How to remediate – AIX Java Advisory : java_apr2014_advisory.asc

1. Introduction

The vulnerability “AIX Java Advisory : java_apr2014_advisory.asc” affects versions of Java SDK installed on AIX systems. Multiple vulnerabilities exist within the Java platform, potentially allowing remote attackers to execute code or access sensitive information. This impacts confidentiality, integrity and availability depending on the specific exploit path used.

2. Technical Explanation

The affected Java SDK versions contain multiple flaws across various libraries including libjpeg, libpng, and Oracle Java components. These vulnerabilities range from information disclosure to remote code execution. An attacker could craft a malicious JPEG image to trigger an information leak in libjpeg, or exploit flaws in Oracle Java’s 2D image handling to execute arbitrary code on the target system. Successful exploitation requires a vulnerable version of Java SDK to be installed and accessible.

• Root cause: Multiple vulnerabilities exist including flawed input validation, insecure default configurations, and flaws in component handling.
• Exploit mechanism: Attackers can exploit these vulnerabilities by sending crafted data (e.g., malicious JPEG images) or leveraging specific Java features to trigger code execution.
• Scope: AIX systems with vulnerable versions of Java SDK installed are affected.

3. Detection and Assessment

To confirm vulnerability, check the installed Java version and review system logs for suspicious activity. A thorough assessment involves scanning for known vulnerabilities using a security scanner.

• Quick checks: Use the java -version command to determine the installed Java SDK version.
• Scanning: Nessus plugin ID 63277512 can identify vulnerable systems. This is an example only, other scanners may provide similar coverage.
• Logs and evidence: Review system logs for errors related to Java components or suspicious network activity originating from the Java process.

java -version

4. Solution / Remediation Steps

Apply fixes available from the AIX website by upgrading to a patched version of Java SDK.

4.1 Preparation

• A roll back plan involves restoring the previous Java SDK version if issues occur.

4.2 Implementation

1. Step 1: Download the appropriate patch for your AIX system from the IBM developerWorks website (http://www.ibm.com/developerworks/java/jdk/aix/service.html#levels).
2. Step 2: Install the downloaded patch using the standard AIX installation procedure (e.g., installp command).
3. Step 3: Verify that the patch has been successfully installed by running java -version and confirming the updated version number.

4.3 Config or Code Example

No config changes are required, only a software update.

4.4 Security Practices Relevant to This Vulnerability

Regular patch management is crucial for addressing vulnerabilities like these. Least privilege can limit the impact of successful exploitation by restricting Java’s access to system resources.

• Practice 1: Implement a regular patch cadence to ensure timely application of security updates.
• Practice 2: Apply least privilege principles, granting Java only the necessary permissions to function correctly.

4.5 Automation (Optional)

Automation is not directly applicable for this vulnerability without specific system management tools in place.

5. Verification / Validation

Confirm the fix by verifying the updated Java version and re-running detection scans. Perform a basic service smoke test to ensure functionality remains intact.

• Post-fix check: Run java -version and confirm that the output shows an updated, patched version of Java SDK.
• Re-test: Re-run the Nessus scan (ID 63277512) to verify that the vulnerability is no longer detected.

java -version

6. Preventive Measures and Monitoring

Update security baselines to include patched Java versions. Implement automated patch management pipelines to streamline updates.

• Baselines: Update your system baseline or configuration policy to require the latest Java SDK version.
• Pipelines: Integrate vulnerability scanning into CI/CD pipelines to identify and address vulnerabilities early in the development lifecycle.
• Asset and patch process: Review and update asset inventory and patch management processes to ensure timely updates of critical software like Java.

7. Risks, Side Effects, and Roll Back

Applying patches may cause compatibility issues with existing applications. A roll back plan involves restoring the previous Java SDK version.

• Roll back: Restore the system from a backup created prior to applying the patch, or uninstall the new patch using the standard AIX uninstallation procedure (e.g., installp -u command).

8. References and Resources

• Vendor advisory or bulletin: http://www.ibm.com/developerworks/java/jdk/aix/service.html#levels
• NVD or CVE entry: Multiple CVEs are listed in the vulnerability description above, see http://www.nessus.org/u?63277512 for details
• Product or platform documentation relevant to the fix: IBM AIX Java SDK documentation.