RHSA-2010:0408: Moderate: java-1.4.2-ibm security update
The IBM 1.4.2 SR13-FP4 Java release includes the IBM Java 2 RuntimeEnvironment and the IBM Java 2 Software Development Kit.This update fixes various vulnerabilities in the IBM Java 2 RuntimeEnvironment and the IBM Java 2 Software Development Kit. Thesevulnerabilities are summarized on the IBM "Security alerts" page listed inthe References section. (CVE-2009-3555, CVE-2009-3867, CVE-2009-3869,CVE-2009-3871, CVE-2009-3874, CVE-2009-3875)For the CVE-2009-3555 issue, this update disables renegotiation in thenon-default IBM JSSE2 provider for the Java Secure Socket Extension (JSSE)component. The default JSSE provider is not updated with this fix. Refer tothe IBMJSSE2 Provider Reference Guide, linked to in the References, forinstructions on how to configure the IBM Java 2 Runtime Environment to usethe JSSE2 provider by default.When using the JSSE2 provider, unsafe renegotiation can be re-enabled usingthe com.ibm.jsse2.renegotiate property. Refer to the followingKnowledgebase article for details:http://kbase.redhat.com/faq/docs/DOC-20491 Warning: Do not install these java-1.4.2-ibm packages for SAP alongside thejava-1.4.2-ibm packages from the Red Hat Enterprise Linux Extras orSupplementary channels on the Red Hat Network. Doing so could cause yoursystem to fail to update cleanly, among other possible problems.All users of java-1.4.2-ibm for Red Hat Enterprise Linux 4 and 5 for SAPare advised to upgrade to these updated packages, which contain the IBM1.4.2 SR13-FP4 Java release. All running instances of IBM Java must berestarted for this update to take effect.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2010:0408?
RHSA-2010:0408 is rated as critical due to several vulnerabilities in the IBM Java environment.
How do I fix RHSA-2010:0408?
To fix RHSA-2010:0408, you need to update the affected IBM Java packages to the latest version provided by Red Hat.
Which packages are affected by RHSA-2010:0408?
Affected packages for RHSA-2010:0408 include java, java-demo, java-devel, java-javacomm, and java-src versions up to 1.4.2-ibm-1.4.2.13.4.sap-1jpp.1.el5.
What vulnerabilities are addressed in RHSA-2010:0408?
RHSA-2010:0408 addresses multiple vulnerabilities in the IBM Java 2 Runtime Environment and Software Development Kit that could lead to denial of service and arbitrary code execution.
Is RHSA-2010:0408 applicable to all systems?
RHSA-2010:0408 is specific to Red Hat Enterprise Linux environments running the affected versions of IBM Java.