CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
EPSS
Percentile
87.5%
Updated to icedtea-web 1.4.1 New in release 1.4.1 (2013-XX-YY) :
Improved and cleaned Temporary internet files panel
PR1465 - java.io.FileNotFoundException while trying to download a JAR file
PR1473 - javaws should not depend on name of local file
PR854: Resizing an applet several times causes 100% CPU load
CVE-2012-4540, RH869040: Heap-based buffer overflow after triggering event attached to applet
reproducers tests are enabled in dist-tarball
application context support for OpenJDK build 25 and higher
small patches into rhino support and
PR1533: Inherit jnlp.packEnabled and jnlp.versionEnabled like other properties
add icedtea-web man page
make check enabled again
should be build for non-standart archs
removed unused multilib arches
Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
#%NASL_MIN_LEVEL 70300
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Fedora Security Advisory 2013-16971.
#
include('deprecated_nasl_level.inc');
include('compat.inc');
if (description)
{
script_id(70060);
script_version("1.8");
script_set_attribute(attribute:"plugin_modification_date", value:"2021/01/11");
script_cve_id("CVE-2012-4540");
script_bugtraq_id(56434, 62426);
script_xref(name:"FEDORA", value:"2013-16971");
script_name(english:"Fedora 20 : icedtea-web-1.4.1-0.fc20 (2013-16971)");
script_summary(english:"Checks rpm output for the updated package.");
script_set_attribute(
attribute:"synopsis",
value:"The remote Fedora host is missing a security update."
);
script_set_attribute(
attribute:"description",
value:
"Updated to icedtea-web 1.4.1 New in release 1.4.1 (2013-XX-YY) :
- Improved and cleaned Temporary internet files panel
- PR1465 - java.io.FileNotFoundException while trying to
download a JAR file
- PR1473 - javaws should not depend on name of local
file
- PR854: Resizing an applet several times causes 100%
CPU load
- CVE-2012-4540, RH869040: Heap-based buffer overflow
after triggering event attached to applet
- reproducers tests are enabled in dist-tarball
- application context support for OpenJDK build 25 and
higher
- small patches into rhino support and
- PR1533: Inherit jnlp.packEnabled and
jnlp.versionEnabled like other properties
- add icedtea-web man page
- make check enabled again
- should be build for non-standart archs
- removed unused multilib arches
Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
);
script_set_attribute(
attribute:"see_also",
value:"https://bugzilla.redhat.com/show_bug.cgi?id=1007960"
);
# https://lists.fedoraproject.org/pipermail/package-announce/2013-September/116466.html
script_set_attribute(
attribute:"see_also",
value:"http://www.nessus.org/u?dd54ac18"
);
script_set_attribute(
attribute:"solution",
value:"Update the affected icedtea-web package."
);
script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
script_set_cvss_temporal_vector("CVSS2#E:ND/RL:OF/RC:C");
script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
script_set_attribute(attribute:"exploit_available", value:"false");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:icedtea-web");
script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:20");
script_set_attribute(attribute:"patch_publication_date", value:"2013/09/17");
script_set_attribute(attribute:"plugin_publication_date", value:"2013/09/23");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_copyright(english:"This script is Copyright (C) 2013-2021 Tenable Network Security, Inc.");
script_family(english:"Fedora Local Security Checks");
script_dependencies("ssh_get_info.nasl");
script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");
exit(0);
}
include("audit.inc");
include("global_settings.inc");
include("rpm.inc");
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
os_ver = os_ver[1];
if (! ereg(pattern:"^20([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 20.x", "Fedora " + os_ver);
if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);
flag = 0;
if (rpm_check(release:"FC20", reference:"icedtea-web-1.4.1-0.fc20")) flag++;
if (flag)
{
if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
else security_warning(0);
exit(0);
}
else
{
tested = pkg_tests_get();
if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
else audit(AUDIT_PACKAGE_NOT_INSTALLED, "icedtea-web");
}