Detections
Analytics
Ubuntu 11.10 / 12.04 LTS : icedtea-web regression (USN-1804-2)
medium Nessus Plugin ID 66199
Language:
Synopsis
The remote Ubuntu host is missing one or more security-related patches.Description
USN-1804-1 fixed vulnerabilities in IcedTea-Web. This update introduced a regression with the Java Network Launching Protocol (JNLP) when fetching content over SSL under certain configurations, such as when using the community-supported IcedTead 7 browser plugin.This update fixes the problem.
We apologize for the inconvenience.
Jiri Vanek discovered that IcedTea-Web would use the same classloader for applets from different domains. A remote attacker could exploit this to expose sensitive information or potentially manipulate applets from other domains. (CVE-2013-1926)
It was discovered that IcedTea-Web did not properly verify JAR files and was susceptible to the GIFAR attack. If a user were tricked into opening a malicious website, a remote attacker could potentially exploit this to execute code under certain circumstances. (CVE-2013-1927).
Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
Solution
Update the affected icedtea-7-plugin and / or icedtea-netx packages.See Also
Plugin Details
Severity: Medium
ID: 66199
File Name: ubuntu_USN-1804-2.nasl
Version: 1.8
Type: local
Agent: unix
Family: Ubuntu Local Security Checks
Published: 4/24/2013
Updated: 9/19/2019
Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 5.9
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: p-cpe:/a:canonical:ubuntu_linux:icedtea-7-plugin, p-cpe:/a:canonical:ubuntu_linux:icedtea-netx, cpe:/o:canonical:ubuntu_linux:11.10, cpe:/o:canonical:ubuntu_linux:12.04:-:lts
Required KB Items: Host/cpu, Host/Debian/dpkg-l, Host/Ubuntu, Host/Ubuntu/release
Exploit Ease: No known exploits are available
Patch Publication Date: 4/23/2013
Vulnerability Publication Date: 4/29/2013
Reference Information
CVE: CVE-2013-1926, CVE-2013-1927
USN: 1804-2