RHSA-2011:1380: Critical: java-1.6.0-openjdk security update

First published: Tue Oct 18 2011(Updated: )

These packages provide the OpenJDK 6 Java Runtime Environment and the<br>OpenJDK 6 Software Development Kit.<br>A flaw was found in the Java RMI (Remote Method Invocation) registry<br>implementation. A remote RMI client could use this flaw to execute<br>arbitrary code on the RMI server running the registry. (CVE-2011-3556)<br>A flaw was found in the Java RMI registry implementation. A remote RMI<br>client could use this flaw to execute code on the RMI server with<br>unrestricted privileges. (CVE-2011-3557)<br>A flaw was found in the IIOP (Internet Inter-Orb Protocol) deserialization<br>code. An untrusted Java application or applet running in a sandbox could<br>use this flaw to bypass sandbox restrictions by deserializing<br>specially-crafted input. (CVE-2011-3521)<br>It was found that the Java ScriptingEngine did not properly restrict the<br>privileges of sandboxed applications. An untrusted Java application or<br>applet running in a sandbox could use this flaw to bypass sandbox<br>restrictions. (CVE-2011-3544)<br>A flaw was found in the AWTKeyStroke implementation. An untrusted Java<br>application or applet running in a sandbox could use this flaw to bypass<br>sandbox restrictions. (CVE-2011-3548)<br>An integer overflow flaw, leading to a heap-based buffer overflow, was<br>found in the Java2D code used to perform transformations of graphic shapes<br>and images. An untrusted Java application or applet running in a sandbox<br>could use this flaw to bypass sandbox restrictions. (CVE-2011-3551)<br>An insufficient error checking flaw was found in the unpacker for JAR files<br>in pack200 format. A specially-crafted JAR file could use this flaw to<br>crash the Java Virtual Machine (JVM) or, possibly, execute arbitrary code<br>with JVM privileges. (CVE-2011-3554)<br>It was found that HttpsURLConnection did not perform SecurityManager checks<br>in the setSSLSocketFactory method. An untrusted Java application or applet<br>running in a sandbox could use this flaw to bypass connection restrictions<br>defined in the policy. (CVE-2011-3560)<br>A flaw was found in the way the SSL 3 and TLS 1.0 protocols used block<br>ciphers in cipher-block chaining (CBC) mode. An attacker able to perform a<br>chosen plain text attack against a connection mixing trusted and untrusted<br>data could use this flaw to recover portions of the trusted data sent over<br>the connection. (CVE-2011-3389)<br>Note: This update mitigates the CVE-2011-3389 issue by splitting the first<br>application data record byte to a separate SSL/TLS protocol record. This<br>mitigation may cause compatibility issues with some SSL/TLS implementations<br>and can be disabled using the jsse.enableCBCProtection boolean property.<br>This can be done on the command line by appending the flag<br>"-Djsse.enableCBCProtection=false" to the java command.<br>An information leak flaw was found in the InputStream.skip implementation.<br>An untrusted Java application or applet could possibly use this flaw to<br>obtain bytes skipped by other threads. (CVE-2011-3547)<br>A flaw was found in the Java HotSpot virtual machine. An untrusted Java<br>application or applet could use this flaw to disclose portions of the VM<br>memory, or cause it to crash. (CVE-2011-3558)<br>The Java API for XML Web Services (JAX-WS) implementation in OpenJDK was<br>configured to include the stack trace in error messages sent to clients. A<br>remote client could possibly use this flaw to obtain sensitive information.<br>(CVE-2011-3553)<br>It was found that Java applications running with SecurityManager<br>restrictions were allowed to use too many UDP sockets by default. If<br>multiple instances of a malicious application were started at the same<br>time, they could exhaust all available UDP sockets on the system.<br>(CVE-2011-3552)<br>This erratum also upgrades the OpenJDK package to IcedTea6 1.9.10. Refer to<br>the NEWS file, linked to in the References, for further information.<br>All users of java-1.6.0-openjdk are advised to upgrade to these updated<br>packages, which resolve these issues. All running instances of OpenJDK Java<br>must be restarted for the update to take effect.<br>

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/description
• agent/event
• agent/first-publish-date
• agent/last-modified-date
• agent/references
• agent/remedy
• agent/severity
• agent/softwarecombine
• agent/tags
• agent/title
• agent/type
• agent/weakness
• collector/redhat-errata
• anchor-id/RHSA-2011:1380
• package-manager/redhat