Sun Java Runtime Environment XML Data Processing Multiple Vulnerabilities
BID:30143
Info
Sun Java Runtime Environment XML Data Processing Multiple Vulnerabilities
| Bugtraq ID: | 30143 |
| Class: | Unknown |
| CVE: |
CVE-2008-3106 CVE-2008-3105 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 08 2008 12:00AM |
| Updated: | Apr 13 2015 08:36PM |
| Credit: | Sun |
| Vulnerable: |
VMWare VirtualCenter 2.0.2 VMWare VirtualCenter 2.5 Update 5 VMWare VirtualCenter 2.5 Update 2 VMWare VirtualCenter 2.5 Update 1 VMWare VirtualCenter 2.5 VMWare VirtualCenter 2.0.2 Update 5 VMWare VirtualCenter 2.0.2 Update 4 VMWare VirtualCenter 2.0.2 Update 3 VMWare VirtualCenter 2.0.2 Update 2 VMWare VirtualCenter 2.0.2 Update 1 VMWare ESX Server 3.0.3 VMWare ESX Server 3.0.2 VMWare ESX Server 3.0.1 VMWare ESX Server 3.5 SuSE SUSE Linux Enterprise Server 9 SuSE SUSE Linux Enterprise Server 10 SP2 SuSE SUSE Linux Enterprise Server 10 SP1 SuSE SUSE Linux Enterprise Desktop 10 SP2 SuSE SUSE Linux Enterprise Desktop 10 SP1 Sun JRE (Linux Production Release) 1.6 _06 Sun JRE (Linux Production Release) 1.6 _05 Sun JRE (Linux Production Release) 1.6 _04 Sun JRE (Linux Production Release) 1.5 _15 Sun JRE (Linux Production Release) 1.5 _07 Sun JRE (Linux Production Release) 1.5 _06 Sun JRE (Linux Production Release) 1.6.0_03 Sun JRE (Linux Production Release) 1.6.0_02 Sun JRE (Linux Production Release) 1.6.0_01 Sun JRE (Linux Production Release) 1.5.0_14 Sun JRE (Linux Production Release) 1.5.0_13 Sun JRE (Linux Production Release) 1.5.0_12 Sun JRE (Linux Production Release) 1.5.0_11 Sun JRE (Linux Production Release) 1.5.0_10 Sun JRE (Linux Production Release) 1.5.0_09 Sun JRE (Linux Production Release) 1.5.0_08 Sun JDK (Solaris Production Release) 1.5 _15 Sun JDK (Linux Production Release) 1.6 _06 Sun JDK (Linux Production Release) 1.6 _05 Sun JDK (Linux Production Release) 1.6 _04 Sun JDK (Linux Production Release) 1.6 _01 Sun JDK (Linux Production Release) 1.5 0_10 Sun JDK (Linux Production Release) 1.5 _14 Sun JDK (Linux Production Release) 1.5 _07 Sun JDK (Linux Production Release) 1.5 _06 Sun JDK (Linux Production Release) 1.5 _02 Sun JDK (Linux Production Release) 1.5 _01 Sun JDK (Linux Production Release) 1.5 .0_05 Sun JDK (Linux Production Release) 1.6.0_03 Sun JDK (Linux Production Release) 1.6.0_02 Sun JDK (Linux Production Release) 1.5.0_13 Sun JDK (Linux Production Release) 1.5.0.0_12 Sun JDK (Linux Production Release) 1.5.0.0_11 Sun JDK (Linux Production Release) 1.5.0.0_09 Sun JDK (Linux Production Release) 1.5.0.0_08 Sun JDK (Linux Production Release) 1.5.0.0_04 Sun JDK (Linux Production Release) 1.5.0.0_03 S.u.S.E. Open-Enterprise-Server 0 S.u.S.E. Novell Linux POS 9 RedHat Red Hat Network Satellite (for RHEL 4) 5.1 RedHat Enterprise Linux WS Extras 4 RedHat Enterprise Linux Extras 4 RedHat Enterprise Linux ES Extras 4 RedHat Enterprise Linux AS Extras 4 RedHat Desktop Extras 4 Red Hat Enterprise Linux Supplementary 5 server Red Hat Enterprise Linux Desktop Supplementary 5 client Oracle JRockit R27.6.0 Nortel Networks Web-Centric Self-Service 0 Nortel Networks Self-Service Speech Server 0 Nortel Networks Self-Service Peri Application 0 Nortel Networks Self-Service MPS 500 0 Nortel Networks Self-Service MPS 1000 0 Nortel Networks Self-Service CCXML 0 Nortel Networks Self-Service 0 Nortel Networks Self Service VoiceXML 0 Nortel Networks MPS Speech Server 6.0 Nortel Networks MPS Manager 0 Nortel Networks MPS Developer 0 Nortel Networks MPS 3.0 Nortel Networks MPS 2.1 Nortel Networks MPS 1.0 Nortel Networks Enterprise VoIP TM-CS1000 Nortel Networks Communication Control Toolkit 0 IcedTea IcedTea 1.7 Gentoo Linux BEA Systems JRockit 8.1 BEA Systems JRockit 8.0 BEA Systems JRockit 7.0 BEA Systems JRockit 3.1.5 BEA Systems JRockit 3.1.4 .1 BEA Systems JRockit 3.1.4 BEA Systems JRockit 3.1.3 BEA Systems JRockit 3.1.2 BEA Systems JRockit 3.1.1 BEA Systems JRockit 1.5 BEA Systems JRockit 1.4.2 07 BEA Systems JRockit 1.4.2 BEA Systems JRockit 1.3.1 20 BEA Systems JRockit R27.5.0 BEA Systems JRockit R27.3.1 BEA Systems JRockit 7.0 BEA Systems JRockit 6 BEA Systems JRockit 5.0 BEA Systems JRockit 1.5.0_04 BEA Systems JRockit 1.5.0_03 BEA Systems JRockit 1.4.2_08 BEA Systems JRockit 1.4.2_05 BEA Systems JRockit 1.4.2_04 BEA Systems JRockit 1.4.2 R4.5 Apple Mac OS X Server 10.5.5 Apple Mac OS X Server 10.5.4 Apple Mac OS X Server 10.5.3 Apple Mac OS X Server 10.5.2 Apple Mac OS X Server 10.5.1 Apple Mac OS X Server 10.5 Apple Mac OS X 10.5.5 Apple Mac OS X 10.5.4 Apple Mac OS X 10.5.3 Apple Mac OS X 10.5.2 Apple Mac OS X 10.5.1 Apple Mac OS X 10.5 |
| Not Vulnerable: |
VMWare VirtualCenter 2.5.Update 3 build 1 Sun JRE (Linux Production Release) 1.6 _07 Sun JRE (Linux Production Release) 1.5 _16 Sun JDK (Linux Production Release) 1.6 _07 Sun JDK (Linux Production Release) 1.5.0_16 |
Discussion
Sun Java Runtime Environment XML Data Processing Multiple Vulnerabilities
Sun Java Runtime Environment is prone to multiple remote vulnerabilities.
An attacker can exploit these issues to obtain sensitive information or crash the affected application, denying service to legitimate users.
These issues affect the following versions on Solaris, Linux, and Windows platforms:
JDK and JRE 6 Update 6 and earlier
JDK and JRE 5.0 Update 15 and earlier
Sun Java Runtime Environment is prone to multiple remote vulnerabilities.
An attacker can exploit these issues to obtain sensitive information or crash the affected application, denying service to legitimate users.
These issues affect the following versions on Solaris, Linux, and Windows platforms:
JDK and JRE 6 Update 6 and earlier
JDK and JRE 5.0 Update 15 and earlier
Exploit / POC
Sun Java Runtime Environment XML Data Processing Multiple Vulnerabilities
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
Sun Java Runtime Environment XML Data Processing Multiple Vulnerabilities
Solution:
The vendor has released an update. Please see the references for more information.
Oracle JRockit R27.6.0
Apple Mac OS X Server 10.5.5
Solution:
The vendor has released an update. Please see the references for more information.
Oracle JRockit R27.6.0
-
Oracle jrockit-jdk1.5.0_15-linux_ia32.tar.gz
ftp://anonymous:dev2dev%40bea%[email protected]/pub/releases/securit y/jrockit-jdk1.5.0_15-linux_ia32.tar.gz -
Oracle jrockit-jdk1.5.0_15-linux_ia64.tar.gz
ftp://anonymous:dev2dev%40bea%[email protected]/pub/releases/securit y/jrockit-jdk1.5.0_15-linux_ia64.tar.gz -
Oracle jrockit-jdk1.5.0_15-linux_x86_64.tar.gz
ftp://anonymous:dev2dev%40bea%[email protected]/pub/releases/securit y/jrockit-jdk1.5.0_15-linux_x86_64.tar.gz -
Oracle jrockit-jdk1.5.0_15-solaris_sparcv9.tar.gz
ftp://anonymous:dev2dev%40bea%[email protected]/pub/releases/securit y/jrockit-jdk1.5.0_15-solaris_sparcv9.tar.gz -
Oracle jrockit-jdk1.5.0_15-windows_ia32.zip
ftp://anonymous:dev2dev%40bea%[email protected]/pub/releases/securit y/jrockit-jdk1.5.0_15-windows_ia32.zip -
Oracle jrockit-jdk1.5.0_15-windows_ia64.zip
ftp://anonymous:dev2dev%40bea%[email protected]/pub/releases/securit y/jrockit-jdk1.5.0_15-windows_ia64.zip -
Oracle jrockit-jdk1.5.0_15-windows_x86_64.zip
ftp://anonymous:dev2dev%40bea%[email protected]/pub/releases/securit y/jrockit-jdk1.5.0_15-windows_x86_64.zip -
Oracle jrockit-jdk1.6.0_05-linux_ia32.tar.gz
ftp://anonymous:dev2dev%40bea%[email protected]/pub/releases/securit y/jrockit-jdk1.6.0_05-linux_ia32.tar.gz -
Oracle jrockit-jdk1.6.0_05-linux_x86_64.tar.gz
ftp://anonymous:dev2dev%40bea%[email protected]/pub/releases/securit y/jrockit-jdk1.6.0_05-linux_x86_64.tar.gz -
Oracle jrockit-jdk1.6.0_05-solaris_sparcv9.tar.gz
ftp://anonymous:dev2dev%40bea%[email protected]/pub/releases/securit y/jrockit-jdk1.6.0_05-solaris_sparcv9.tar.gz -
Oracle jrockit-jdk1.6.0_05-windows_ia32.zip
ftp://anonymous:dev2dev%40bea%[email protected]/pub/releases/securit y/jrockit-jdk1.6.0_05-windows_ia32.zip -
Oracle jrockit-jdk1.6.0_05-windows_x86_64.zip
ftp://anonymous:dev2dev%40bea%[email protected]/pub/releases/securit y/jrockit-jdk1.6.0_05-windows_x86_64.zip
Apple Mac OS X Server 10.5.5
-
Apple JavaForMacOSX10.5Update2.dmg
Java for Mac OS X 10.5 Update 2
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=21277&cat= 59&platform=osx&method=sa/JavaForMacOSX10.5Update2.dmg
References
Sun Java Runtime Environment XML Data Processing Multiple Vulnerabilities
References:
References:
- IcedTea Homepage (IcedTea)
- 2008008988, Rev 2 - Nortel Response to Sun Java JDK / JRE Multiple Vulnerabiliti (Nortel Networks)
- Nortel Security Advisory 2008008988, Rev 1 (Nortel)
- RHSA-2008:0594-7 java-1.6.0-sun security update (Red Hat)
- RHSA-2008:0638-4 Red Hat Network Satellite Server IBM Java Runtime security upda (Red Hat)
- RHSA-2008:0790-6 java-1.5.0-ibm security update (Red Hat)
- Security Vulnerability in the Java Runtime Environment related to the processing (Oracle)
- Security Vulnerability in the Java Runtime Environment related to the processing (Oracle)
- Solution 238628: Security Vulnerabilities in the Java Runtime Environment (Sun)