The Oracle Linux 5 / 6 / 7 host has multiple vulnerabilities in java-1.6.0-openjdk (ELSA-2015-0085
Reporter | Title | Published | Views | Family All 199 |
---|---|---|---|---|
![]() | RedHat Update for java-1.6.0-openjdk RHSA-2015:0085-01 | 27 Jan 201500:00 | – | openvas |
![]() | Amazon Linux: Security Advisory (ALAS-2015-480) | 8 Sep 201500:00 | – | openvas |
![]() | Oracle: Security Advisory (ELSA-2015-0068) | 6 Oct 201500:00 | – | openvas |
![]() | Oracle: Security Advisory (ELSA-2015-0085) | 6 Oct 201500:00 | – | openvas |
![]() | CentOS Update for java CESA-2015:0067 centos6 | 23 Jan 201500:00 | – | openvas |
![]() | CentOS Update for java CESA-2015:0085 centos5 | 27 Jan 201500:00 | – | openvas |
![]() | RedHat Update for java-1.7.0-openjdk RHSA-2015:0067-01 | 23 Jan 201500:00 | – | openvas |
![]() | CentOS Update for java CESA-2015:0068 centos5 | 23 Jan 201500:00 | – | openvas |
![]() | CentOS Update for java CESA-2015:0067 centos7 | 23 Jan 201500:00 | – | openvas |
![]() | CentOS Update for java CESA-2015:0085 centos7 | 27 Jan 201500:00 | – | openvas |
#%NASL_MIN_LEVEL 70300
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Red Hat Security Advisory RHSA-2015:0085 and
# Oracle Linux Security Advisory ELSA-2015-0085 respectively.
#
include('deprecated_nasl_level.inc');
include('compat.inc');
if (description)
{
script_id(81011);
script_version("1.20");
script_set_attribute(attribute:"plugin_modification_date", value:"2024/10/22");
script_cve_id(
"CVE-2014-3566",
"CVE-2014-6585",
"CVE-2014-6587",
"CVE-2014-6591",
"CVE-2014-6593",
"CVE-2014-6601",
"CVE-2015-0383",
"CVE-2015-0395",
"CVE-2015-0407",
"CVE-2015-0408",
"CVE-2015-0410",
"CVE-2015-0412"
);
script_bugtraq_id(
70574,
72132,
72136,
72140,
72142,
72155,
72162,
72165,
72168,
72169,
72173,
72175
);
script_xref(name:"RHSA", value:"2015:0085");
script_name(english:"Oracle Linux 5 / 6 / 7 : java-1.6.0-openjdk (ELSA-2015-0085)");
script_set_attribute(attribute:"synopsis", value:
"The remote Oracle Linux host is missing one or more security updates.");
script_set_attribute(attribute:"description", value:
"The remote Oracle Linux 5 / 6 / 7 host has packages installed that are affected by multiple vulnerabilities as
referenced in the ELSA-2015-0085 advisory.
[1:1.6.0.33-1.13.6.1.0.1.el5_11]
- Add oracle-enterprise.patch
[1:1.6.0.34-1.13.6.1]
- Update to latest 1.13.6 release candidate tarball
- Fixes a number of issues found with b34:
- * OJ51, PR2187: Sync patch for 4873188 with 7 version
- * OJ52, PR2185: Application of 6786276 introduces compatibility issue
- * OJ53, PR2181: strict-aliasing warnings issued on PPC32
- * OJ54, PR2182: 6911104 reintroduces test fragment removed in existing 6964018 backport
- * S6730740, PR2186: Fix for 6729881 has apparently broken several 64 bit tests: 'Bad address'
- * S7031830, PR2183: bad_record_mac failure on TLSv1.2 enabled connection with SSLEngine
- Also includes PR2180, so patch dropped from RPM.
- Resolves: rhbz#1180289
[1:1.6.0.34-1.13.6.0]
- Apply pr2180.patch to work around issue with older autotools.
- Resolves: rhbz#1180289
[1:1.6.0.34-1.13.6.0]
- Update to IcedTea 1.13.6
- Apply pr2125.patch in generate_rhel_zip.sh to remove unwanted elliptic curves.
- Add no_pr2125.patch to avoid repeating the procedure during the IcedTea build.
- Avoid duplicating the OpenJDK build version by making more use of %{openjdkver}.
- Add US_export_policy.jar and local_policy.jar to packages.
- Resolves: rhbz#1180289
Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
script_set_attribute(attribute:"see_also", value:"https://linux.oracle.com/errata/ELSA-2015-0085.html");
script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N");
script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2015-0408");
script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2014-3566");
script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
script_set_attribute(attribute:"exploit_available", value:"true");
script_set_attribute(attribute:"in_the_news", value:"true");
script_set_attribute(attribute:"vuln_publication_date", value:"2014/10/15");
script_set_attribute(attribute:"patch_publication_date", value:"2015/01/26");
script_set_attribute(attribute:"plugin_publication_date", value:"2015/01/27");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:java-1.6.0-openjdk");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:java-1.6.0-openjdk-demo");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:java-1.6.0-openjdk-devel");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:java-1.6.0-openjdk-javadoc");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:java-1.6.0-openjdk-src");
script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:5");
script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:6");
script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:7");
script_set_attribute(attribute:"generated_plugin", value:"current");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"Oracle Linux Local Security Checks");
script_copyright(english:"This script is Copyright (C) 2015-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("ssh_get_info.nasl");
script_require_keys("Host/local_checks_enabled", "Host/OracleLinux", "Host/RedHat/release", "Host/RedHat/rpm-list");
exit(0);
}
include('rpm.inc');
if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item('Host/OracleLinux')) audit(AUDIT_OS_NOT, 'Oracle Linux');
var os_release = get_kb_item("Host/RedHat/release");
if (isnull(os_release) || !pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux)", string:os_release)) audit(AUDIT_OS_NOT, 'Oracle Linux');
var os_ver = pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\.[0-9]+)?)", string:os_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Oracle Linux');
os_ver = os_ver[1];
if (! preg(pattern:"^(5|6|7)([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, 'Oracle Linux 5 / 6 / 7', 'Oracle Linux ' + os_ver);
if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Oracle Linux', cpu);
var pkgs = [
{'reference':'java-1.6.0-openjdk-1.6.0.34-1.13.6.1.0.1.el5_11', 'cpu':'i386', 'release':'5', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
{'reference':'java-1.6.0-openjdk-demo-1.6.0.34-1.13.6.1.0.1.el5_11', 'cpu':'i386', 'release':'5', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
{'reference':'java-1.6.0-openjdk-devel-1.6.0.34-1.13.6.1.0.1.el5_11', 'cpu':'i386', 'release':'5', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
{'reference':'java-1.6.0-openjdk-javadoc-1.6.0.34-1.13.6.1.0.1.el5_11', 'cpu':'i386', 'release':'5', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
{'reference':'java-1.6.0-openjdk-src-1.6.0.34-1.13.6.1.0.1.el5_11', 'cpu':'i386', 'release':'5', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
{'reference':'java-1.6.0-openjdk-1.6.0.34-1.13.6.1.0.1.el5_11', 'cpu':'x86_64', 'release':'5', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
{'reference':'java-1.6.0-openjdk-demo-1.6.0.34-1.13.6.1.0.1.el5_11', 'cpu':'x86_64', 'release':'5', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
{'reference':'java-1.6.0-openjdk-devel-1.6.0.34-1.13.6.1.0.1.el5_11', 'cpu':'x86_64', 'release':'5', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
{'reference':'java-1.6.0-openjdk-javadoc-1.6.0.34-1.13.6.1.0.1.el5_11', 'cpu':'x86_64', 'release':'5', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
{'reference':'java-1.6.0-openjdk-src-1.6.0.34-1.13.6.1.0.1.el5_11', 'cpu':'x86_64', 'release':'5', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
{'reference':'java-1.6.0-openjdk-1.6.0.34-1.13.6.1.el6_6', 'cpu':'i686', 'release':'6', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
{'reference':'java-1.6.0-openjdk-demo-1.6.0.34-1.13.6.1.el6_6', 'cpu':'i686', 'release':'6', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
{'reference':'java-1.6.0-openjdk-devel-1.6.0.34-1.13.6.1.el6_6', 'cpu':'i686', 'release':'6', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
{'reference':'java-1.6.0-openjdk-javadoc-1.6.0.34-1.13.6.1.el6_6', 'cpu':'i686', 'release':'6', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
{'reference':'java-1.6.0-openjdk-src-1.6.0.34-1.13.6.1.el6_6', 'cpu':'i686', 'release':'6', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
{'reference':'java-1.6.0-openjdk-1.6.0.34-1.13.6.1.el6_6', 'cpu':'x86_64', 'release':'6', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
{'reference':'java-1.6.0-openjdk-demo-1.6.0.34-1.13.6.1.el6_6', 'cpu':'x86_64', 'release':'6', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
{'reference':'java-1.6.0-openjdk-devel-1.6.0.34-1.13.6.1.el6_6', 'cpu':'x86_64', 'release':'6', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
{'reference':'java-1.6.0-openjdk-javadoc-1.6.0.34-1.13.6.1.el6_6', 'cpu':'x86_64', 'release':'6', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
{'reference':'java-1.6.0-openjdk-src-1.6.0.34-1.13.6.1.el6_6', 'cpu':'x86_64', 'release':'6', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
{'reference':'java-1.6.0-openjdk-1.6.0.34-1.13.6.1.el7_0', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
{'reference':'java-1.6.0-openjdk-demo-1.6.0.34-1.13.6.1.el7_0', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
{'reference':'java-1.6.0-openjdk-devel-1.6.0.34-1.13.6.1.el7_0', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
{'reference':'java-1.6.0-openjdk-javadoc-1.6.0.34-1.13.6.1.el7_0', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
{'reference':'java-1.6.0-openjdk-src-1.6.0.34-1.13.6.1.el7_0', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'}
];
var flag = 0;
foreach var package_array ( pkgs ) {
var reference = NULL;
var _release = NULL;
var sp = NULL;
var _cpu = NULL;
var el_string = NULL;
var rpm_spec_vers_cmp = NULL;
var epoch = NULL;
var allowmaj = NULL;
var exists_check = NULL;
if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
if (!empty_or_null(package_array['release'])) _release = 'EL' + package_array['release'];
if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];
if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];
if (reference && _release) {
if (exists_check) {
if (rpm_exists(release:_release, rpm:exists_check) && rpm_check(release:_release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;
} else {
if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;
}
}
}
if (flag)
{
security_report_v4(
port : 0,
severity : SECURITY_HOLE,
extra : rpm_report_get()
);
exit(0);
}
else
{
var tested = pkg_tests_get();
if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'java-1.6.0-openjdk / java-1.6.0-openjdk-demo / java-1.6.0-openjdk-devel / etc');
}
Transform Your Security Services
Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.
Book a live demo