The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several components and third-party libraries :

  - Java Runtime Environment (JRE)
  - Network File Copy (NFC) Protocol
  - OpenSSL

Multiple improper permission check issues were discovered in the Beans, Swing, and JMX components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. (CVE-2012-5086, CVE-2012-5084, CVE-2012-5089)

Multiple improper permission check issues were discovered in the Scripting, JMX, Concurrency, Libraries, and Security components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2012-5068, CVE-2012-5071, CVE-2012-5069, CVE-2012-5073, CVE-2012-5072)

It was discovered that java.util.ServiceLoader could create an instance of an incompatible class while performing provider lookup. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. (CVE-2012-5079)

It was discovered that the Java Secure Socket Extension (JSSE) SSL/TLS implementation did not properly handle handshake records containing an overly large data length value. An unauthenticated, remote attacker could possibly use this flaw to cause an SSL/TLS server to terminate with an exception. (CVE-2012-5081)

It was discovered that the JMX component in OpenJDK could perform certain actions in an insecure manner. An untrusted Java application or applet could possibly use this flaw to disclose sensitive information. (CVE-2012-5075)

A bug in the Java HotSpot Virtual Machine optimization code could cause it to not perform array initialization in certain cases. An untrusted Java application or applet could use this flaw to disclose portions of the virtual machine's memory. (CVE-2012-4416)

It was discovered that the SecureRandom class did not properly protect against the creation of multiple seeders. An untrusted Java application or applet could possibly use this flaw to disclose sensitive information. (CVE-2012-5077)

It was discovered that the java.io.FilePermission class exposed the hash code of the canonicalized path name. An untrusted Java application or applet could possibly use this flaw to determine certain system paths, such as the current working directory.
(CVE-2012-3216)

This update disables Gopher protocol support in the java.net package by default. Gopher support can be enabled by setting the newly introduced property, 'jdk.net.registerGopherProtocol', to true.
(CVE-2012-5085)

Note: If the web browser plug-in provided by the icedtea-web package was installed, the issues exposed via Java applets could have been exploited without user interaction if a user visited a malicious website.

This erratum also upgrades the OpenJDK package to IcedTea6 1.11.5.

All running instances of OpenJDK Java must be restarted for the update to take effect.

The remote MiracleLinux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2012-967:03 advisory.

    The OpenJDK runtime environment.
    Security issues fixed with this release:
     CVE-2012-3216     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and     earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier allows remote     attackers to affect confidentiality via unknown vectors related to Libraries.
     CVE-2012-4416     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and     earlier, and 6 Update 35 and earlier, allows remote attackers to affect confidentiality and integrity via     unknown vectors related to Hotspot.
     CVE-2012-5068     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and     earlier, and 6 Update 35 and earlier, allows remote attackers to affect confidentiality, integrity, and     availability via unknown vectors related to Libraries.
     CVE-2012-5069     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and     earlier, 6 Update 35 and earlier, and 5.0 Update 36 and earlier allows remote attackers to affect     confidentiality and integrity via unknown vectors related to Concurrency.
     CVE-2012-5070     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and     earlier allows remote attackers to affect confidentiality, related to JMX.
     CVE-2012-5071     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and     earlier, 6 Update 35 and earlier, and 5.0 Update 36 and earlier allows remote attackers to affect     confidentiality and integrity, related to JMX.
     CVE-2012-5072     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and     earlier, and 6 Update 35 and earlier, allows remote attackers to affect confidentiality via unknown     vectors related to Security.
     CVE-2012-5073     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and     earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier allows remote     attackers to affect integrity via unknown vectors related to Libraries.
     CVE-2012-5074     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and     earlier allows remote attackers to affect confidentiality and integrity, related to JAX-WS.
     CVE-2012-5075     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and     earlier, 6 Update 35 and earlier, and 5.0 Update 36 and earlier allows remote attackers to affect     confidentiality, related to JMX.
     CVE-2012-5076     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and     earlier allows remote attackers to affect confidentiality, integrity, and availability, related to JAX-WS.
     CVE-2012-5077     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and     earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier allows remote     attackers to affect confidentiality via unknown vectors related to Security.
     CVE-2012-5079     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and     earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier allows remote     attackers to affect integrity via unknown vectors related to Libraries.
     CVE-2012-5081     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and     earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier allows remote     attackers to affect availability, related to JSSE.
     CVE-2012-5084     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and     earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier allows remote     attackers to affect confidentiality, integrity, and availability via unknown vectors related to Swing.
     CVE-2012-5085     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and     earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier allows remote     authenticated users to have an unspecified impact via unknown vectors related to Networking. NOTE: the     Oracle CPU states that this issue has a 0.0 CVSS score. If so, then this is not a vulnerability and this     issue should not be included in CVE.
     CVE-2012-5086     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and     earlier, and 6 Update 35 and earlier, allows remote attackers to affect confidentiality, integrity, and     availability via unknown vectors related to Beans.
     CVE-2012-5087     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and     earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors     related to Beans.
     CVE-2012-5088     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and     earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors     related to Libraries.
     CVE-2012-5089     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and     earlier, 6 Update 35 and earlier, and 5.0 Update 36 and earlier allows remote attackers to affect     confidentiality, integrity, and availability, related to JMX.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-1386 advisory.

    [1.7.0.9-2.3.3.0.1.el6_3.1]
    - Update DISTRO_NAME in specfile

    [1.7.0.9-2.3.3.el6.1]
    - Changed permissions of sa-jdi.jar to correct 644
    - Resolves: rhbz#865050

    [1.7.0.9-2.3.3.el6]
    - Updated to 2.3.3
    - Updated java-1.7.0-openjdk-java-access-bridge-security.patch
    - Resolves rhbz#s 856124, 865346, 865348, 865350, 865352, 865354, 865357,       865359, 865363, 865365, 865370, 865428, 865471, 865434, 865511, 865514,       865519, 865531, 865541, 865568

    [1.7.0.5-2.3.2.el6.1]
    - Cleanup before security release
    - Updated to latest IcedTea7-forest 2.3
    - Resolves: rhbz#852299

    [1.7.0.5-2.2.1.1.el6.4]
    - Cleanup before security release
    - Removed patches:
       patch 1001 sec-webrevs-openjdk7-29_aug_2012-7162473.patch        patch 1002 sec-webrevs-openjdk7-29_aug_2012-7162476.patch        patch 1003 sec-webrevs-openjdk7-29_aug_2012-7163201.patch        patch 1004 sec-webrevs-openjdk7-29_aug_2012-7194567.patch        patch 1005 sec-webrevs-openjdk7-29_aug_2012-78e01a6ca8d3.patch
    - Resolves: rhbz#852299

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

java-1_7_0-opendjk was updated to icedtea-2.3.3 (bnc#785814)

  - Security fixes

  - S6631398, CVE-2012-3216: FilePermission improved path     checking

  - S7093490: adjust package access in rmiregistry

  - S7143535, CVE-2012-5068: ScriptEngine corrected     permissions

  - S7158796, CVE-2012-5070: Tighten properties checking in     EnvHelp

  - S7158807: Revise stack management with volatile call     sites

  - S7163198, CVE-2012-5076: Tightened package accessibility

  - S7167656, CVE-2012-5077: Multiple Seeders are being     created

  - S7169884, CVE-2012-5073: LogManager checks do not work     correctly for sub-types

  - S7169887, CVE-2012-5074: Tightened package accessibility

  - S7169888, CVE-2012-5075: Narrowing resource definitions     in JMX RMI connector

  - S7172522, CVE-2012-5072: Improve DomainCombiner checking

  - S7186286, CVE-2012-5081: TLS implementation to better     adhere to RFC

  - S7189103, CVE-2012-5069: Executors needs to maintain     state

  - S7189490: More improvements to DomainCombiner checking

  - S7189567, CVE-2012-5085: java net obselete protocol

  - S7192975, CVE-2012-5071: Issue with JMX reflection

  - S7195194, CVE-2012-5084: Better data validation for     Swing

  - S7195549, CVE-2012-5087: Better bean object persistence

  - S7195917, CVE-2012-5086: XMLDecoder parsing at     close-time should be improved

  - S7195919, CVE-2012-5079: (sl) ServiceLoader can throw     CCE without needing to create instance

  - S7196190, CVE-2012-5088: Improve method of handling     MethodHandles

  - S7198296, CVE-2012-5089: Refactor classloader usage

  - S7158800: Improve storage of symbol tables

  - S7158801: Improve VM CompileOnly option

  - S7158804: Improve config file parsing

  - S7198606, CVE-2012-4416: Improve VM optimization

  - Bug fixes

  - Remove merge artefact.

The remote Mac OS X host has a version of Java for Mac OS X 10.6 that is missing Update 11, which updates the Java version to 1.6.0_37.  It is, therefore, affected by several security vulnerabilities, the most serious of which may allow an untrusted Java applet to execute arbitrary code with the privileges of the current user outside the Java sandbox.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
89663	VMware ESX / ESXi NFC and Third-Party Libraries Multiple Vulnerabilities (VMSA-2013-0003) (remote check)	Nessus	Misc.	2016/3/4	2022/3/29	critical
62618	Scientific Linux Security Update : java-1.6.0-openjdk on SL6.x i386/x86_64 (20121017) (ROBOT)	Nessus	Scientific Linux Local Security Checks	2012/10/18	2021/1/14	critical
283938	MiracleLinux 4 : java-1.7.0-openjdk-1.7.0.9-2.3.3.AXS4.1 (AXSA:2012-967:03)	Nessus	Miracle Linux Local Security Checks	2026/1/14	2026/1/16	critical
68646	Oracle Linux 6 : java-1.7.0-openjdk (ELSA-2012-1386)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2024/10/22	medium
74793	openSUSE Security Update : java-1_7_0-openjdk (openSUSE-SU-2012:1419-1) (ROBOT)	Nessus	SuSE Local Security Checks	2014/6/13	2022/3/29	critical
62594	Mac OS X : Java for Mac OS X 10.6 Update 11	Nessus	MacOS X Local Security Checks	2012/10/17	2023/11/27	critical

检测

插件搜索

critical

critical

critical

medium

critical

critical