IBM Java detection updates

Summary

Tenable’s detection plugins for Java now use additional methods to detect IBM Java.

Change

A series of plugins are used to detect Java JRE on scan targets. For Java installs on Windows, plugin 148499 performs initial detection.

In June 2023, we updated Java plugins in response to a security advisory, with several defense-in-depth fixes and added several alternative methods, such as inspection of files that are often included with the distributions.

Recently, Tenable was notified that detection of IBM Java for Windows was failing to collect a sufficiently granular version of the product for accurate vulnerability determination in certain cases. Additional files that contain the granular version number were identified and are now used for detection on that platform.

Tenable will continue to enhance our detection of IBM Java JRE for corner cases, as they are identified, which would enable holistic detection in customers’ environments.

Impact

Plugin 148499 will now examine an additional set of files to identify IBM Java on Windows platforms to collect a granular version number, so that downstream vulnerability determination can be made.

Plugin

148499 - Java Detection and Identification (Windows)

Target Release Date

September 5, 2023