Oracle · Java SE
CVE-2012-4681
Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
Cos'è
Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses SecurityManager restrictions by (1) using com.sun.beans.finder.ClassFinder.findClass and leveraging an exception with the forName method to access restricted classes from arbitrary packages such as sun.awt.SunToolkit, then (2) using "reflection with a trusted immediate caller" to leverage the getField method to access and modify private fields, as exploited in the wild in August 2012 using Gondzz.class and Gondvv.class.
CISA: The Java Runtime Environment (JRE) component in Oracle Java SE allow for remote code execution.
Cosa fare
Apply updates per vendor instructions.
Scadenza per le agenzie federali USA: 24 marzo 2022
- Aggiunta all'elenco CISA
- 3 marzo 2022
- Pubblicato
- 28 agosto 2012
- Gravità
- Critica 9,8 CVSS 3.1
- Probabilità di attacchi nei prossimi 30 giorni (EPSS)
- 99% tra il 0,1% più alto di tutte le vulnerabilità note
- Più dettagli
- NVD · CVE.org · CISA
Tutte le fonti (14)
- http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00016.html
- http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00032.html
- http://marc.info/?l=bugtraq&m=135109152819176&w=2
- http://rhn.redhat.com/errata/RHSA-2012-1225.html
- http://marc.info/?l=bugtraq&m=135109152819176&w=2
- http://blog.fireeye.com/research/2012/08/zero-day-season-is-not-over-yet.html
- http://www.us-cert.gov/cas/techalerts/TA12-240A.html
- http://labs.alienvault.com/labs/index.php/2012/new-java-0day-exploited-in-the-wild/
- https://community.rapid7.com/community/metasploit/blog/2012/08/27/lets-start-the-week-with-a-new-java-0day
- http://www.deependresearch.org/2012/08/java-7-vulnerability-analysis.html
- http://www.oracle.com/technetwork/topics/security/alert-cve-2012-4681-1835715.html
- http://immunityproducts.blogspot.com/2012/08/java-0day-analysis-cve-2012-4681.html
- http://secunia.com/advisories/51044
- http://www.securityfocus.com/bid/55213
Altre falle sfruttate di Oracle
| Aggiunto | Vulnerabilità | Prodotto | Gravità | Probabilità di attacco |
|---|---|---|---|---|
| 28 mar 2022 | Sandbox Bypass | Java SE | Critica 9,8 | 91% |
| 28 mar 2022 | Unspecified | Java SE | Critica 9,8 | 99% |
| 3 mar 2022 | Runtime Environment (JRE) Arbitrary Code Execution | Java SE | Critica 9,8 | 98% |
| 3 mar 2022 | Runtime Environment (JRE) Arbitrary Code Execution | Java SE | Critica 9,8 | 94% |
| 3 mar 2022 | and Java SE Embedded Remote Code Execution | Java SE | Critica 9,8 | 25% |
| 3 mar 2022 | Integrity Check | Java SE | Media 5,3 | 14% |
| 24 ago 2026 | Improper Access Control | HTTP Server and Oracle Weblogic Server Proxy Plug-in | Critica 10,0 | 73% |
| 15 lug 2026 | Improper Privilege Management | E-Business Suite | Critica 9,8 | 12% |
Fonti: Known Exploited Vulnerabilities (CISA, pubblico dominio), CVE records (cve.org) e EPSS (FIRST). La probabilità di attacco è la stima EPSS che qualcuno provi a sfruttare la falla nei prossimi 30 giorni.