Bug 1731

Advisory:

Java-1.6.0-openjdk is victim of several CVE :


- Resolves: rhbz#709375
- Bumped to IcedTea6 1.10.2
- RH706250, S6213702, CVE-2011-0872: (so) non-blocking sockets with TCP urgent
  disabled get still selected for read ops (win)
- RH706106, S6618658, CVE-2011-0865: Vulnerability in deserialization
- RH706111, S7012520, CVE-2011-0815: Heap overflow vulnerability in 
  FileDialog.show() (win)
- RH706139, S7013519, CVE-2011-0822, CVE-2011-0862: Integer overflows in 2D 
  code
- RH706153, S7013969, CVE-2011-0867: NetworkInterface.toString can reveal 
  bindings
- RH706234, S7013971, CVE-2011-0869: Vulnerability in SAAJ
- RH706239, S7016340, CVE-2011-0870: Vulnerability in SAAJ
- RH706241, S7016495, CVE-2011-0868: Crash in Java 2D transforming an image 
  with scale close to zero
- RH706248, S7020198, CVE-2011-0871: ImageIcon creates Component with null acc
- RH706245, S7020373, CVE-2011-0864: JSR rewriting can overflow memory address
  size variables


This update fixes those issues.

Source RPM: http://javadl.sun.com/webapps/download/AutoDL?BundleId=49014 => java-1.6.0-openjdk

Can somebody please provide steps for testing this update. Thankyou.

CC: (none) => eeeemail

Well, i'm no Java expert, but this should be it: install/update java-1.6.0-openjdk, make sure that openjdk is the default java with
update-alternatives --config java
and select openjdk there.
Then find and check with an exploit for every CVE mentioned by dmorgan.

CC: (none) => doktor5000

Thanks Florian. Not being a security expert though I've no idea where to start with finding exploits for CVE's.

Are there any POC's available to test the security fixes in this update?

Thankyou.

Using a previously compiled copy of a previously compiled copy of
http://download.oracle.com/javase/tutorial/getStarted/cupojava/unix.html

$ java -version
java version "1.6.0_22"
OpenJDK Runtime Environment (IcedTea6 1.10.2) (fedora-14.b22.5.1.mga1-i386)
OpenJDK Client VM (build 20.0-b11, mixed mode)
[dave@hodgins software]$ java HelloWorldApp
Hello World!

Does this package include a browser plugin?
# update-alternatives --config libjavaplugin.so
There are 2 programs which provide `libjavaplugin.so'.
  Selection    Command
-----------------------------------------------
*+    1        /usr/lib/jvm/java-1.6.0-sun-1.6.0.26/jre/lib/i386/libnpjp2.so
      2        /usr/lib/jvm/java-1.6.0-sun-1.6.0.26/jre/plugin/i386/ns7/libjavaplugin_oji.so

CC: (none) => davidwhodgins

There don't appear to be any exploits for the CVE's at securityfocus so we'll just have to ensure it seems to work ok.

icedtea-web is the browser plugin I think for openjdk, Source RPM  : icedtea-web-1.0.2-5.mga1.src.rpm. There isn't any update for it in updates_testing so I'm presuming it's just java itself.

Using the HelloWorldApp you gave Dave.

i586:

$ javac HelloWorldApp.java
$ java HelloWorldApp
Hello World!


Using OddEven from https://secure.wikimedia.org/wikipedia/en/wiki/Java_%28programming_language%29#A_more_comprehensive_example

$ javac OddEven.java
$ java OddEven (entered 99)
Odd
$ java OddEven (entered 56)
Even

Seems OK.

X86_64:

$ javac HelloWorldApp.java
$ java HelloWorldApp
Hello World!



$ javac OddEven.java
$ java OddEven
Odd (entered 345)
$ java OddEven
Even (entered 456)


Seems OK.

Update Validated

Advisory:

-------------
Java-1.6.0-openjdk is victim of several CVE :


- Resolves: rhbz#709375
- Bumped to IcedTea6 1.10.2
- RH706250, S6213702, CVE-2011-0872: (so) non-blocking sockets with TCP urgent
  disabled get still selected for read ops (win)
- RH706106, S6618658, CVE-2011-0865: Vulnerability in deserialization
- RH706111, S7012520, CVE-2011-0815: Heap overflow vulnerability in 
  FileDialog.show() (win)
- RH706139, S7013519, CVE-2011-0822, CVE-2011-0862: Integer overflows in 2D 
  code
- RH706153, S7013969, CVE-2011-0867: NetworkInterface.toString can reveal 
  bindings
- RH706234, S7013971, CVE-2011-0869: Vulnerability in SAAJ
- RH706239, S7016340, CVE-2011-0870: Vulnerability in SAAJ
- RH706241, S7016495, CVE-2011-0868: Crash in Java 2D transforming an image 
  with scale close to zero
- RH706248, S7020198, CVE-2011-0871: ImageIcon creates Component with null acc
- RH706245, S7020373, CVE-2011-0864: JSR rewriting can overflow memory address
  size variables


This update fixes those issues.
-------------

SRPM: 	java-1.6.0-openjdk-1.6.0.0-14.b22.5.1.mga1.src.rpm

Could somebody from sysadmin please push from core/updates_testing to core/updates.

Thankyou!

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

update pushed.

Status: NEW => RESOLVED
Resolution: (none) => FIXED