Vulnerabilities > CVE-2012-3422 - Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Redhat Icedtea-Web

047910
CVSS 6.8 - MEDIUM
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
redhat
CWE-119
nessus

Summary

The getFirstInTableInstance function in the IcedTea-Web plugin before 1.2.1 returns an uninitialized pointer when the instance_to_id_map hash is empty, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted web page, which causes an uninitialized memory location to be read.

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Overflow Buffers
    Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
  • Client-side Injection-induced Buffer Overflow
    This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
  • Filter Failure through Buffer Overflow
    In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
  • MIME Conversion
    An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.

Nessus

  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_ICEDTEA-WEB-120802.NASL
    descriptionThe icedtea-web Java browser plugin was updated to 1.2.1 to fix security issues and bugs. - Potential read from a uninitialized memory location has been fixed. (CVE-2012-3422) - Incorrect handling of not-0 terminated strings has been fixed. (CVE-2012-3423)
    last seen2020-06-05
    modified2013-01-25
    plugin id64155
    published2013-01-25
    reporterThis script is Copyright (C) 2013-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/64155
    titleSuSE 11.1 / 11.2 Security Update : icedtea-web (SAT Patch Numbers 6621 / 6626)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from SuSE 11 update information. The text itself is
    # copyright (C) Novell, Inc.
    #
    
    if (NASL_LEVEL < 3000) exit(0);
    
    include("compat.inc");
    
    if (description)
    {
      script_id(64155);
      script_version("1.3");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2012-3422", "CVE-2012-3423");
    
      script_name(english:"SuSE 11.1 / 11.2 Security Update : icedtea-web (SAT Patch Numbers 6621 / 6626)");
      script_summary(english:"Checks rpm output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote SuSE 11 host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The icedtea-web Java browser plugin was updated to 1.2.1 to fix
    security issues and bugs.
    
      - Potential read from a uninitialized memory location has
        been fixed. (CVE-2012-3422)
    
      - Incorrect handling of not-0 terminated strings has been
        fixed. (CVE-2012-3423)"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=773458"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3422.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3423.html"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Apply SAT patch number 6621 / 6626 as appropriate."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:icedtea-web");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:11");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2012/08/02");
      script_set_attribute(attribute:"plugin_publication_date", value:"2013/01/25");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2013-2020 Tenable Network Security, Inc.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release !~ "^(SLED|SLES)11") audit(AUDIT_OS_NOT, "SuSE 11");
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SuSE 11", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"SLED11", sp:1, cpu:"i586", reference:"icedtea-web-1.2.1-0.2.1")) flag++;
    if (rpm_check(release:"SLED11", sp:1, cpu:"x86_64", reference:"icedtea-web-1.2.1-0.2.1")) flag++;
    if (rpm_check(release:"SLED11", sp:2, cpu:"i586", reference:"icedtea-web-1.2.1-0.7.1")) flag++;
    if (rpm_check(release:"SLED11", sp:2, cpu:"x86_64", reference:"icedtea-web-1.2.1-0.7.1")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2012-14370.NASL
    descriptionThis update brings IcedTea-Web 1.3 to Fedora. From Red Hat Bugzilla, it fixes rhbz#720836. Additionally, it provides numerous other bug fixes and enhancements, many of which are listed here : https://dbhole.wordpress.com/2012/09/05/icedtea-web-1-3-released/ - Updated to 1.2.1 - Resolves: RH840592/CVE-2012-3422 - Resolves: RH841345/CVE-2012-3423 - Updated to 1.2.1 - Resolves: RH840592/CVE-2012-3422 - Resolves: RH841345/CVE-2012-3423 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-03-17
    modified2012-09-26
    plugin id62296
    published2012-09-26
    reporterThis script is Copyright (C) 2012-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/62296
    titleFedora 18 : icedtea-web-1.3-1.fc18 (2012-14370)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Fedora Security Advisory 2012-14370.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(62296);
      script_version("1.8");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12");
    
      script_cve_id("CVE-2012-3422", "CVE-2012-3423");
      script_bugtraq_id(54762);
      script_xref(name:"FEDORA", value:"2012-14370");
    
      script_name(english:"Fedora 18 : icedtea-web-1.3-1.fc18 (2012-14370)");
      script_summary(english:"Checks rpm output for the updated package.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Fedora host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "This update brings IcedTea-Web 1.3 to Fedora. From Red Hat Bugzilla,
    it fixes rhbz#720836. Additionally, it provides numerous other bug
    fixes and enhancements, many of which are listed here :
    
    https://dbhole.wordpress.com/2012/09/05/icedtea-web-1-3-released/
    
      - Updated to 1.2.1
    
        - Resolves: RH840592/CVE-2012-3422
    
        - Resolves: RH841345/CVE-2012-3423
    
        - Updated to 1.2.1
    
        - Resolves: RH840592/CVE-2012-3422
    
        - Resolves: RH841345/CVE-2012-3423
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Fedora security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=840592"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=841345"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://dbhole.wordpress.com/2012/09/05/icedtea-web-1-3-released/"
      );
      # https://lists.fedoraproject.org/pipermail/package-announce/2012-September/088090.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?f111f589"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected icedtea-web package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:ND/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:icedtea-web");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:18");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2012/09/20");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/09/26");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2012-2020 Tenable Network Security, Inc.");
      script_family(english:"Fedora Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
    os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
    os_ver = os_ver[1];
    if (! ereg(pattern:"^18([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 18.x", "Fedora " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);
    
    flag = 0;
    if (rpm_check(release:"FC18", reference:"icedtea-web-1.3-1.fc18")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "icedtea-web");
    }
    
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2012-1132.NASL
    descriptionFrom Red Hat Security Advisory 2012:1132 : Updated icedtea-web packages that fix two security issues are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The IcedTea-Web project provides a Java web browser plug-in and an implementation of Java Web Start, which is based on the Netx project. It also contains a configuration tool for managing deployment settings for the plug-in and Web Start implementations. An uninitialized pointer use flaw was found in the IcedTea-Web plug-in. Visiting a malicious web page could possibly cause a web browser using the IcedTea-Web plug-in to crash, disclose a portion of its memory, or execute arbitrary code. (CVE-2012-3422) It was discovered that the IcedTea-Web plug-in incorrectly assumed all strings received from the browser were NUL terminated. When using the plug-in with a web browser that does not NUL terminate strings, visiting a web page containing a Java applet could possibly cause the browser to crash, disclose a portion of its memory, or execute arbitrary code. (CVE-2012-3423) Red Hat would like to thank Chamal De Silva for reporting the CVE-2012-3422 issue. This erratum also upgrades IcedTea-Web to version 1.2.1. Refer to the NEWS file, linked to in the References, for further information. All IcedTea-Web users should upgrade to these updated packages, which resolve these issues. Web browsers using the IcedTea-Web browser plug-in must be restarted for this update to take effect.
    last seen2020-06-01
    modified2020-06-02
    plugin id68590
    published2013-07-12
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/68590
    titleOracle Linux 6 : icedtea-web (ELSA-2012-1132)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Red Hat Security Advisory RHSA-2012:1132 and 
    # Oracle Linux Security Advisory ELSA-2012-1132 respectively.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(68590);
      script_version("1.6");
      script_cvs_date("Date: 2019/09/30 10:58:17");
    
      script_cve_id("CVE-2012-3422", "CVE-2012-3423");
      script_xref(name:"RHSA", value:"2012:1132");
    
      script_name(english:"Oracle Linux 6 : icedtea-web (ELSA-2012-1132)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Oracle Linux host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "From Red Hat Security Advisory 2012:1132 :
    
    Updated icedtea-web packages that fix two security issues are now
    available for Red Hat Enterprise Linux 6.
    
    The Red Hat Security Response Team has rated this update as having
    important security impact. Common Vulnerability Scoring System (CVSS)
    base scores, which give detailed severity ratings, are available for
    each vulnerability from the CVE links in the References section.
    
    The IcedTea-Web project provides a Java web browser plug-in and an
    implementation of Java Web Start, which is based on the Netx project.
    It also contains a configuration tool for managing deployment settings
    for the plug-in and Web Start implementations.
    
    An uninitialized pointer use flaw was found in the IcedTea-Web
    plug-in. Visiting a malicious web page could possibly cause a web
    browser using the IcedTea-Web plug-in to crash, disclose a portion of
    its memory, or execute arbitrary code. (CVE-2012-3422)
    
    It was discovered that the IcedTea-Web plug-in incorrectly assumed all
    strings received from the browser were NUL terminated. When using the
    plug-in with a web browser that does not NUL terminate strings,
    visiting a web page containing a Java applet could possibly cause the
    browser to crash, disclose a portion of its memory, or execute
    arbitrary code. (CVE-2012-3423)
    
    Red Hat would like to thank Chamal De Silva for reporting the
    CVE-2012-3422 issue.
    
    This erratum also upgrades IcedTea-Web to version 1.2.1. Refer to the
    NEWS file, linked to in the References, for further information.
    
    All IcedTea-Web users should upgrade to these updated packages, which
    resolve these issues. Web browsers using the IcedTea-Web browser
    plug-in must be restarted for this update to take effect."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://oss.oracle.com/pipermail/el-errata/2012-July/002965.html"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected icedtea-web packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:icedtea-web");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:icedtea-web-javadoc");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:6");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2012/08/07");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/08/01");
      script_set_attribute(attribute:"plugin_publication_date", value:"2013/07/12");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Oracle Linux Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/OracleLinux", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/OracleLinux")) audit(AUDIT_OS_NOT, "Oracle Linux");
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || !pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux)", string:release)) audit(AUDIT_OS_NOT, "Oracle Linux");
    os_ver = pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Oracle Linux");
    os_ver = os_ver[1];
    if (! preg(pattern:"^6([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Oracle Linux 6", "Oracle Linux " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Oracle Linux", cpu);
    
    flag = 0;
    if (rpm_check(release:"EL6", reference:"icedtea-web-1.2.1-1.el6_3")) flag++;
    if (rpm_check(release:"EL6", reference:"icedtea-web-javadoc-1.2.1-1.el6_3")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "icedtea-web / icedtea-web-javadoc");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2012-513.NASL
    descriptionThis update of icedtea-web fixed multiple hewap buffer overflows.
    last seen2020-06-05
    modified2014-06-13
    plugin id74712
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/74712
    titleopenSUSE Security Update : icedtea-web (openSUSE-SU-2012:0982-1)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update openSUSE-2012-513.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(74712);
      script_version("1.4");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2012-3422", "CVE-2012-3423");
    
      script_name(english:"openSUSE Security Update : icedtea-web (openSUSE-SU-2012:0982-1)");
      script_summary(english:"Check for the openSUSE-2012-513 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:"This update of icedtea-web fixed multiple hewap buffer overflows."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=773458"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://lists.opensuse.org/opensuse-updates/2012-08/msg00022.html"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected icedtea-web packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:icedtea-web");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:icedtea-web-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:icedtea-web-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:icedtea-web-javadoc");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:12.1");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2012/08/07");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/08/10");
      script_set_attribute(attribute:"plugin_publication_date", value:"2014/06/13");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE12\.1)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "12.1", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE12.1", reference:"icedtea-web-1.2.1-10.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"icedtea-web-debuginfo-1.2.1-10.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"icedtea-web-debugsource-1.2.1-10.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"icedtea-web-javadoc-1.2.1-10.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "icedtea-web / icedtea-web-debuginfo / icedtea-web-debugsource / etc");
    }
    
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20120731_ICEDTEA_WEB_ON_SL6_X.NASL
    descriptionThe IcedTea-Web project provides a Java web browser plug-in and an implementation of Java Web Start, which is based on the Netx project. It also contains a configuration tool for managing deployment settings for the plug-in and Web Start implementations. An uninitialized pointer use flaw was found in the IcedTea-Web plug-in. Visiting a malicious web page could possibly cause a web browser using the IcedTea-Web plug-in to crash, disclose a portion of its memory, or execute arbitrary code. (CVE-2012-3422) It was discovered that the IcedTea-Web plug-in incorrectly assumed all strings received from the browser were NUL terminated. When using the plug-in with a web browser that does not NUL terminate strings, visiting a web page containing a Java applet could possibly cause the browser to crash, disclose a portion of its memory, or execute arbitrary code. (CVE-2012-3423) This erratum also upgrades IcedTea-Web to version 1.2.1. All IcedTea-Web users should upgrade to these updated packages, which resolve these issues. Web browsers using the IcedTea-Web browser plug-in must be restarted for this update to take effect.
    last seen2020-03-18
    modified2012-08-03
    plugin id61406
    published2012-08-03
    reporterThis script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/61406
    titleScientific Linux Security Update : icedtea-web on SL6.x i386/x86_64 (20120731)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text is (C) Scientific Linux.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(61406);
      script_version("1.4");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/02/27");
    
      script_cve_id("CVE-2012-3422", "CVE-2012-3423");
    
      script_name(english:"Scientific Linux Security Update : icedtea-web on SL6.x i386/x86_64 (20120731)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Scientific Linux host is missing one or more security
    updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The IcedTea-Web project provides a Java web browser plug-in and an
    implementation of Java Web Start, which is based on the Netx project.
    It also contains a configuration tool for managing deployment settings
    for the plug-in and Web Start implementations.
    
    An uninitialized pointer use flaw was found in the IcedTea-Web
    plug-in. Visiting a malicious web page could possibly cause a web
    browser using the IcedTea-Web plug-in to crash, disclose a portion of
    its memory, or execute arbitrary code. (CVE-2012-3422)
    
    It was discovered that the IcedTea-Web plug-in incorrectly assumed all
    strings received from the browser were NUL terminated. When using the
    plug-in with a web browser that does not NUL terminate strings,
    visiting a web page containing a Java applet could possibly cause the
    browser to crash, disclose a portion of its memory, or execute
    arbitrary code. (CVE-2012-3423)
    
    This erratum also upgrades IcedTea-Web to version 1.2.1.
    
    All IcedTea-Web users should upgrade to these updated packages, which
    resolve these issues. Web browsers using the IcedTea-Web browser
    plug-in must be restarted for this update to take effect."
      );
      # https://listserv.fnal.gov/scripts/wa.exe?A2=ind1208&L=scientific-linux-errata&T=0&P=77
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?791f8840"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "Update the affected icedtea-web, icedtea-web-debuginfo and / or
    icedtea-web-javadoc packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:icedtea-web");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:icedtea-web-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:icedtea-web-javadoc");
      script_set_attribute(attribute:"cpe", value:"x-cpe:/o:fermilab:scientific_linux");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2012/08/07");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/07/31");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/08/03");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Scientific Linux Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Scientific Linux " >!< release) audit(AUDIT_HOST_NOT, "running Scientific Linux");
    os_ver = pregmatch(pattern: "Scientific Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Scientific Linux");
    os_ver = os_ver[1];
    if (! preg(pattern:"^6([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Scientific Linux 6.x", "Scientific Linux " + os_ver);
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Scientific Linux", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"SL6", reference:"icedtea-web-1.2.1-1.el6_3")) flag++;
    if (rpm_check(release:"SL6", reference:"icedtea-web-debuginfo-1.2.1-1.el6_3")) flag++;
    if (rpm_check(release:"SL6", reference:"icedtea-web-javadoc-1.2.1-1.el6_3")) flag++;
    
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "icedtea-web / icedtea-web-debuginfo / icedtea-web-javadoc");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_ICEDTEA-WEB-130702.NASL
    descriptionThis update to IcedTea-Web 1.4 provides the following fixes and enhancements : - Security updates - RH916774: Class-loader incorrectly shared for applets with same relative-path. (CVE-2013-1926) - RH884705: fixed gifar vulnerabilit. (CVE-2013-1927) - RH840592: Potential read from an uninitialized memory location. (CVE-2012-3422) - RH841345: Incorrect handling of not 0-terminated strings. (CVE-2012-3423) - RH884705: fixed gifar vulnerability. (CVE-2013-1927) - RH916774: Class-loader incorrectly shared for applets with same relative-path. (CVE-2013-1926) - NetX - PR1027: DownloadService is not supported by IcedTea-Web - PR725: JNLP applications will prompt for creating desktop shortcuts every time they are run - PR1292: Javaws does not resolve versioned jar names with periods correctly - PR580: http://www.horaoficial.cl/ loads improperly. - Plugin - PR1106: Buffer overflow in plugin table- - PR1166: Embedded JNLP File is not supported in applet tag - PR1217: Add command line arguments for plugins - PR1189: Icedtea-plugin requires code attribute when using jnlp_href - PR1198: JSObject is not passed to JavaScript correctly - PR1260: IcedTea-Web should not rely on GTK - PR1157: Applets can hang browser after fatal exception - PR580: http://www.horaoficial.cl/ loads improperly - PR1260: IcedTea-Web should not rely on GTK - PR1157: Applets can hang browser after fatal exception. - Common - PR1049: Extension jnlp
    last seen2020-06-05
    modified2013-07-18
    plugin id68953
    published2013-07-18
    reporterThis script is Copyright (C) 2013-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/68953
    titleSuSE 11.3 Security Update : icedtea-web (SAT Patch Number 7981)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from SuSE 11 update information. The text itself is
    # copyright (C) Novell, Inc.
    #
    
    if (NASL_LEVEL < 3000) exit(0);
    
    include("compat.inc");
    
    if (description)
    {
      script_id(68953);
      script_version("1.4");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2012-3422", "CVE-2012-3423", "CVE-2013-1926", "CVE-2013-1927");
    
      script_name(english:"SuSE 11.3 Security Update : icedtea-web (SAT Patch Number 7981)");
      script_summary(english:"Checks rpm output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote SuSE 11 host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "This update to IcedTea-Web 1.4 provides the following fixes and
    enhancements :
    
      - Security updates
    
      - RH916774: Class-loader incorrectly shared for applets
        with same relative-path. (CVE-2013-1926)
    
      - RH884705: fixed gifar vulnerabilit. (CVE-2013-1927)
    
      - RH840592: Potential read from an uninitialized memory
        location. (CVE-2012-3422)
    
      - RH841345: Incorrect handling of not 0-terminated
        strings. (CVE-2012-3423)
    
      - RH884705: fixed gifar vulnerability. (CVE-2013-1927)
    
      - RH916774: Class-loader incorrectly shared for applets
        with same relative-path. (CVE-2013-1926)
    
      - NetX
    
      - PR1027: DownloadService is not supported by IcedTea-Web
    
      - PR725: JNLP applications will prompt for creating
        desktop shortcuts every time they are run
    
      - PR1292: Javaws does not resolve versioned jar names with
        periods correctly
    
      - PR580: http://www.horaoficial.cl/ loads improperly.
    
      - Plugin
    
      - PR1106: Buffer overflow in plugin table-
    
      - PR1166: Embedded JNLP File is not supported in applet
        tag
    
      - PR1217: Add command line arguments for plugins
    
      - PR1189: Icedtea-plugin requires code attribute when
        using jnlp_href
    
      - PR1198: JSObject is not passed to JavaScript correctly
    
      - PR1260: IcedTea-Web should not rely on GTK
    
      - PR1157: Applets can hang browser after fatal exception
    
      - PR580: http://www.horaoficial.cl/ loads improperly
    
      - PR1260: IcedTea-Web should not rely on GTK
    
      - PR1157: Applets can hang browser after fatal exception.
    
      - Common
    
      - PR1049: Extension jnlp's signed jar with the content of
        only META-INF/* is considered
    
      - PR955: regression: SweetHome3D fails to run
    
      - PR1145: IcedTea-Web can cause ClassCircularityError
    
      - PR1161: X509VariableTrustManager does not work correctly
        with OpenJDK7
    
      - PR822: Applets fail to load if jars have different
        signers
    
      - PR1186:
        System.getProperty('deployment.user.security.trusted.cac
        erts') is null
    
      - PR909: The Java applet at
        http://de.gosupermodel.com/games/wardrobegame.jsp fails
    
      - PR1299: WebStart doesn't read socket proxy settings from
        firefox correctly.
    
      - Added cs, de, pl localization
    
      - Splash screen for javaws and plugin
    
      - Better error reporting for plugin via
        Error-splash-screen
    
      - All IcedTea-Web dialogues are centered to middle of
        active screen
    
      - Download indicator made compact for more then one jar
    
      - User can select its own JVM via itw-settings and
        deploy.properties
    
      - Added extended applets security settings and dialogue
    
      - Added new option in itw-settings which allows users to
        set JVM arguments when plugin is initialized
    
      - Fixed a build failure with older xulrunner
    
      - Changed strict openjdk6 dependencies to anything
        java-openjdk >= 1.6.0."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=815596"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=818768"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=825880"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3422.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3423.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2013-1926.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2013-1927.html"
      );
      script_set_attribute(attribute:"solution", value:"Apply SAT patch number 7981.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:icedtea-web");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:11");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2013/07/02");
      script_set_attribute(attribute:"plugin_publication_date", value:"2013/07/18");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2013-2020 Tenable Network Security, Inc.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release !~ "^(SLED|SLES)11") audit(AUDIT_OS_NOT, "SuSE 11");
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SuSE 11", cpu);
    
    pl = get_kb_item("Host/SuSE/patchlevel");
    if (isnull(pl) || int(pl) != 3) audit(AUDIT_OS_NOT, "SuSE 11.3");
    
    
    flag = 0;
    if (rpm_check(release:"SLED11", sp:3, cpu:"i586", reference:"icedtea-web-1.4-0.10.1")) flag++;
    if (rpm_check(release:"SLED11", sp:3, cpu:"x86_64", reference:"icedtea-web-1.4-0.10.1")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2012-14316.NASL
    descriptionThis update brings IcedTea-Web 1.3 to Fedora. From Red Hat Bugzilla, it fixes rhbz#720836. Additionally, it provides numerous other bug fixes and enhancements, many of which are listed here : https://dbhole.wordpress.com/2012/09/05/icedtea-web-1-3-released/ - Updated to 1.2.1 - Resolves: RH840592/CVE-2012-3422 - Resolves: RH841345/CVE-2012-3423 - Updated to 1.2.1 - Resolves: RH840592/CVE-2012-3422 - Resolves: RH841345/CVE-2012-3423 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-03-17
    modified2012-09-24
    plugin id62232
    published2012-09-24
    reporterThis script is Copyright (C) 2012-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/62232
    titleFedora 17 : icedtea-web-1.3-1.fc17 (2012-14316)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Fedora Security Advisory 2012-14316.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(62232);
      script_version("1.9");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12");
    
      script_cve_id("CVE-2012-3422", "CVE-2012-3423");
      script_bugtraq_id(54762);
      script_xref(name:"FEDORA", value:"2012-14316");
    
      script_name(english:"Fedora 17 : icedtea-web-1.3-1.fc17 (2012-14316)");
      script_summary(english:"Checks rpm output for the updated package.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Fedora host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "This update brings IcedTea-Web 1.3 to Fedora. From Red Hat Bugzilla,
    it fixes rhbz#720836. Additionally, it provides numerous other bug
    fixes and enhancements, many of which are listed here :
    
    https://dbhole.wordpress.com/2012/09/05/icedtea-web-1-3-released/
    
      - Updated to 1.2.1
    
        - Resolves: RH840592/CVE-2012-3422
    
        - Resolves: RH841345/CVE-2012-3423
    
        - Updated to 1.2.1
    
        - Resolves: RH840592/CVE-2012-3422
    
        - Resolves: RH841345/CVE-2012-3423
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Fedora security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=840592"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=841345"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://dbhole.wordpress.com/2012/09/05/icedtea-web-1-3-released/"
      );
      # https://lists.fedoraproject.org/pipermail/package-announce/2012-September/087631.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?6dcabfb4"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected icedtea-web package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:ND/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:icedtea-web");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:17");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2012/09/19");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/09/24");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2012-2020 Tenable Network Security, Inc.");
      script_family(english:"Fedora Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
    os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
    os_ver = os_ver[1];
    if (! ereg(pattern:"^17([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 17.x", "Fedora " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);
    
    flag = 0;
    if (rpm_check(release:"FC17", reference:"icedtea-web-1.3-1.fc17")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "icedtea-web");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2012-512.NASL
    description - update to 1.2.1 (bnc#773458) - Security Updates - CVE-2012-3422, RH840592: Potential read from an uninitialized memory location - CVE-2012-3423, RH841345: Incorrect handling of not 0-terminated strings - NetX - PR898: signed applications with big jnlp-file doesn
    last seen2020-06-05
    modified2014-06-13
    plugin id74711
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/74711
    titleopenSUSE Security Update : icedtea-web (openSUSE-SU-2012:0981-1)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update openSUSE-2012-512.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(74711);
      script_version("1.4");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2012-3422", "CVE-2012-3423");
    
      script_name(english:"openSUSE Security Update : icedtea-web (openSUSE-SU-2012:0981-1)");
      script_summary(english:"Check for the openSUSE-2012-512 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "  - update to 1.2.1 (bnc#773458)
    
      - Security Updates
    
      - CVE-2012-3422, RH840592: Potential read from an
        uninitialized memory location
    
      - CVE-2012-3423, RH841345: Incorrect handling of not
        0-terminated strings
    
      - NetX
    
      - PR898: signed applications with big jnlp-file doesn't
        start (webstart affect like 'frozen')
    
      - PR811: javaws is not handling urls with spaces (and
        other characters needing encoding) correctly
    
      - 816592: icedtea-web not loading GeoGebra java applets in
        Firefox or Chrome
    
      - Plugin
    
      - PR863: Error passing strings to applet methods in
        Chromium
    
      - PR895: IcedTea-Web searches for missing classes on each
        loadClass or findClass
    
      - PR518: NPString.utf8characters not guaranteed to be
        nul-terminated
    
      - Common
    
      - RH838417: Disambiguate signed applet security prompt
        from certificate warning
    
      - RH838559: Disambiguate signed applet security prompt
        from certificate warning"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=773458"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://lists.opensuse.org/opensuse-updates/2012-08/msg00021.html"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected icedtea-web packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:icedtea-web");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:icedtea-web-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:icedtea-web-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:icedtea-web-javadoc");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:12.1");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2012/08/07");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/08/02");
      script_set_attribute(attribute:"plugin_publication_date", value:"2014/06/13");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE12\.1)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "12.1", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE12.1", reference:"icedtea-web-1.2.1-6.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"icedtea-web-debuginfo-1.2.1-6.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"icedtea-web-debugsource-1.2.1-6.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"icedtea-web-javadoc-1.2.1-6.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "icedtea-web");
    }
    
  • NASL familyMandriva Local Security Checks
    NASL idMANDRIVA_MDVSA-2012-122.NASL
    descriptionMultiple vulnerabilities has been discovered and corrected in icedtea-web : An uninitialized pointer use flaw was found in IcedTea-Web web browser plugin. A malicious web page could use this flaw make IcedTea-Web browser plugin pass invalid pointer to a web browser. Depending on the browser used, it may cause the browser to crash or possibly execute arbitrary code (CVE-2012-3422). It was discovered that the IcedTea-Web web browser plugin incorrectly assumed that all strings provided by browser are NUL terminated, which is not guaranteed by the NPAPI (Netscape Plugin Application Programming Interface). When used in a browser that does not NUL terminate NPVariant NPStrings, this could lead to buffer over-read or over-write, resulting in possible information leak, crash, or code execution (CVE-2012-3423). The updated packages have been upgraded to the 1.1.6 version which is not affected by these issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id61972
    published2012-09-06
    reporterThis script is Copyright (C) 2012-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/61972
    titleMandriva Linux Security Advisory : icedtea-web (MDVSA-2012:122)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2013-439.NASL
    descriptionChanges in icedtea-web with update to 1.4 (bnc#818768) : - Added cs, de, pl localization - Splash screen for javaws and plugin - Better error reporting for plugin via Error-splash-screen - All IcedTea-Web dialogues are centered to middle of active screen - Download indicator made compact for more then one jar - User can select its own JVM via itw-settings and deploy.properties. - Added extended applets security settings and dialogue - Security updates - CVE-2013-1926, RH916774: Class-loader incorrectly shared for applets with same relative-path. - CVE-2013-1927, RH884705: fixed gifar vulnerabilit - CVE-2012-3422, RH840592: Potential read from an uninitialized memory location - CVE-2012-3423, RH841345: Incorrect handling of not 0-terminated strings - NetX - PR1027: DownloadService is not supported by IcedTea-Web - PR725: JNLP applications will prompt for creating desktop shortcuts every time they are run - PR1292: Javaws does not resolve versioned jar names with periods correctly - Plugin - PR1106: Buffer overflow in plugin table- - PR1166: Embedded JNLP File is not supported in applet tag - PR1217: Add command line arguments for plugins - PR1189: Icedtea-plugin requires code attribute when using jnlp_href - PR1198: JSObject is not passed to JavaScript correctly - PR1260: IcedTea-Web should not rely on GTK - PR1157: Applets can hang browser after fatal exception - PR580: http://www.horaoficial.cl/ loads improperly - Common - PR1049: Extension jnlp
    last seen2020-06-05
    modified2014-06-13
    plugin id75010
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/75010
    titleopenSUSE Security Update : icedtea-web (openSUSE-SU-2013:0893-1)
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2012-1132.NASL
    descriptionUpdated icedtea-web packages that fix two security issues are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The IcedTea-Web project provides a Java web browser plug-in and an implementation of Java Web Start, which is based on the Netx project. It also contains a configuration tool for managing deployment settings for the plug-in and Web Start implementations. An uninitialized pointer use flaw was found in the IcedTea-Web plug-in. Visiting a malicious web page could possibly cause a web browser using the IcedTea-Web plug-in to crash, disclose a portion of its memory, or execute arbitrary code. (CVE-2012-3422) It was discovered that the IcedTea-Web plug-in incorrectly assumed all strings received from the browser were NUL terminated. When using the plug-in with a web browser that does not NUL terminate strings, visiting a web page containing a Java applet could possibly cause the browser to crash, disclose a portion of its memory, or execute arbitrary code. (CVE-2012-3423) Red Hat would like to thank Chamal De Silva for reporting the CVE-2012-3422 issue. This erratum also upgrades IcedTea-Web to version 1.2.1. Refer to the NEWS file, linked to in the References, for further information. All IcedTea-Web users should upgrade to these updated packages, which resolve these issues. Web browsers using the IcedTea-Web browser plug-in must be restarted for this update to take effect.
    last seen2020-06-01
    modified2020-06-02
    plugin id67094
    published2013-06-29
    reporterThis script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/67094
    titleCentOS 6 : icedtea-web (CESA-2012:1132)
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201406-32.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201406-32 (IcedTea JDK: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in the IcedTea JDK. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, obtain sensitive information, bypass intended security policies, or have other unspecified impact. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id76303
    published2014-06-30
    reporterThis script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/76303
    titleGLSA-201406-32 : IcedTea JDK: Multiple vulnerabilities (BEAST) (ROBOT)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-1521-1.NASL
    descriptionChamal De Silva discovered that the IcedTea-Web Java web browser plugin could dereference an uninitialized pointer. A remote attacker could use this to craft a malicious web page that could cause a denial of service by crashing the web browser or possibly execute arbitrary code. (CVE-2012-3422) Steven Bergom and others discovered that the IcedTea-Web Java web browser plugin assumed that all strings provided by browsers are NULL terminated, which is not guaranteed by the NPAPI (Netscape Plugin Application Programming Interface). A remote attacker could use this to craft a malicious Java applet that could cause a denial of service by crashing the web browser, expose sensitive information or possibly execute arbitrary code. (CVE-2012-3423). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id61380
    published2012-08-01
    reporterUbuntu Security Notice (C) 2012-2019 Canonical, Inc. / NASL script (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/61380
    titleUbuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : icedtea-web vulnerabilities (USN-1521-1)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_55B498E2E56C11E1BBD5001C25E46B1D.NASL
    descriptionThe IcedTea project team reports : CVE-2012-3422: Use of uninitialized instance pointers An uninitialized pointer use flaw was found in IcedTea-Web web browser plugin. A malicious web page could use this flaw make IcedTea-Web browser plugin pass invalid pointer to a web browser. Depending on the browser used, it may cause the browser to crash or possibly execute arbitrary code. The get_cookie_info() and get_proxy_info() call getFirstInTableInstance() with the instance_to_id_map hash as a parameter. If instance_to_id_map is empty (which can happen when plugin was recently removed), getFirstInTableInstance() returns an uninitialized pointer. CVE-2012-3423: Incorrect handling of non 0-terminated strings It was discovered that the IcedTea-Web web browser plugin incorrectly assumed that all strings provided by browser are NUL terminated, which is not guaranteed by the NPAPI (Netscape Plugin Application Programming Interface). When used in a browser that does not NUL terminate NPVariant NPStrings, this could lead to buffer over-read or over-write, resulting in possible information leak, crash, or code execution. Mozilla browsers currently NUL terminate strings, however recent Chrome versions are known not to provide NUL terminated data.
    last seen2020-06-01
    modified2020-06-02
    plugin id61522
    published2012-08-14
    reporterThis script is Copyright (C) 2012-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/61522
    titleFreeBSD : Several vulnerabilities found in IcedTea-Web (55b498e2-e56c-11e1-bbd5-001c25e46b1d)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2012-1132.NASL
    descriptionUpdated icedtea-web packages that fix two security issues are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The IcedTea-Web project provides a Java web browser plug-in and an implementation of Java Web Start, which is based on the Netx project. It also contains a configuration tool for managing deployment settings for the plug-in and Web Start implementations. An uninitialized pointer use flaw was found in the IcedTea-Web plug-in. Visiting a malicious web page could possibly cause a web browser using the IcedTea-Web plug-in to crash, disclose a portion of its memory, or execute arbitrary code. (CVE-2012-3422) It was discovered that the IcedTea-Web plug-in incorrectly assumed all strings received from the browser were NUL terminated. When using the plug-in with a web browser that does not NUL terminate strings, visiting a web page containing a Java applet could possibly cause the browser to crash, disclose a portion of its memory, or execute arbitrary code. (CVE-2012-3423) Red Hat would like to thank Chamal De Silva for reporting the CVE-2012-3422 issue. This erratum also upgrades IcedTea-Web to version 1.2.1. Refer to the NEWS file, linked to in the References, for further information. All IcedTea-Web users should upgrade to these updated packages, which resolve these issues. Web browsers using the IcedTea-Web browser plug-in must be restarted for this update to take effect.
    last seen2020-06-01
    modified2020-06-02
    plugin id61378
    published2012-08-01
    reporterThis script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/61378
    titleRHEL 6 : icedtea-web (RHSA-2012:1132)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_ICEDTEA-WEB-130517.NASL
    descriptionThis update of icedtea-web fixes several bugs and security issues.
    last seen2020-06-05
    modified2013-06-02
    plugin id66741
    published2013-06-02
    reporterThis script is Copyright (C) 2013-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/66741
    titleSuSE 11.2 Security Update : icedtea-web (SAT Patch Number 7742)

Redhat

advisories
rhsa
idRHSA-2012:1132
rpms
  • icedtea-web-0:1.2.1-1.el6_3
  • icedtea-web-debuginfo-0:1.2.1-1.el6_3
  • icedtea-web-javadoc-0:1.2.1-1.el6_3