[RedHat] Schwachstelle in IcedTea-Web

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA1

Liebe Kolleginnen und Kollegen,

soeben erreichte uns nachfolgendes RedHat Security Advisory. Wir geben
diese Informationen unveraendert an Sie weiter.

Das IcedTea-Web Browser Plugin dient zur Darstellung von in Webseiten
eingebundenen Java Applets. Um zu verhindern, dass Java Applets Objekte
von anderen Webseiten nachladen, dient hierbei die sogenannte
Same-Origin-Policy.

CVE-2011-3377 – Schwachstelle im IcedTea-Web Browser Plug-In

In der Implementierung der Same-Origin-Policy im IcedTea-Web Browser
Plug-In besteht eine Schwachstelle. Diese ermoeglicht entfernten
Angreifern mittels eines praeparierten Java Applets auf Objekte, die
durch Domains mit demselben Suffix wie das originaere Applet erreichbar
sind, zuzugreifen, was gegen die Same-Origin-Policy verstoesst.

Betroffen sind die folgenden Software Pakete und Plattformen:

Paket icedtea-web

Red Hat Enterprise Linux Desktop (v. 6) – i386, x86_64
Red Hat Enterprise Linux Desktop Optional (v. 6) – i386, x86_64
Red Hat Enterprise Linux HPC Node (v. 6) – x86_64
Red Hat Enterprise Linux HPC Node Optional (v. 6) – x86_64
Red Hat Enterprise Linux Server (v. 6) – i386, x86_64
Red Hat Enterprise Linux Server Optional (v. 6) – i386, x86_64
Red Hat Enterprise Linux Workstation (v. 6) – i386, x86_64
Red Hat Enterprise Linux Workstation Optional (v. 6) – i386, x86_64

Vom Hersteller werden ueberarbeitete Pakete zur Verfuegung gestellt.

(c) der deutschen Zusammenfassung bei DFN-CERT Services GmbH; die
Verbreitung, auch auszugsweise, ist nur unter Hinweis auf den Urheber,
DFN-CERT Services GmbH, und nur zu nicht kommerziellen Zwecken
gestattet.

Mit freundlichen Gruessen,
Matthias Braeck

– —
Matthias Braeck, B.Sc. (Incident Response Team)

DFN-CERT Services GmbH, https://www.dfn-cert.de, Phone +49 40 808077-590
Sitz / Register: Hamburg, AG Hamburg, HRB 88805, Ust-IdNr.: DE 232129737
Sachsenstrasse 5, 20097 Hamburg/Germany, CEO: Dr. Klaus-Peter Kossakowski

Automatische Warnmeldungen: https://www.cert.dfn.de/autowarn

– —–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA1

=====================================================================
Red Hat Security Advisory

Synopsis: Moderate: icedtea-web security update
Advisory ID: RHSA-2011:1441-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2011-1441.html
Issue date: 2011-11-08
CVE Names: CVE-2011-3377
=====================================================================

1. Summary:

Updated icedtea-web packages that fix one security issue are now available
for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

2. Relevant releases/architectures:

3. Description:

The IcedTea-Web project provides a Java web browser plug-in and an
implementation of Java Web Start, which is based on the Netx project. It
also contains a configuration tool for managing deployment settings for the
plug-in and Web Start implementations.

A flaw was found in the same-origin policy implementation in the
IcedTea-Web browser plug-in. A malicious Java applet could use this flaw to
open network connections to hosts other than the originating host,
violating the same-origin policy. (CVE-2011-3377)

All IcedTea-Web users should upgrade to these updated packages, which
upgrade IcedTea-Web to version 1.0.6 to correct this issue. Web browsers
using the IcedTea-Web browser plug-in must be restarted for this update to
take effect.

4. Solution:

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

742515 – CVE-2011-3377 IcedTea-Web: second-level domain subdomains and suffix domain SOP bypass

6. Package List:

Red Hat Enterprise Linux Desktop (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/icedtea-web-1.0.6-1.el6_1.src.rpm

i386:
icedtea-web-1.0.6-1.el6_1.i686.rpm
icedtea-web-debuginfo-1.0.6-1.el6_1.i686.rpm

x86_64:
icedtea-web-1.0.6-1.el6_1.x86_64.rpm
icedtea-web-debuginfo-1.0.6-1.el6_1.x86_64.rpm

Red Hat Enterprise Linux Desktop Optional (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/icedtea-web-1.0.6-1.el6_1.src.rpm

i386:
icedtea-web-debuginfo-1.0.6-1.el6_1.i686.rpm
icedtea-web-javadoc-1.0.6-1.el6_1.i686.rpm

x86_64:
icedtea-web-debuginfo-1.0.6-1.el6_1.x86_64.rpm
icedtea-web-javadoc-1.0.6-1.el6_1.x86_64.rpm

Red Hat Enterprise Linux HPC Node (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/icedtea-web-1.0.6-1.el6_1.src.rpm

x86_64:
icedtea-web-1.0.6-1.el6_1.x86_64.rpm
icedtea-web-debuginfo-1.0.6-1.el6_1.x86_64.rpm

Red Hat Enterprise Linux HPC Node Optional (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/icedtea-web-1.0.6-1.el6_1.src.rpm

x86_64:
icedtea-web-debuginfo-1.0.6-1.el6_1.x86_64.rpm
icedtea-web-javadoc-1.0.6-1.el6_1.x86_64.rpm

Red Hat Enterprise Linux Server (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/icedtea-web-1.0.6-1.el6_1.src.rpm

i386:
icedtea-web-1.0.6-1.el6_1.i686.rpm
icedtea-web-debuginfo-1.0.6-1.el6_1.i686.rpm

x86_64:
icedtea-web-1.0.6-1.el6_1.x86_64.rpm
icedtea-web-debuginfo-1.0.6-1.el6_1.x86_64.rpm

Red Hat Enterprise Linux Server Optional (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/icedtea-web-1.0.6-1.el6_1.src.rpm

i386:
icedtea-web-debuginfo-1.0.6-1.el6_1.i686.rpm
icedtea-web-javadoc-1.0.6-1.el6_1.i686.rpm

x86_64:
icedtea-web-debuginfo-1.0.6-1.el6_1.x86_64.rpm
icedtea-web-javadoc-1.0.6-1.el6_1.x86_64.rpm

Red Hat Enterprise Linux Workstation (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/icedtea-web-1.0.6-1.el6_1.src.rpm

i386:
icedtea-web-1.0.6-1.el6_1.i686.rpm
icedtea-web-debuginfo-1.0.6-1.el6_1.i686.rpm

x86_64:
icedtea-web-1.0.6-1.el6_1.x86_64.rpm
icedtea-web-debuginfo-1.0.6-1.el6_1.x86_64.rpm

Red Hat Enterprise Linux Workstation Optional (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/icedtea-web-1.0.6-1.el6_1.src.rpm

i386:
icedtea-web-debuginfo-1.0.6-1.el6_1.i686.rpm
icedtea-web-javadoc-1.0.6-1.el6_1.i686.rpm

x86_64:
icedtea-web-debuginfo-1.0.6-1.el6_1.x86_64.rpm
icedtea-web-javadoc-1.0.6-1.el6_1.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package

7. References:

https://www.redhat.com/security/data/cve/CVE-2011-3377.html
https://access.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

iD8DBQFOuajeXlSAg2UNWIIRAmZ3AKC8gDkmvRT6nBDEVjEBXMzbBDKNugCdGW4g
OH/6nplCrNj8EowSZ/nbSYA=
=d1fi
– —–END PGP SIGNATURE—–
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v2.0.16 (GNU/Linux)

iQEcBAEBAgAGBQJOunp3AAoJEJtyb8U7iGZBQTkH/1lOhfCqtJsEz5sWuUaNcqdO
yUjWjPogOdYgT3UbWx5qXf7Cf1zf5MXH3Q4dMXP/s0watPradjY3fzyVXqFencpE
5spz3mpYQEP3PZ8WqArGjJ37b8hqHlRSKpNSmAKwcyJn65CLq8xmKNCn6Wpf/klf
rlh3KkywqJvslUaHPen2RLavhHVaIzRSN4fqT1Lw8dh7fCOi9mQDAVxdq+p+lyO/
fgQy5gzT9JBLMqPSPuQ40PS9W4eA4SKtj7zG1sqUnxw2Pmx4vcpYqzFQTBS/qzz5
tbevW0jFuSBX+wtO72dDzrE0+cKWc1dpy4y/80P1ymCcAxxUp7RMHssBY7m4AQY=
=pBJi
—–END PGP SIGNATURE—–

[RedHat] Schwachstelle in IcedTea-Web - RHSA-2011:1441-01

LMP003 Chemnitzer Linux-Tage 2026

[RedHat] Schwachstelle in IcedTea-Web – RHSA-2011:1441-01

[RedHat] Schwachstelle in IcedTea-Web - RHSA-2011:1441-01