Sun Java Runtime Environment Multiple Security Vulnerabilities

Bugtraq ID:	30144
Class:	Access Validation Error
CVE:	CVE-2008-3109 CVE-2008-3110
Remote:	Yes
Local:	No
Published:	Jul 08 2008 12:00AM
Updated:	Nov 18 2009 08:06PM
Credit:	Sun Microsystems
Vulnerable:	VMWare VirtualCenter 2.0.2 VMWare VirtualCenter 2.5 Update 5 VMWare VirtualCenter 2.5 Update 2 VMWare VirtualCenter 2.5 Update 1 VMWare VirtualCenter 2.5 VMWare VirtualCenter 2.0.2 Update 5 VMWare VirtualCenter 2.0.2 Update 4 VMWare VirtualCenter 2.0.2 Update 3 VMWare VirtualCenter 2.0.2 Update 2 VMWare VirtualCenter 2.0.2 Update 1 VMWare ESX Server 3.0.3 VMWare ESX Server 3.0.2 VMWare ESX Server 3.0.1 VMWare ESX Server 3.5 Sun JRE (Linux Production Release) 1.6 _06 Sun JRE (Linux Production Release) 1.6 _05 Sun JRE (Linux Production Release) 1.6 _04 Sun JRE 6.0 Update 3 Sun JRE 6.0 Update 2 Sun JRE 6.0 Update 1 Sun JDK (Linux Production Release) 1.6 _06 Sun JDK (Linux Production Release) 1.6 _05 Sun JDK (Linux Production Release) 1.6 _04 Sun JDK (Linux Production Release) 1.6 Sun JDK 6.0 Update 3 Sun JDK 6.0 Update 2 Sun JDK 6.0 Update 1 Redhat Enterprise Linux WS Extras 4 Redhat Enterprise Linux Supplementary 5 server Redhat Enterprise Linux Extras 4 Redhat Enterprise Linux ES Extras 4 Redhat Enterprise Linux Desktop Supplementary 5 client Redhat Enterprise Linux AS Extras 4 Redhat Desktop Extras 4 Oracle JRockit R27.6.0 Nortel Networks Self-Service Speech Server 0 Nortel Networks Self-Service Peri Application 0 Nortel Networks Self-Service MPS 500 0 Nortel Networks Self-Service MPS 1000 0 Nortel Networks Self-Service CCXML 0 Nortel Networks Self Service VoiceXML 0 Nortel Networks MPS Speech Server 6.0 Nortel Networks MPS Manager 0 Nortel Networks MPS Developer 0 Nortel Networks MPS 3.0 Nortel Networks MPS 2.1 Nortel Networks MPS 1.0 Nortel Networks Enterprise VoIP TM-CS1000 Gentoo Linux BEA Systems JRockit 8.1 BEA Systems JRockit 8.0 BEA Systems JRockit 7.0 BEA Systems JRockit 3.1.5 BEA Systems JRockit 3.1.4 .1 BEA Systems JRockit 3.1.4 BEA Systems JRockit 3.1.3 BEA Systems JRockit 3.1.2 BEA Systems JRockit 3.1.1 BEA Systems JRockit 1.5 BEA Systems JRockit 1.4.2 07 BEA Systems JRockit 1.4.2 BEA Systems JRockit 1.3.1 20 BEA Systems JRockit R27.5.0 BEA Systems JRockit R27.3.1 BEA Systems JRockit 7.0 BEA Systems JRockit 6 BEA Systems JRockit 5.0 BEA Systems JRockit 1.5.0_04 BEA Systems JRockit 1.5.0_03 BEA Systems JRockit 1.4.2_08 BEA Systems JRockit 1.4.2_05 BEA Systems JRockit 1.4.2_04 BEA Systems JRockit 1.4.2 R4.5 Apple Mac OS X Server 10.5.5 Apple Mac OS X Server 10.5.4 Apple Mac OS X Server 10.5.3 Apple Mac OS X Server 10.5.2 Apple Mac OS X Server 10.5.1 Apple Mac OS X Server 10.5 Apple Mac OS X 10.5.5 Apple Mac OS X 10.5.4 Apple Mac OS X 10.5.3 Apple Mac OS X 10.5.2 Apple Mac OS X 10.5.1 Apple Mac OS X 10.5
Not Vulnerable:	VMWare VirtualCenter 2.5.Update 3 build 1 Sun JRE (Linux Production Release) 1.6 _07 Sun JDK (Linux Production Release) 1.6 _07

Sun Java Runtime Environment Multiple Security Vulnerabilities

A privilege-escalation issue and an information-disclosure issue affect multiple implementations of Java Runtime Environment (JRE).

Sun has released an advisory addressing these vulnerabilities in the following software:

JDK and JRE 6 Update 6 and earlier.

Sun Java Runtime Environment Multiple Security Vulnerabilities

These issues may not require specific exploit code and may be trivial to exploit.

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Sun Java Runtime Environment Multiple Security Vulnerabilities

Solution:
Vendor advisory and fixes are available. Please see the references for more information.


Oracle JRockit R27.6.0

• Oracle jrockit-jdk1.6.0_05-linux_ia32.tar.gz
  ftp://anonymous:dev2dev%40bea%[email protected]/pub/releases/securit y/jrockit-jdk1.6.0_05-linux_ia32.tar.gz


• Oracle jrockit-jdk1.6.0_05-linux_x86_64.tar.gz
  ftp://anonymous:dev2dev%40bea%[email protected]/pub/releases/securit y/jrockit-jdk1.6.0_05-linux_x86_64.tar.gz


• Oracle jrockit-jdk1.6.0_05-solaris_sparcv9.tar.gz
  ftp://anonymous:dev2dev%40bea%[email protected]/pub/releases/securit y/jrockit-jdk1.6.0_05-solaris_sparcv9.tar.gz


• Oracle jrockit-jdk1.6.0_05-windows_ia32.zip
  ftp://anonymous:dev2dev%40bea%[email protected]/pub/releases/securit y/jrockit-jdk1.6.0_05-windows_ia32.zip


• Oracle jrockit-jdk1.6.0_05-windows_x86_64.zip
  ftp://anonymous:dev2dev%40bea%[email protected]/pub/releases/securit y/jrockit-jdk1.6.0_05-windows_x86_64.zip

Apple Mac OS X 10.5.4

• Apple JavaForMacOSX10.5Update2.dmg
  Java for Mac OS X 10.5 Update 2
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=21277&cat= 59&platform=osx&method=sa/JavaForMacOSX10.5Update2.dmg

Apple Mac OS X Server 10.5.4

• Apple JavaForMacOSX10.5Update2.dmg
  Java for Mac OS X 10.5 Update 2
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=21277&cat= 59&platform=osx&method=sa/JavaForMacOSX10.5Update2.dmg

Apple Mac OS X Server 10.5.5

• Apple JavaForMacOSX10.5Update2.dmg
  Java for Mac OS X 10.5 Update 2
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=21277&cat= 59&platform=osx&method=sa/JavaForMacOSX10.5Update2.dmg

Apple Mac OS X 10.5.5

• Apple JavaForMacOSX10.5Update2.dmg
  Java for Mac OS X 10.5 Update 2
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=21277&cat= 59&platform=osx&method=sa/JavaForMacOSX10.5Update2.dmg

Sun Java Runtime Environment Multiple Security Vulnerabilities

References:

• JDK and JRE 6 Update 7 Downloads (Sun)
  
• Sun Alert: 238687 - Security Vulnerabilities in the Java Runtime Environment Scr (Sun)
  
• Sun Java Homepage (Sun Microsystems)
  
• 2008008988, Rev 2 - Nortel Response to Sun Java JDK / JRE Multiple Vulnerabiliti (Nortel Networks)
  
• Nortel Security Advisory 2008008988, Rev 1 (Nortel)
  
• RHSA-2008:0594-7 java-1.6.0-sun security update (Red Hat)
  
• Security Vulnerability in the Java Runtime Environment Scripting Language Suppor (Oracle)
  
• Security Vulnerability in the Java Runtime Environment Scripting Language Suppor (Oracle)