APC Security Advisory - InfraStruxure Central 5.0 Java Runtime Environment

Consulter notre FAQ

Issue:

APC Security Advisory - InfraStruxure Central 5.0 Java Runtime Environment

Product Line:

InfraStruxure Central

Environment:

InfraStruxure Central version 5.0

Cause:

InfraStruxure Central utilizes Java which can contain vulnerabilities. The information below goes over known issues and resolutions where applicable.

Resolution:

Security Vulnerabilities in the Java Runtime Environment related to the processing of XML Data. [1]

Problem Summary
A vulnerability in the Java Runtime Environment related to the processing of XML data may allow unauthorized access to certain URL resources (such as some files and web pages) or a Denial of Service (DoS) condition to be created on the system running the JRE. A second vulnerability in the Java Runtime Environment with processing XML data may allow an untrusted applet or application that is downloaded from a website unauthorized access to certain URL resources (such as some files and web pages).

Severity Risk
Low for a vulnerable APC installed JRE
Low for processing of malicious XML data

Affected Products
The following products may install a vulnerable JRE and will be updated to include the most recent non-vulnerable JRE in the next regularly scheduled product update.

InfraStruXure Central 5.0 Client for Windows and Linux
InfraStruXure Central Server

Mitigating Factors
The InfraStruXure Central Client installer does not associate the packaged JRE with the local system’s web browser and does not include the packaged JRE in the standard execution path. Therefore, it is very unlikely for an untrusted applet to execute in the context of the APC installed JRE unless the system administrator manually configures the system to do so. Also, although InfraStruXure Central does allow the uploading of XML data, the data must adhere to strict guidelines before being processed, making the likelihood of malicious code execution low.

Recommendations and workarounds:
Download and install the newest JRE to all machines running the InfraStruXure Central Client (http://java.com/). When it becomes available, upgrade the InfraStruXure Central Server using the next regularly scheduled product update.

A Security Vulnerability with the processing of fonts in the Java Runtime Environment may allow Elevation of Privileges. [2]

Problem Summary
A buffer overflow security vulnerability with the processing of fonts in the Java Runtime Environment (JRE) may allow an untrusted applet or application to elevate its privileges. For example, an untrusted applet may grant itself permissions to read and write local files or execute local applications that are accessible to the user running the untrusted applet.

Severity Risk
No risk.
Affected Products
None

Mitigating Factors
The InfraStruXure Central Client uses one font throughout all user input fields. The InfraStruXure Central Client installer does not associate the packaged JRE with the local system’s web browser and does not include the packaged JRE in the standard execution path. Therefore, it is very unlikely for an untrusted applet to execute in the context of the APC installed JRE unless the system administrator manually configures the system to do so. Also, InfraStruXure Central does not utilize applets.

Recommendations and workarounds
Download and install the newest JRE to all machines running the InfraStruXure Central Client (http://java.com/).

Security Vulnerabilities in the Java Runtime Environment Scripting Language Support. [3]

Problem Summary
A vulnerability in the Java Runtime Environment relating to scripting language support may allow an untrusted applet or application to elevate its privileges. For example, an untrusted applet may grant itself permissions to read and write local files or execute local applications that are accessible to the user running the untrusted applet. A second vulnerability in the Java Runtime Environment relating to scripting language support may allow an untrusted applet to access information from another applet.