Ubuntu 16.04 LTS / 17.10 : OpenJDK 8 vulnerabilities (USN-3644-1) - Nessus

High   Plugin ID: 109723

This page contains detailed information about the Ubuntu 16.04 LTS / 17.10 : OpenJDK 8 vulnerabilities (USN-3644-1) Nessus plugin including available exploits and PoCs found on GitHub, in Metasploit or Exploit-DB for verifying of this vulnerability.

Table Of Contents
hide

Plugin Overview

ID: 109723
Name: Ubuntu 16.04 LTS / 17.10 : OpenJDK 8 vulnerabilities (USN-3644-1)
Filename: ubuntu_USN-3644-1.nasl
Vulnerability Published: 2018-04-19
This Plugin Published: 2018-05-11
Last Modification Time: 2020-09-17
Plugin Version: 1.7
Plugin Type: local
Plugin Family: Ubuntu Local Security Checks
Dependencies: ssh_get_info.nasl
Required KB Items [?]: Host/cpu, Host/Debian/dpkg-l, Host/Ubuntu, Host/Ubuntu/release

Vulnerability Information

Severity: High
Vulnerability Published: 2018-04-19
Patch Published: 2018-05-11
CVE [?]: CVE-2018-2783, CVE-2018-2790, CVE-2018-2794, CVE-2018-2795, CVE-2018-2796, CVE-2018-2797, CVE-2018-2798, CVE-2018-2799, CVE-2018-2800, CVE-2018-2814, CVE-2018-2815
CPE [?]: cpe:/o:canonical:ubuntu_linux:16.04, cpe:/o:canonical:ubuntu_linux:17.10, p-cpe:/a:canonical:ubuntu_linux:openjdk-8-jre, p-cpe:/a:canonical:ubuntu_linux:openjdk-8-jre-headless, p-cpe:/a:canonical:ubuntu_linux:openjdk-8-jre-jamvm, p-cpe:/a:canonical:ubuntu_linux:openjdk-8-jre-zero

Synopsis

The remote Ubuntu host is missing one or more security-related patches.

Description

It was discovered that the Security component of OpenJDK did not correctly perform merging of multiple sections for the same file listed in JAR archive file manifests. An attacker could possibly use this to modify attributes in a manifest without invalidating the signature. (CVE-2018-2790)

Francesco Palmarini, Marco Squarcina, Mauro Tempesta, and Riccardo Focardi discovered that the Security component of OpenJDK did not restrict which classes could be used when deserializing keys from the JCEKS key stores. An attacker could use this to specially craft a JCEKS key store to execute arbitrary code. (CVE-2018-2794)

It was discovered that the Security component of OpenJDK in some situations did not properly limit the amount of memory allocated when performing deserialization. An attacker could use this to cause a denial of service (memory exhaustion). (CVE-2018-2795)

It was discovered that the Concurrency component of OpenJDK in some situations did not properly limit the amount of memory allocated when performing deserialization. An attacker could use this to cause a denial of service (memory exhaustion). (CVE-2018-2796)

It was discovered that the JMX component of OpenJDK in some situations did not properly limit the amount of memory allocated when performing deserialization. An attacker could use this to cause a denial of service (memory exhaustion). (CVE-2018-2797)

It was discovered that the AWT component of OpenJDK in some situations did not properly limit the amount of memory allocated when performing deserialization. An attacker could use this to cause a denial of service (memory exhaustion). (CVE-2018-2798)

It was discovered that the JAXP component of OpenJDK in some situations did not properly limit the amount of memory allocated when performing deserialization. An attacker could use this to cause a denial of service (memory exhaustion). (CVE-2018-2799)

Moritz Bechler discovered that the RMI component of OpenJDK enabled HTTP transport for RMI servers by default. A remote attacker could use this to gain access to restricted services. (CVE-2018-2800)

It was discovered that a vulnerability existed in the Hotspot component of OpenJDK affecting confidentiality, data integrity, and availability. An attacker could use this to specially craft an Java application that caused a denial of service or bypassed sandbox restrictions. (CVE-2018-2814)

Apostolos Giannakidis discovered that the Serialization component of OpenJDK did not properly bound memory allocations in some situations. An attacker could use this to cause a denial of service (memory exhaustion). (CVE-2018-2815)

David Benjamin discovered a vulnerability in the Security component of OpenJDK related to data integrity and confidentiality. A remote attacker could possibly use this to expose sensitive information. (CVE-2018-2783).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Solution

Update the affected packages.

Public Exploits

Target Network Port(s): N/A
Target Asset(s): N/A
Exploit Available: True (GitHub)

Here's the list of publicly known exploits and PoCs for verifying the Ubuntu 16.04 LTS / 17.10 : OpenJDK 8 vulnerabilities (USN-3644-1) vulnerability:

  1. GitHub: https://github.com/spiegel-im-spiegel/jvnman
    [CVE-2018-2783]

Before running any exploit against any system, make sure you are authorized by the owner of the target system(s) to perform such activity. In any other case, this would be considered as an illegal activity.

WARNING: Beware of using unverified exploits from sources such as GitHub or Exploit-DB. These exploits and PoCs could contain malware. For more information, see how to use exploits safely.

Risk Information

CVSS V2 Vector [?]: AV:N/AC:M/Au:N/C:P/I:P/A:N
CVSS Base Score:5.8 (Medium)
Impact Subscore:4.9
Exploitability Subscore:8.6
CVSS Temporal Score:NA (None)
CVSS Environmental Score:NA (None)
Modified Impact Subscore:NA
Overall CVSS Score:5.8 (Medium)
CVSS V3 Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS Base Score:8.3 (High)
Impact Subscore:6.0
Exploitability Subscore:1.6
CVSS Temporal Score:NA (None)
CVSS Environmental Score:NA (None)
Modified Impact Subscore:NA
Overall CVSS Score:8.3 (High)

Go back to menu.

Plugin Source

This is the ubuntu_USN-3644-1.nasl nessus plugin source code. Ubuntu Security Notice (C) 2018-2020 Canonical, Inc. / NASL script (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof. 

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Ubuntu Security Notice USN-3644-1. The text 
# itself is copyright (C) Canonical, Inc. See 
# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered 
# trademark of Canonical, Inc.
#

include("compat.inc");

if (description)
{
  script_id(109723);
  script_version("1.7");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/09/17");

  script_cve_id("CVE-2018-2783", "CVE-2018-2790", "CVE-2018-2794", "CVE-2018-2795", "CVE-2018-2796", "CVE-2018-2797", "CVE-2018-2798", "CVE-2018-2799", "CVE-2018-2800", "CVE-2018-2814", "CVE-2018-2815");
  script_xref(name:"USN", value:"3644-1");

  script_name(english:"Ubuntu 16.04 LTS / 17.10 : OpenJDK 8 vulnerabilities (USN-3644-1)");
  script_summary(english:"Checks dpkg output for updated packages.");

  script_set_attribute(
    attribute:"synopsis",
    value:
"The remote Ubuntu host is missing one or more security-related
patches."
  );
  script_set_attribute(
    attribute:"description",
    value:
"It was discovered that the Security component of OpenJDK did not
correctly perform merging of multiple sections for the same file
listed in JAR archive file manifests. An attacker could possibly use
this to modify attributes in a manifest without invalidating the
signature. (CVE-2018-2790)

Francesco Palmarini, Marco Squarcina, Mauro Tempesta, and Riccardo
Focardi discovered that the Security component of OpenJDK did not
restrict which classes could be used when deserializing keys from the
JCEKS key stores. An attacker could use this to specially craft a
JCEKS key store to execute arbitrary code. (CVE-2018-2794)

It was discovered that the Security component of OpenJDK in some
situations did not properly limit the amount of memory allocated when
performing deserialization. An attacker could use this to cause a
denial of service (memory exhaustion). (CVE-2018-2795)

It was discovered that the Concurrency component of OpenJDK in some
situations did not properly limit the amount of memory allocated when
performing deserialization. An attacker could use this to cause a
denial of service (memory exhaustion). (CVE-2018-2796)

It was discovered that the JMX component of OpenJDK in some situations
did not properly limit the amount of memory allocated when performing
deserialization. An attacker could use this to cause a denial of
service (memory exhaustion). (CVE-2018-2797)

It was discovered that the AWT component of OpenJDK in some situations
did not properly limit the amount of memory allocated when performing
deserialization. An attacker could use this to cause a denial of
service (memory exhaustion). (CVE-2018-2798)

It was discovered that the JAXP component of OpenJDK in some
situations did not properly limit the amount of memory allocated when
performing deserialization. An attacker could use this to cause a
denial of service (memory exhaustion). (CVE-2018-2799)

Moritz Bechler discovered that the RMI component of OpenJDK enabled
HTTP transport for RMI servers by default. A remote attacker could use
this to gain access to restricted services. (CVE-2018-2800)

It was discovered that a vulnerability existed in the Hotspot
component of OpenJDK affecting confidentiality, data integrity, and
availability. An attacker could use this to specially craft an Java
application that caused a denial of service or bypassed sandbox
restrictions. (CVE-2018-2814)

Apostolos Giannakidis discovered that the Serialization component of
OpenJDK did not properly bound memory allocations in some situations.
An attacker could use this to cause a denial of service (memory
exhaustion). (CVE-2018-2815)

David Benjamin discovered a vulnerability in the Security component of
OpenJDK related to data integrity and confidentiality. A remote
attacker could possibly use this to expose sensitive information.
(CVE-2018-2783).

Note that Tenable Network Security has extracted the preceding
description block directly from the Ubuntu security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://usn.ubuntu.com/3644-1/"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:openjdk-8-jre");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:openjdk-8-jre-headless");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:openjdk-8-jre-jamvm");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:openjdk-8-jre-zero");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:16.04");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:17.10");

  script_set_attribute(attribute:"vuln_publication_date", value:"2018/04/19");
  script_set_attribute(attribute:"patch_publication_date", value:"2018/05/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2018/05/11");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"Ubuntu Security Notice (C) 2018-2020 Canonical, Inc. / NASL script (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Ubuntu Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");

  exit(0);
}


include("audit.inc");
include("ubuntu.inc");
include("misc_func.inc");

if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/Ubuntu/release");
if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu");
release = chomp(release);
if (! preg(pattern:"^(16\.04|17\.10)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 16.04 / 17.10", "Ubuntu " + release);
if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu);

flag = 0;

if (ubuntu_check(osver:"16.04", pkgname:"openjdk-8-jre", pkgver:"8u171-b11-0ubuntu0.16.04.1")) flag++;
if (ubuntu_check(osver:"16.04", pkgname:"openjdk-8-jre-headless", pkgver:"8u171-b11-0ubuntu0.16.04.1")) flag++;
if (ubuntu_check(osver:"16.04", pkgname:"openjdk-8-jre-jamvm", pkgver:"8u171-b11-0ubuntu0.16.04.1")) flag++;
if (ubuntu_check(osver:"16.04", pkgname:"openjdk-8-jre-zero", pkgver:"8u171-b11-0ubuntu0.16.04.1")) flag++;
if (ubuntu_check(osver:"17.10", pkgname:"openjdk-8-jre", pkgver:"8u171-b11-0ubuntu0.17.10.1")) flag++;
if (ubuntu_check(osver:"17.10", pkgname:"openjdk-8-jre-headless", pkgver:"8u171-b11-0ubuntu0.17.10.1")) flag++;
if (ubuntu_check(osver:"17.10", pkgname:"openjdk-8-jre-zero", pkgver:"8u171-b11-0ubuntu0.17.10.1")) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : ubuntu_report_get()
  );
  exit(0);
}
else
{
  tested = ubuntu_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "openjdk-8-jre / openjdk-8-jre-headless / openjdk-8-jre-jamvm / etc");
}

The latest version of this script can be found in these locations depending on your platform:

  • Linux / Unix:
    /opt/nessus/lib/nessus/plugins/ubuntu_USN-3644-1.nasl
  • Windows:
    C:\ProgramData\Tenable\Nessus\nessus\plugins\ubuntu_USN-3644-1.nasl
  • Mac OS X:
    /Library/Nessus/run/lib/nessus/plugins/ubuntu_USN-3644-1.nasl

Go back to menu.

How to Run

Here is how to run the Ubuntu 16.04 LTS / 17.10 : OpenJDK 8 vulnerabilities (USN-3644-1) as a standalone plugin via the Nessus web user interface (https://localhost:8834/):

  1. Click to start a New Scan.
  2. Select Advanced Scan.
  3. Navigate to the Plugins tab.
  4. On the top right corner click to Disable All plugins.
  5. On the left side table select Ubuntu Local Security Checks plugin family.
  6. On the right side table select Ubuntu 16.04 LTS / 17.10 : OpenJDK 8 vulnerabilities (USN-3644-1) plugin ID 109723.
  7. Specify the target on the Settings tab and click to Save the scan.
  8. Run the scan.

Here are a few examples of how to run the plugin in the command line. Note that the examples below demonstrate the usage on the Linux / Unix platform.

Basic usage:

/opt/nessus/bin/nasl ubuntu_USN-3644-1.nasl -t <IP/HOST>

Run the plugin with audit trail message on the console:

/opt/nessus/bin/nasl -a ubuntu_USN-3644-1.nasl -t <IP/HOST>

Run the plugin with trace script execution written to the console (useful for debugging):

/opt/nessus/bin/nasl -T - ubuntu_USN-3644-1.nasl -t <IP/HOST>

Run the plugin with using a state file for the target and updating it (useful for running multiple plugins on the target):

/opt/nessus/bin/nasl -K /tmp/state ubuntu_USN-3644-1.nasl -t <IP/HOST>

Go back to menu.

References

USN | Ubuntu Security Notice: See also: Similar and related Nessus plugins:
  • 110857 - EulerOS 2.0 SP3 : java-1.7.0-openjdk (EulerOS-SA-2018-1193)
  • 110859 - EulerOS 2.0 SP3 : java-1.8.0-openjdk (EulerOS-SA-2018-1195)
  • 118663 - F5 Networks BIG-IP : Oracle Java SE vulnerability (K44923228)
  • 122836 - GLSA-201903-14 : Oracle JDK/JRE: Multiple vulnerabilities
  • 160357 - IBM Java 6.0 < 6.0.16.65 / 6.1 < 6.1.8.65 / 7.0 < 7.0.10.25 / 7.1 < 7.1.4.25 / 8.0 < 8.0.5.15 Multiple Vulnerabilities
  • 127190 - NewStart CGSL CORE 5.04 / MAIN 5.04 : java-1.8.0-openjdk Multiple Vulnerabilities (NS-SA-2019-0027)
  • 127199 - NewStart CGSL CORE 5.04 / MAIN 5.04 : java-1.7.0-openjdk Multiple Vulnerabilities (NS-SA-2019-0032)
  • 127385 - NewStart CGSL MAIN 4.05 : java-1.7.0-openjdk Multiple Vulnerabilities (NS-SA-2019-0131)
  • 127397 - NewStart CGSL MAIN 4.05 : java-1.8.0-openjdk Multiple Vulnerabilities (NS-SA-2019-0137)
  • 109202 - Oracle Java SE Multiple Vulnerabilities (April 2018 CPU)
  • 109203 - Oracle Java SE Multiple Vulnerabilities (April 2018 CPU) (Unix)
  • 109207 - Oracle JRockit R28.3.17 Multiple Vulnerabilities (April 2018 CPU)
  • 111932 - Photon OS 1.0: Mysql / Openjdk PHSA-2018-1.0-0130 (deprecated)
  • 121835 - Photon OS 1.0: Openjdk PHSA-2018-1.0-0130
  • 111298 - Photon OS 2.0 : openjdk8 / httpd / librelp / zsh / libvirt (PhotonOS-PHSA-2018-2.0-0039) (deprecated)
  • 106182 - RHEL 6 / 7 : java-1.8.0-oracle (RHSA-2018:0099)
  • 106183 - RHEL 6 / 7 : java-1.7.0-oracle (RHSA-2018:0100)
  • 109304 - RHEL 6 : java-1.6.0-sun (RHSA-2018:1203)
  • 109306 - RHEL 7 : java-1.6.0-sun (RHSA-2018:1205)
  • 110115 - RHEL 7 : java-1.8.0-ibm (RHSA-2018:1721)
  • 110116 - RHEL 6 : java-1.8.0-ibm (RHSA-2018:1722)
  • 110117 - RHEL 7 : java-1.7.1-ibm (RHSA-2018:1723)
  • 110118 - RHEL 6 : java-1.7.1-ibm (RHSA-2018:1724)
  • 110692 - RHEL 6 : java-1.7.1-ibm (RHSA-2018:1974)
  • 110793 - RHEL 6 : java-1.8.0-ibm (RHSA-2018:1975)
  • 110186 - SUSE SLES11 Security Update : java-1_7_1-ibm (SUSE-SU-2018:1447-1)
  • 110223 - SUSE SLES11 Security Update : java-1_7_0-ibm (SUSE-SU-2018:1458-1)
  • 110620 - SUSE SLES12 Security Update : java-1_8_0-ibm (SUSE-SU-2018:1738-1)
  • 118267 - SUSE SLES12 Security Update : java-1_8_0-ibm (SUSE-SU-2018:1738-2)
  • 110638 - SUSE SLES12 Security Update : java-1_7_1-ibm (SUSE-SU-2018:1764-1)
  • 118268 - SUSE SLES12 Security Update : java-1_7_1-ibm (SUSE-SU-2018:1764-2)
  • 120060 - SUSE SLES15 Security Update : java-1_8_0-ibm (SUSE-SU-2018:2068-1)

Version

This page has been produced using Nessus Professional 10.1.2 (#68) LINUX, Plugin set 202205072148.
Plugin file ubuntu_USN-3644-1.nasl version 1.7. For more plugins, visit the Nessus Plugin Library.

Go back to menu.