Test Kennung:	1.3.6.1.4.1.25623.1.1.2.2017.1028
Kategorie:	Huawei EulerOS Local Security Checks
Titel:	Huawei EulerOS: Security Advisory for java-1.7.0-openjdk (EulerOS-SA-2017-1028)
Zusammenfassung:	The remote host is missing an update for the Huawei EulerOS 'java-1.7.0-openjdk' package(s) announced via the EulerOS-SA-2017-1028 advisory.
Beschreibung:	Summary: The remote host is missing an update for the Huawei EulerOS 'java-1.7.0-openjdk' package(s) announced via the EulerOS-SA-2017-1028 advisory. Vulnerability Insight: It was discovered that the RMI registry and DCG implementations in the RMI component of OpenJDK performed deserialization of untrusted inputs. A remote attacker could possibly use this flaw to execute arbitrary code with the privileges of RMI registry or a Java RMI application. (CVE-2017-3241) Multiple flaws were discovered in the Libraries and Hotspot components in OpenJDK. An untrusted Java application or applet could use these flaws to completely bypass Java sandbox restrictions. (CVE-2017-3272, CVE-2017-3289) A covert timing channel flaw was found in the DSA implementation in the Libraries component of OpenJDK. A remote attacker could possibly use this flaw to extract certain information about the used key via a timing side channel. (CVE-2016-5548) It was discovered that the Libraries component of OpenJDK accepted ECSDA signatures using non-canonical DER encoding. This could cause a Java application to accept signature in an incorrect format not accepted by other cryptographic tools. (CVE-2016-5546) It was discovered that the 2D component of OpenJDK performed parsing of iTXt and zTXt PNG image chunks even when configured to ignore metadata. An attacker able to make a Java application parse a specially crafted PNG image could cause the application to consume an excessive amount of memory. (CVE-2017-3253) It was discovered that the Libraries component of OpenJDK did not validate the length of the object identifier read from the DER input before allocating memory to store the OID. An attacker able to make a Java application decode a specially crafted DER input could cause the application to consume an excessive amount of memory. (CVE-2016-5547) It was discovered that the JAAS component of OpenJDK did not use the correct way to extract user DN from the result of the user search LDAP query. A specially crafted user LDAP entry could cause the application to use an incorrect DN. (CVE-2017-3252) It was discovered that the Networking component of OpenJDK failed to properly parse user info from the URL. A remote attacker could cause a Java application to incorrectly parse an attacker supplied URL and interpret it differently from other applications processing the same URL. (CVE-2016-5552) Multiple flaws were found in the Networking components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2017-3261, CVE-2017-3231) A flaw was found in the way the DES/3DES cipher was used as part of the TLS/SSL protocol. A man-in-the-middle attacker could use this flaw to recover some plaintext data by capturing large amounts of encrypted traffic between TLS/SSL server and client if the communication used a DES/3DES based ciphersuite. (CVE-2016-2183) Affected Software/OS: 'java-1.7.0-openjdk' package(s) on Huawei EulerOS V2.0SP2. Solution: Please install the updated package(s). CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Querverweis:	Common Vulnerability Exposure (CVE) ID: CVE-2016-5546 BugTraq ID: 95506 http://www.securityfocus.com/bid/95506 Debian Security Information: DSA-3782 (Google Search) http://www.debian.org/security/2017/dsa-3782 https://security.gentoo.org/glsa/201701-65 https://security.gentoo.org/glsa/201707-01 RedHat Security Advisories: RHSA-2017:0175 http://rhn.redhat.com/errata/RHSA-2017-0175.html RedHat Security Advisories: RHSA-2017:0176 http://rhn.redhat.com/errata/RHSA-2017-0176.html RedHat Security Advisories: RHSA-2017:0177 http://rhn.redhat.com/errata/RHSA-2017-0177.html RedHat Security Advisories: RHSA-2017:0180 http://rhn.redhat.com/errata/RHSA-2017-0180.html RedHat Security Advisories: RHSA-2017:0263 http://rhn.redhat.com/errata/RHSA-2017-0263.html RedHat Security Advisories: RHSA-2017:0269 http://rhn.redhat.com/errata/RHSA-2017-0269.html RedHat Security Advisories: RHSA-2017:0336 http://rhn.redhat.com/errata/RHSA-2017-0336.html RedHat Security Advisories: RHSA-2017:0337 http://rhn.redhat.com/errata/RHSA-2017-0337.html RedHat Security Advisories: RHSA-2017:0338 http://rhn.redhat.com/errata/RHSA-2017-0338.html RedHat Security Advisories: RHSA-2017:1216 https://access.redhat.com/errata/RHSA-2017:1216 http://www.securitytracker.com/id/1037637 Common Vulnerability Exposure (CVE) ID: CVE-2016-5547 BugTraq ID: 95521 http://www.securityfocus.com/bid/95521 Common Vulnerability Exposure (CVE) ID: CVE-2016-5548 BugTraq ID: 95559 http://www.securityfocus.com/bid/95559 Common Vulnerability Exposure (CVE) ID: CVE-2016-5552 BugTraq ID: 95512 http://www.securityfocus.com/bid/95512 http://www.securitytracker.com/id/1037798 Common Vulnerability Exposure (CVE) ID: CVE-2017-3231 BugTraq ID: 95563 http://www.securityfocus.com/bid/95563 Common Vulnerability Exposure (CVE) ID: CVE-2017-3241 BugTraq ID: 95488 http://www.securityfocus.com/bid/95488 https://www.exploit-db.com/exploits/41145/ https://erpscan.io/advisories/erpscan-17-006-oracle-openjdk-java-serialization-dos-vulnerability/ Common Vulnerability Exposure (CVE) ID: CVE-2017-3252 BugTraq ID: 95509 http://www.securityfocus.com/bid/95509 Common Vulnerability Exposure (CVE) ID: CVE-2017-3253 BugTraq ID: 95498 http://www.securityfocus.com/bid/95498 Common Vulnerability Exposure (CVE) ID: CVE-2017-3261 BugTraq ID: 95566 http://www.securityfocus.com/bid/95566 Common Vulnerability Exposure (CVE) ID: CVE-2017-3272 BugTraq ID: 95533 http://www.securityfocus.com/bid/95533 Common Vulnerability Exposure (CVE) ID: CVE-2017-3289 BugTraq ID: 95525 http://www.securityfocus.com/bid/95525
Copyright	Copyright (C) 2020 Greenbone Networks GmbH

Dies ist nur einer von 99761 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.