RHSA-2010:0155: Moderate: java-1.4.2-ibm security and bug fix update

The IBM 1.4.2 SR13-FP4 Java release includes the IBM Java 2 RuntimeEnvironment and the IBM Java 2 Software Development Kit.A flaw was found in the way the TLS/SSL (Transport Layer Security/SecureSockets Layer) protocols handle session renegotiation. A man-in-the-middleattacker could use this flaw to prefix arbitrary plain text to a client'ssession (for example, an HTTPS connection to a website). This could forcethe server to process an attacker's request as if authenticated using thevictim's credentials. (CVE-2009-3555)This update disables renegotiation in the non-default IBM JSSE2 providerfor the Java Secure Socket Extension (JSSE) component. The default JSSEprovider is not updated with this fix. Refer to the IBMJSSE2 ProviderReference Guide, linked to in the References, for instructions on how toconfigure the IBM Java 2 Runtime Environment to use the JSSE2 provider bydefault.When using the JSSE2 provider, unsafe renegotiation can be re-enabled usingthe com.ibm.jsse2.renegotiate property. Refer to the followingKnowledgebase article for details:http://kbase.redhat.com/faq/docs/DOC-20491 This update also fixes the following bug: the libjaasauth.so file was missing from the java-1.4.2-ibm packages for the Intel Itanium architecture (.ia64.rpm). This update adds the file tothe packages for the Itanium architecture, which resolves this issue.(BZ#572577)All users of java-1.4.2-ibm are advised to upgrade to these updatedpackages, which contain the IBM 1.4.2 SR13-FP4 Java release. All runninginstances of IBM Java must be restarted for this update to take effect.