| ||||||||||||||||
Red Hat alert RHSA-2007:0963-01 (java-1.5.0-sun)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Important: java-1.5.0-sun security update Advisory ID: RHSA-2007:0963-01 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-0963.html Issue date: 2007-10-12 Updated on: 2007-10-12 Product: Red Hat Enterprise Linux Extras CVE Names: CVE-2007-5232 CVE-2007-5238 CVE-2007-5239 CVE-2007-5240 CVE-2007-5273 CVE-2007-5274 - --------------------------------------------------------------------- 1. Summary: Updated java-1.5.0-sun packages that correct several security issues are now available for Red Hat Enterprise Linux 4 Extras and 5 Supplementary. This update has been rated as having important security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 4 Extras - i386, x86_64 Red Hat Desktop version 4 Extras - i386, x86_64 Red Hat Enterprise Linux ES version 4 Extras - i386, x86_64 Red Hat Enterprise Linux WS version 4 Extras - i386, x86_64 RHEL Desktop Supplementary (v. 5 client) - i386, x86_64 RHEL Supplementary (v. 5 server) - i386, x86_64 3. Problem description: The Java Runtime Environment (JRE) contains the software and tools that users need to run applets and applications written using the Java programming language. A flaw in the applet caching mechanism of the Java Runtime Environment (JRE) did not correctly process the creation of network connections. A remote attacker could use this flaw to create connections to services on machines other than the one that the applet was downloaded from. (CVE-2007-5232) Multiple vulnerabilities existed in Java Web Start allowing an untrusted application to determine the location of the Java Web Start cache. (CVE-2007-5238) Untrusted Java Web Start Applications or Java Applets were able to drag and drop a file to a Desktop Application. A user-assisted remote attacker could use this flaw to move or copy arbitrary files. (CVE-2007-5239) The Java Runtime Environment (JRE) allowed untrusted Java Applets or applications to display oversized Windows. This could be used by remote attackers to hide security warning banners. (CVE-2007-5240) Unsigned Java Applets communicating via a HTTP proxy could allow a remote attacker to violate the Java security model. A cached, malicious Applet could create network connections to services on other machines. (CVE-2007-5273) Unsigned Applets loaded with Mozilla Firefox or Opera browsers allowed remote attackers to violate the Java security model. A cached, malicious Applet could create network connections to services on other machines. (CVE-2007-5274) In Red Hat Enterprise Linux a Java Web Start application requesting elevated permissions is only started automatically when signed with a trusted code signing certificate and otherwise requires user confirmation to access privileged resources. All users of java-sun-1.5.0 should upgrade to these packages, which contain Sun Java 1.5.0 Update 13 that corrects these issues. Please note that during our quality testing we discovered that the Java browser plug-in may not function perfectly when visiting some sites that make use of multiple applets on a single HTML page. We have verified that this issue is not due to our packaging and affects Sun Java 1.5.0 Update 13. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 321951 - CVE-2007-5232 Security Vulnerability in Java Runtime Environment With Applet Caching 321961 - CVE-2007-5238 Vulnerabilities in Java Web Start allow to determine the location of the Java Web Start cache 321981 - CVE-2007-5239 Untrusted Application or Applet May Move or Copy Arbitrary Files 321991 - CVE-2007-5240 Applets or Applications are allowed to display an oversized window 324351 - CVE-2007-5273 Anti-DNS Pinning and Java Applets with HTTP proxy 324361 - CVE-2007-5274 Anti-DNS Pinning and Java Applets with Opera and Firefox 6. RPMs required: Red Hat Enterprise Linux AS version 4 Extras: i386: 3706c9413164ce5b813c58cccdef2c0d java-1.5.0-sun-1.5.0.13-1jpp.1.el4.i586.rpm fc5b7afe7ad0dafc7674046926e4a85d java-1.5.0-sun-demo-1.5.0.13-1jpp.1.el4.i586.rpm 18cf410980bd3bf9c6efd15e65a5ab55 java-1.5.0-sun-devel-1.5.0.13-1jpp.1.el4.i586.rpm a8836d4cddc258e716b1b3c391e3e703 java-1.5.0-sun-jdbc-1.5.0.13-1jpp.1.el4.i586.rpm 7ccd54c80d4fc8af6fd734454c513916 java-1.5.0-sun-plugin-1.5.0.13-1jpp.1.el4.i586.rpm 55c3f4337a6c7a7f24961ea1aab7cc51 java-1.5.0-sun-src-1.5.0.13-1jpp.1.el4.i586.rpm x86_64: 910cd54c393e23be712e998c71896f4a java-1.5.0-sun-1.5.0.13-1jpp.1.el4.x86_64.rpm d7212d88844bab46f7100886fcbd9957 java-1.5.0-sun-demo-1.5.0.13-1jpp.1.el4.x86_64.rpm b199fc01e8f065cf24682f529c0124bf java-1.5.0-sun-devel-1.5.0.13-1jpp.1.el4.x86_64.rpm acc23e5c0ca693c9b0687072db464e12 java-1.5.0-sun-jdbc-1.5.0.13-1jpp.1.el4.x86_64.rpm ecc90825333738682d92f571622fc071 java-1.5.0-sun-src-1.5.0.13-1jpp.1.el4.x86_64.rpm Red Hat Desktop version 4 Extras: i386: 3706c9413164ce5b813c58cccdef2c0d java-1.5.0-sun-1.5.0.13-1jpp.1.el4.i586.rpm fc5b7afe7ad0dafc7674046926e4a85d java-1.5.0-sun-demo-1.5.0.13-1jpp.1.el4.i586.rpm 18cf410980bd3bf9c6efd15e65a5ab55 java-1.5.0-sun-devel-1.5.0.13-1jpp.1.el4.i586.rpm a8836d4cddc258e716b1b3c391e3e703 java-1.5.0-sun-jdbc-1.5.0.13-1jpp.1.el4.i586.rpm 7ccd54c80d4fc8af6fd734454c513916 java-1.5.0-sun-plugin-1.5.0.13-1jpp.1.el4.i586.rpm 55c3f4337a6c7a7f24961ea1aab7cc51 java-1.5.0-sun-src-1.5.0.13-1jpp.1.el4.i586.rpm x86_64: 910cd54c393e23be712e998c71896f4a java-1.5.0-sun-1.5.0.13-1jpp.1.el4.x86_64.rpm d7212d88844bab46f7100886fcbd9957 java-1.5.0-sun-demo-1.5.0.13-1jpp.1.el4.x86_64.rpm b199fc01e8f065cf24682f529c0124bf java-1.5.0-sun-devel-1.5.0.13-1jpp.1.el4.x86_64.rpm acc23e5c0ca693c9b0687072db464e12 java-1.5.0-sun-jdbc-1.5.0.13-1jpp.1.el4.x86_64.rpm ecc90825333738682d92f571622fc071 java-1.5.0-sun-src-1.5.0.13-1jpp.1.el4.x86_64.rpm Red Hat Enterprise Linux ES version 4 Extras: i386: 3706c9413164ce5b813c58cccdef2c0d java-1.5.0-sun-1.5.0.13-1jpp.1.el4.i586.rpm fc5b7afe7ad0dafc7674046926e4a85d java-1.5.0-sun-demo-1.5.0.13-1jpp.1.el4.i586.rpm 18cf410980bd3bf9c6efd15e65a5ab55 java-1.5.0-sun-devel-1.5.0.13-1jpp.1.el4.i586.rpm a8836d4cddc258e716b1b3c391e3e703 java-1.5.0-sun-jdbc-1.5.0.13-1jpp.1.el4.i586.rpm 7ccd54c80d4fc8af6fd734454c513916 java-1.5.0-sun-plugin-1.5.0.13-1jpp.1.el4.i586.rpm 55c3f4337a6c7a7f24961ea1aab7cc51 java-1.5.0-sun-src-1.5.0.13-1jpp.1.el4.i586.rpm x86_64: 910cd54c393e23be712e998c71896f4a java-1.5.0-sun-1.5.0.13-1jpp.1.el4.x86_64.rpm d7212d88844bab46f7100886fcbd9957 java-1.5.0-sun-demo-1.5.0.13-1jpp.1.el4.x86_64.rpm b199fc01e8f065cf24682f529c0124bf java-1.5.0-sun-devel-1.5.0.13-1jpp.1.el4.x86_64.rpm acc23e5c0ca693c9b0687072db464e12 java-1.5.0-sun-jdbc-1.5.0.13-1jpp.1.el4.x86_64.rpm ecc90825333738682d92f571622fc071 java-1.5.0-sun-src-1.5.0.13-1jpp.1.el4.x86_64.rpm Red Hat Enterprise Linux WS version 4 Extras: i386: 3706c9413164ce5b813c58cccdef2c0d java-1.5.0-sun-1.5.0.13-1jpp.1.el4.i586.rpm fc5b7afe7ad0dafc7674046926e4a85d java-1.5.0-sun-demo-1.5.0.13-1jpp.1.el4.i586.rpm 18cf410980bd3bf9c6efd15e65a5ab55 java-1.5.0-sun-devel-1.5.0.13-1jpp.1.el4.i586.rpm a8836d4cddc258e716b1b3c391e3e703 java-1.5.0-sun-jdbc-1.5.0.13-1jpp.1.el4.i586.rpm 7ccd54c80d4fc8af6fd734454c513916 java-1.5.0-sun-plugin-1.5.0.13-1jpp.1.el4.i586.rpm 55c3f4337a6c7a7f24961ea1aab7cc51 java-1.5.0-sun-src-1.5.0.13-1jpp.1.el4.i586.rpm x86_64: 910cd54c393e23be712e998c71896f4a java-1.5.0-sun-1.5.0.13-1jpp.1.el4.x86_64.rpm d7212d88844bab46f7100886fcbd9957 java-1.5.0-sun-demo-1.5.0.13-1jpp.1.el4.x86_64.rpm b199fc01e8f065cf24682f529c0124bf java-1.5.0-sun-devel-1.5.0.13-1jpp.1.el4.x86_64.rpm acc23e5c0ca693c9b0687072db464e12 java-1.5.0-sun-jdbc-1.5.0.13-1jpp.1.el4.x86_64.rpm ecc90825333738682d92f571622fc071 java-1.5.0-sun-src-1.5.0.13-1jpp.1.el4.x86_64.rpm RHEL Desktop Supplementary (v. 5 client): i386: 35c9332d0204f54b5b056474bdeaeccf java-1.5.0-sun-1.5.0.13-1jpp.1.el5.i586.rpm 44f9288677a80fcbafba3a5fed92e592 java-1.5.0-sun-demo-1.5.0.13-1jpp.1.el5.i586.rpm c5239b51ae5dea75c6b2b0320f0714a4 java-1.5.0-sun-devel-1.5.0.13-1jpp.1.el5.i586.rpm d523a49ce4259e115a17531a6b23e467 java-1.5.0-sun-jdbc-1.5.0.13-1jpp.1.el5.i586.rpm 3b986af374d7cbc7ea45ed77bf218ebb java-1.5.0-sun-plugin-1.5.0.13-1jpp.1.el5.i586.rpm 067de5283b3a7a21d00b89eda43e6280 java-1.5.0-sun-src-1.5.0.13-1jpp.1.el5.i586.rpm x86_64: d5f5265a30c8e070f32bcab27acec770 java-1.5.0-sun-1.5.0.13-1jpp.1.el5.x86_64.rpm 1e0e4593210908b9b328510de912bf4d java-1.5.0-sun-demo-1.5.0.13-1jpp.1.el5.x86_64.rpm 383d3f8999dcca1f789bb1ca3b1da61a java-1.5.0-sun-devel-1.5.0.13-1jpp.1.el5.x86_64.rpm 305bdcd08a3085516b1cebde6ffdd3e0 java-1.5.0-sun-jdbc-1.5.0.13-1jpp.1.el5.x86_64.rpm 3b986af374d7cbc7ea45ed77bf218ebb java-1.5.0-sun-plugin-1.5.0.13-1jpp.1.el5.i586.rpm 8b9d091c14eee7ceece65a9239a20715 java-1.5.0-sun-src-1.5.0.13-1jpp.1.el5.x86_64.rpm RHEL Supplementary (v. 5 server): i386: 35c9332d0204f54b5b056474bdeaeccf java-1.5.0-sun-1.5.0.13-1jpp.1.el5.i586.rpm 44f9288677a80fcbafba3a5fed92e592 java-1.5.0-sun-demo-1.5.0.13-1jpp.1.el5.i586.rpm c5239b51ae5dea75c6b2b0320f0714a4 java-1.5.0-sun-devel-1.5.0.13-1jpp.1.el5.i586.rpm d523a49ce4259e115a17531a6b23e467 java-1.5.0-sun-jdbc-1.5.0.13-1jpp.1.el5.i586.rpm 3b986af374d7cbc7ea45ed77bf218ebb java-1.5.0-sun-plugin-1.5.0.13-1jpp.1.el5.i586.rpm 067de5283b3a7a21d00b89eda43e6280 java-1.5.0-sun-src-1.5.0.13-1jpp.1.el5.i586.rpm x86_64: d5f5265a30c8e070f32bcab27acec770 java-1.5.0-sun-1.5.0.13-1jpp.1.el5.x86_64.rpm 1e0e4593210908b9b328510de912bf4d java-1.5.0-sun-demo-1.5.0.13-1jpp.1.el5.x86_64.rpm 383d3f8999dcca1f789bb1ca3b1da61a java-1.5.0-sun-devel-1.5.0.13-1jpp.1.el5.x86_64.rpm 305bdcd08a3085516b1cebde6ffdd3e0 java-1.5.0-sun-jdbc-1.5.0.13-1jpp.1.el5.x86_64.rpm 3b986af374d7cbc7ea45ed77bf218ebb java-1.5.0-sun-plugin-1.5.0.13-1jpp.1.el5.i586.rpm 8b9d091c14eee7ceece65a9239a20715 java-1.5.0-sun-src-1.5.0.13-1jpp.1.el5.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5232 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5238 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5239 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5240 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5273 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5274 http://www.redhat.com/security/updates/classification/#im... 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHD0UfXlSAg2UNWIIRArmzAJ4yhlngp9IpzC3MFGdHASiz+++/OQCgrKSM DYGpamd2Bx4XWX98BBEXNIc= =njz4 -----END PGP SIGNATURE----- -- Enterprise-watch-list mailing list Enterprise-watch-list@redhat.com https://www.redhat.com/mailman/listinfo/enterprise-watch-... (Log in to post comments)
|
||||||||||||||||