Issued:
2012-01-09
Updated:
2012-01-09

RHSA-2012:0006 - Security Advisory

Synopsis

Critical: java-1.4.2-ibm security update

Type/Severity

Security Advisory: Critical

Topic

Updated java-1.4.2-ibm packages that fix several security issues are now
available for Red Hat Enterprise Linux 4 Extras and Red Hat Enterprise
Linux 5 Supplementary.

The Red Hat Security Response Team has rated this update as having critical
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

Description

The IBM Java SE version 1.4.2 release includes the IBM Java 1.4.2 Runtime
Environment and the IBM Java 1.4.2 Software Development Kit.

This update fixes several vulnerabilities in the IBM Java 1.4.2 Runtime
Environment and the IBM Java 1.4.2 Software Development Kit. Detailed
vulnerability descriptions are linked from the IBM "Security alerts" page,
listed in the References section. (CVE-2011-3389, CVE-2011-3545,
CVE-2011-3547, CVE-2011-3548, CVE-2011-3549, CVE-2011-3552, CVE-2011-3556,
CVE-2011-3557, CVE-2011-3560)

All users of java-1.4.2-ibm are advised to upgrade to these updated
packages, which contain the IBM Java 1.4.2 SR13-FP11 release. All running
instances of IBM Java must be restarted for this update to take effect.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

Affected Products

  • Red Hat Enterprise Linux Server 5 x86_64
  • Red Hat Enterprise Linux Server 5 ia64
  • Red Hat Enterprise Linux Server 5 i386
  • Red Hat Enterprise Linux Server 4 x86_64
  • Red Hat Enterprise Linux Server 4 ia64
  • Red Hat Enterprise Linux Server 4 i386
  • Red Hat Enterprise Linux Workstation 5 x86_64
  • Red Hat Enterprise Linux Workstation 5 i386
  • Red Hat Enterprise Linux Workstation 4 x86_64
  • Red Hat Enterprise Linux Workstation 4 ia64
  • Red Hat Enterprise Linux Workstation 4 i386
  • Red Hat Enterprise Linux Desktop 5 x86_64
  • Red Hat Enterprise Linux Desktop 5 i386
  • Red Hat Enterprise Linux Desktop 4 x86_64
  • Red Hat Enterprise Linux Desktop 4 i386
  • Red Hat Enterprise Linux for IBM z Systems 5 s390x
  • Red Hat Enterprise Linux for IBM z Systems 4 s390x
  • Red Hat Enterprise Linux for IBM z Systems 4 s390
  • Red Hat Enterprise Linux for Power, big endian 5 ppc
  • Red Hat Enterprise Linux for Power, big endian 4 ppc
  • Red Hat Enterprise Linux Server from RHUI 5 x86_64
  • Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

  • BZ - 737506 - CVE-2011-3389 HTTPS: block-wise chosen-plaintext attack against SSL/TLS (BEAST)
  • BZ - 745379 - CVE-2011-3560 OpenJDK: missing checkSetFactory calls in HttpsURLConnection (JSSE, 7096936)
  • BZ - 745387 - CVE-2011-3547 OpenJDK: InputStream skip() information leak (Networking/IO, 7000600)
  • BZ - 745397 - CVE-2011-3552 OpenJDK: excessive default UDP socket limit under SecurityManager (Networking, 7032417)
  • BZ - 745459 - CVE-2011-3556 OpenJDK: RMI DGC server remote code execution (RMI, 7077466)
  • BZ - 745464 - CVE-2011-3557 OpenJDK: RMI registry privileged code execution (RMI, 7083012)
  • BZ - 745473 - CVE-2011-3548 OpenJDK: mutable static AWTKeyStroke.ctor (AWT, 7019773)
  • BZ - 747191 - CVE-2011-3545 Oracle/IBM JDK: unspecified vulnerability fixed in 6u29 (Sound)
  • BZ - 747198 - CVE-2011-3549 Oracle/IBM JDK: unspecified vulnerability fixed in 6u29 (Swing)

CVEs

References

Red Hat Enterprise Linux for Power, big endian 5

SRPM
ppc
java-1.4.2-ibm-1.4.2.13.11-1jpp.1.el5.ppc.rpm SHA-256: 338beba362932492854994ec3d50bf8c4f73c0d1eaf0b1696e3775dc89107765
java-1.4.2-ibm-1.4.2.13.11-1jpp.1.el5.ppc64.rpm SHA-256: d49e7e129c11299b43225d5f61e79afc35cef1aecba7e7c7c1265f7ea24910a1
java-1.4.2-ibm-demo-1.4.2.13.11-1jpp.1.el5.ppc.rpm SHA-256: 8d63c147a2ae62485bbe6fc4ac574a9a6663eae9f5b1c34a01d7aa21fadaf210
java-1.4.2-ibm-demo-1.4.2.13.11-1jpp.1.el5.ppc64.rpm SHA-256: 161dfffc63ccfdd4335ebbcddac7adb9d45c12efeb98a97ba163e9c1a11850c9
java-1.4.2-ibm-devel-1.4.2.13.11-1jpp.1.el5.ppc.rpm SHA-256: 155d009d894822fb2adbee70273b5079d074d90cc732e17aac341289ad29bdd5
java-1.4.2-ibm-devel-1.4.2.13.11-1jpp.1.el5.ppc64.rpm SHA-256: 90acd4f1bc742821dea2672ec8d2b912b14b283e090e494eddb5aaaa995d94bb
java-1.4.2-ibm-javacomm-1.4.2.13.11-1jpp.1.el5.ppc.rpm SHA-256: 928d5c5203cee4ccdfcff7cdcbcbab7580b00d447d50571c46c9b0fd4bee591d
java-1.4.2-ibm-javacomm-1.4.2.13.11-1jpp.1.el5.ppc64.rpm SHA-256: cd1818f6212d95de1325247c23b13865f27d9c207f0087f162e1fa6fdfd0e9f7
java-1.4.2-ibm-jdbc-1.4.2.13.11-1jpp.1.el5.ppc.rpm SHA-256: 7955fd74e639e811970971af56f28790962f6f821f938281781389dacd70a479
java-1.4.2-ibm-src-1.4.2.13.11-1jpp.1.el5.ppc.rpm SHA-256: 252b715c5b483770b330c6b665d554abfd7a6a4de37a2ec641b60682d8bb04e4
java-1.4.2-ibm-src-1.4.2.13.11-1jpp.1.el5.ppc64.rpm SHA-256: 9bfc9786715b4babb932585fc90865a6d766603978a6c7a97edc5158b46cba7d

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.