Sun Java SE Java Management Extensions (JMX) Unspecified Unauthorized Access Vulnerability
BID:30146
Info
Sun Java SE Java Management Extensions (JMX) Unspecified Unauthorized Access Vulnerability
| Bugtraq ID: | 30146 |
| Class: | Unknown |
| CVE: |
CVE-2008-3103 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 08 2008 12:00AM |
| Updated: | May 07 2015 05:07PM |
| Credit: | Sun |
| Vulnerable: |
VMWare VirtualCenter 2.0.2 VMWare VirtualCenter 2.5 Update 5 VMWare VirtualCenter 2.5 Update 2 VMWare VirtualCenter 2.5 Update 1 VMWare VirtualCenter 2.5 VMWare VirtualCenter 2.0.2 Update 5 VMWare VirtualCenter 2.0.2 Update 4 VMWare VirtualCenter 2.0.2 Update 3 VMWare VirtualCenter 2.0.2 Update 2 VMWare VirtualCenter 2.0.2 Update 1 VMWare ESX Server 3.0.3 VMWare ESX Server 3.0.2 VMWare ESX Server 3.0.1 VMWare ESX Server 3.5 SuSE SUSE Linux Enterprise SDK 9 SuSE SUSE Linux Enterprise SDK 10.SP1 SuSE SUSE Linux Enterprise SDK 10 SP2 SuSE SUSE Linux Enterprise SDK 10 Sun JRE (Linux Production Release) 1.6 _06 Sun JRE (Linux Production Release) 1.6 _05 Sun JRE (Linux Production Release) 1.6 _04 Sun JRE (Linux Production Release) 1.5 _15 Sun JRE (Linux Production Release) 1.5 _07 Sun JRE (Linux Production Release) 1.5 _06 Sun JRE (Linux Production Release) 1.6.0_03 Sun JRE (Linux Production Release) 1.6.0_02 Sun JRE (Linux Production Release) 1.6.0_01 Sun JRE (Linux Production Release) 1.5.0_14 Sun JRE (Linux Production Release) 1.5.0_13 Sun JRE (Linux Production Release) 1.5.0_12 Sun JRE (Linux Production Release) 1.5.0_11 Sun JRE (Linux Production Release) 1.5.0_10 Sun JRE (Linux Production Release) 1.5.0_09 Sun JRE (Linux Production Release) 1.5.0_08 Sun JDK (Linux Production Release) 1.6 _06 Sun JDK (Linux Production Release) 1.6 _05 Sun JDK (Linux Production Release) 1.6 _04 Sun JDK (Linux Production Release) 1.6 _01 Sun JDK (Linux Production Release) 1.6 Sun JDK (Linux Production Release) 1.5 0_10 Sun JDK (Linux Production Release) 1.5 _15 Sun JDK (Linux Production Release) 1.5 _14 Sun JDK (Linux Production Release) 1.5 _07 Sun JDK (Linux Production Release) 1.5 _06 Sun JDK (Linux Production Release) 1.5 _02 Sun JDK (Linux Production Release) 1.5 _01 Sun JDK (Linux Production Release) 1.5 .0_05 Sun JDK (Linux Production Release) 1.6.0_03 Sun JDK (Linux Production Release) 1.6.0_02 Sun JDK (Linux Production Release) 1.5.0_13 Sun JDK (Linux Production Release) 1.5.0.0_12 Sun JDK (Linux Production Release) 1.5.0.0_11 Sun JDK (Linux Production Release) 1.5.0.0_09 Sun JDK (Linux Production Release) 1.5.0.0_08 Sun JDK (Linux Production Release) 1.5.0.0_04 Sun JDK (Linux Production Release) 1.5.0.0_03 S.u.S.E. Open-Enterprise-Server 9.0 S.u.S.E. Novell Linux Desktop SDK 9.0 Redhat Red Hat Network Satellite (for RHEL 4) 5.1 Redhat Enterprise Linux WS Extras 4 Redhat Enterprise Linux Supplementary 5 server Redhat Enterprise Linux Extras 4 Redhat Enterprise Linux ES Extras 4 Redhat Enterprise Linux Desktop Supplementary 5 client Redhat Enterprise Linux AS Extras 4 Redhat Desktop Extras 4 Oracle JRockit R27.6.0 Nortel Networks Self-Service Speech Server 0 Nortel Networks Self-Service Peri Application 0 Nortel Networks Self-Service MPS 1000 0 Nortel Networks Self-Service MPS 100 0 Nortel Networks Self-Service CCXML 0 Nortel Networks Self Service VoiceXML 0 Nortel Networks MPS Speech Server 6.0 Nortel Networks MPS Manager 0 Nortel Networks MPS Developer 0 Nortel Networks MPS 3.0 Nortel Networks MPS 2.1 Nortel Networks MPS 1.0 Nortel Networks Enterprise VoIP TM-CS1000 IcedTea IcedTea 1.7 Gentoo Linux BEA Systems JRockit 8.1 BEA Systems JRockit 8.0 BEA Systems JRockit 7.0 BEA Systems JRockit 3.1.5 BEA Systems JRockit 3.1.4 .1 BEA Systems JRockit 3.1.4 BEA Systems JRockit 3.1.3 BEA Systems JRockit 3.1.2 BEA Systems JRockit 3.1.1 BEA Systems JRockit 1.5 BEA Systems JRockit 1.4.2 07 BEA Systems JRockit 1.4.2 BEA Systems JRockit 1.3.1 20 BEA Systems JRockit R27.5.0 BEA Systems JRockit R27.3.1 BEA Systems JRockit 7.0 BEA Systems JRockit 6 BEA Systems JRockit 5.0 BEA Systems JRockit 1.5.0_04 BEA Systems JRockit 1.5.0_03 BEA Systems JRockit 1.4.2_08 BEA Systems JRockit 1.4.2_05 BEA Systems JRockit 1.4.2_04 BEA Systems JRockit 1.4.2 R4.5 Apple Mac OS X Server 10.5.5 Apple Mac OS X Server 10.5.4 Apple Mac OS X Server 10.5.3 Apple Mac OS X Server 10.5.2 Apple Mac OS X Server 10.5.1 Apple Mac OS X Server 10.4.11 Apple Mac OS X Server 10.4.10 Apple Mac OS X Server 10.4.9 Apple Mac OS X Server 10.4.8 Apple Mac OS X Server 10.4.7 Apple Mac OS X Server 10.4.6 Apple Mac OS X Server 10.4.5 Apple Mac OS X Server 10.4.4 Apple Mac OS X Server 10.4.3 Apple Mac OS X Server 10.4.2 Apple Mac OS X Server 10.4.1 Apple Mac OS X Server 10.4 Apple Mac OS X Server 10.5 Apple Mac OS X 10.5.5 Apple Mac OS X 10.5.4 Apple Mac OS X 10.5.3 Apple Mac OS X 10.5.2 Apple Mac OS X 10.5.1 Apple Mac OS X 10.4.11 Apple Mac OS X 10.4.10 Apple Mac OS X 10.4.9 Apple Mac OS X 10.4.8 Apple Mac OS X 10.4.7 Apple Mac OS X 10.4.6 Apple Mac OS X 10.4.5 Apple Mac OS X 10.4.4 Apple Mac OS X 10.4.3 Apple Mac OS X 10.4.2 Apple Mac OS X 10.4.1 Apple Mac OS X 10.4 Apple Mac OS X 10.5 |
| Not Vulnerable: |
VMWare VirtualCenter 2.5.Update 3 build 1 Sun JRE (Linux Production Release) 1.6 _07 Sun JRE (Linux Production Release) 1.5 _16 Sun JDK (Linux Production Release) 1.6 _07 Sun JDK (Linux Production Release) 1.5.0_16 |
Discussion
Sun Java SE Java Management Extensions (JMX) Unspecified Unauthorized Access Vulnerability
JMX is prone to an unspecified unauthorized-access vulnerability.
The vulnerability allows a JMX client to perform unauthorized actions on a computer running JMX with local monitoring enabled.
The issue affects the following versions for Windows, Solaris, and Linux:
JDK and JRE 6 Update 6 and earlier
JDK and JRE 5.0 Update 15 and earlier
JMX is prone to an unspecified unauthorized-access vulnerability.
The vulnerability allows a JMX client to perform unauthorized actions on a computer running JMX with local monitoring enabled.
The issue affects the following versions for Windows, Solaris, and Linux:
JDK and JRE 6 Update 6 and earlier
JDK and JRE 5.0 Update 15 and earlier
Exploit / POC
Sun Java SE Java Management Extensions (JMX) Unspecified Unauthorized Access Vulnerability
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
Sun Java SE Java Management Extensions (JMX) Unspecified Unauthorized Access Vulnerability
Solution:
Updates are available. Please see the references for more information.
Oracle JRockit R27.6.0
Apple Mac OS X 10.4.11
Apple Mac OS X Server 10.4.11
Apple Mac OS X 10.5.4
Apple Mac OS X Server 10.5.5
Solution:
Updates are available. Please see the references for more information.
Oracle JRockit R27.6.0
-
Oracle JRockit 5.0 R27.6.0 JDK Linux (Intel Itanium - 64-bit)
ftp://anonymous:dev2dev%40bea%[email protected]/pub/releases/securit y/jrockit-jdk1.5.0_15-linux_ia64.tar.gz -
Oracle JRockit 5.0 R27.6.0 JDK Linux (x86 - 32 bit)
ftp://anonymous:dev2dev%40bea%[email protected]/pub/releases/securit y/jrockit-jdk1.5.0_15-linux_ia32.tar.gz -
Oracle JRockit 5.0 R27.6.0 JDK Linux (x86 �?? 64 bit, Intel EM64T & AMD64 - 64 bit)
ftp://anonymous:dev2dev%40bea%[email protected]/pub/releases/securit y/jrockit-jdk1.5.0_15-linux_x86_64.tar.gz -
Oracle JRockit 5.0 R27.6.0 JDK Microsoft Windows (Intel Itanium - 64 bit)
ftp://anonymous:dev2dev%40bea%[email protected]/pub/releases/securit y/jrockit-jdk1.5.0_15-windows_ia64.zip -
Oracle JRockit 5.0 R27.6.0 JDK Microsoft Windows (x86 - 32 bit)
ftp://anonymous:dev2dev%40bea%[email protected]/pub/releases/securit y/jrockit-jdk1.5.0_15-windows_ia32.zip -
Oracle JRockit 5.0 R27.6.0 JDK Microsoft Windows (x86 �?? 64 bit, Intel EM64T & AMD64 - 64 bit)
ftp://anonymous:dev2dev%40bea%[email protected]/pub/releases/securit y/jrockit-jdk1.5.0_15-windows_x86_64.zip -
Oracle JRockit 5.0 R27.6.0 JDK Solaris (SPARC - 64-bit)
ftp://anonymous:dev2dev%40bea%[email protected]/pub/releases/securit y/jrockit-jdk1.5.0_15-solaris_sparcv9.tar.gz -
Oracle JRockit 6 R27.6.0 JDK Linux (x86 - 32 bit)
ftp://anonymous:dev2dev%40bea%[email protected]/pub/releases/securit y/jrockit-jdk1.6.0_05-linux_ia32.tar.gz -
Oracle JRockit 6 R27.6.0 JDK Linux (x86 �?? 64 bit, Intel EM64T & AMD64 - 64 bit)
ftp://anonymous:dev2dev%40bea%[email protected]/pub/releases/securit y/jrockit-jdk1.6.0_05-linux_x86_64.tar.gz -
Oracle JRockit 6 R27.6.0 JDK Microsoft Windows (x86 - 32 bit)
ftp://anonymous:dev2dev%40bea%[email protected]/pub/releases/securit y/jrockit-jdk1.6.0_05-windows_ia32.zip -
Oracle JRockit 6 R27.6.0 JDK Microsoft Windows (x86 �?? 64 bit, Intel EM64T & AMD64 - 64 bit)
ftp://anonymous:dev2dev%40bea%[email protected]/pub/releases/securit y/jrockit-jdk1.6.0_05-windows_x86_64.zip -
Oracle JRockit 6 R27.6.0 JDK Solaris (SPARC - 64-bit)
ftp://anonymous:dev2dev%40bea%[email protected]/pub/releases/securit y/jrockit-jdk1.6.0_05-solaris_sparcv9.tar.gz
Apple Mac OS X 10.4.11
-
Apple JavaForMacOSX10.4Release7.dmg
Java for Mac OS X 10.4, Release 7
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=21278&cat= 59&platform=osx&method=sa/JavaForMacOSX10.4Release7.dmg
Apple Mac OS X Server 10.4.11
-
Apple JavaForMacOSX10.4Release7.dmg
Java for Mac OS X 10.4, Release 7
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=21278&cat= 59&platform=osx&method=sa/JavaForMacOSX10.4Release7.dmg
Apple Mac OS X 10.5.4
-
Apple JavaForMacOSX10.5Update2.dmg
Java for Mac OS X 10.5 Update 2
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=21277&cat= 59&platform=osx&method=sa/JavaForMacOSX10.5Update2.dmg
Apple Mac OS X Server 10.5.5
-
Apple JavaForMacOSX10.5Update2.dmg
Java for Mac OS X 10.5 Update 2
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=21277&cat= 59&platform=osx&method=sa/JavaForMacOSX10.5Update2.dmg
References
Sun Java SE Java Management Extensions (JMX) Unspecified Unauthorized Access Vulnerability
References:
References:
- IcedTea Homepage (IcedTea)
- Java Management Extensions (Sun)
- 2008008988, Rev 2 - Nortel Response to Sun Java JDK / JRE Multiple Vulnerabiliti (Nortel Networks)
- 238965 - Security Vulnerability in Java Management Extensions (JMX) (Sun)
- RHSA-2008:0594-7 java-1.6.0-sun security update (Red Hat)
- RHSA-2008:0595-3 java-1.5.0-sun security update (Red Hat)
- RHSA-2008:0636-4 Red Hat Network Satellite Server Sun Java Runtime security upda (Red Hat)
- Security Vulnerability in Java Management Extensions (JMX) (Oracle)