade-java-1-7-0-openjdk-src

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;