Are old, unused Java SE JRE files insecure?

Question

We have an agent application deployed to some internal web servers that runs on java, and installs a specific JRE to use. The agent updates regularly and installs updated JRE versions to use, but doesn't remove the old files.

Our security team gets a notification that this in insecure even if secure versions are installed and in use - specifically: https://www.tenable.com/plugins/nessus/92517

What kind of risks are there to having old JREs installed, even if not in use by any application?

To clarify: my understanding is that Java exploits target running processes, applications or the jre/jdk installers, and that the JRE files aren't more or less insecure than any other programming language's source files. Is there an attack vector in which having JRE files on a box is more dangerous than having bash installed?

Answer 1

If it's literally code that's sitting on the server, but is never executed, the risks are mostly one of miss-configuration. Unless the java code has some special privileges assigned to it, or special location, I don't see how it's any different from any other executable that shouldn't be running. If the attacker can execute this exploitable java code, can they, as you say, execute bash? If they can do that, it's not java's fault, it's the attack vector that lead to code being executed that shouldn't be.

I wouldn't dismiss the miss-config issue however. If you've got 10 versions of Java sitting around, and 8 of which are compromised in some way, it's possible that someone could miss configure the server to use the old exploitable code. It might be an emergency situation where they tried a different jvm, or just an honest mistake.

But if I were making the call, I'd classify it as "high", not critical. I'd also make sure it gets fixed, or mitigated.