Oracle · Java SE
CVE-2012-4681
Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
O que é
Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses SecurityManager restrictions by (1) using com.sun.beans.finder.ClassFinder.findClass and leveraging an exception with the forName method to access restricted classes from arbitrary packages such as sun.awt.SunToolkit, then (2) using "reflection with a trusted immediate caller" to leverage the getField method to access and modify private fields, as exploited in the wild in August 2012 using Gondzz.class and Gondvv.class.
CISA: The Java Runtime Environment (JRE) component in Oracle Java SE allow for remote code execution.
O que fazer
Apply updates per vendor instructions.
Prazo para as agências federais dos EUA: 24 de março de 2022
- Adicionada à lista da CISA
- 3 de março de 2022
- Publicada
- 28 de agosto de 2012
- Gravidade
- Crítica 9,8 CVSS 3.1
- Chance de ataques nos próximos 30 dias (EPSS)
- 99% entre os 0,1% mais altos de todas as vulnerabilidades conhecidas
- Mais detalhes
- NVD · CVE.org · CISA
Todas as referências (14)
- http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00016.html
- http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00032.html
- http://marc.info/?l=bugtraq&m=135109152819176&w=2
- http://rhn.redhat.com/errata/RHSA-2012-1225.html
- http://marc.info/?l=bugtraq&m=135109152819176&w=2
- http://blog.fireeye.com/research/2012/08/zero-day-season-is-not-over-yet.html
- http://www.us-cert.gov/cas/techalerts/TA12-240A.html
- http://labs.alienvault.com/labs/index.php/2012/new-java-0day-exploited-in-the-wild/
- https://community.rapid7.com/community/metasploit/blog/2012/08/27/lets-start-the-week-with-a-new-java-0day
- http://www.deependresearch.org/2012/08/java-7-vulnerability-analysis.html
- http://www.oracle.com/technetwork/topics/security/alert-cve-2012-4681-1835715.html
- http://immunityproducts.blogspot.com/2012/08/java-0day-analysis-cve-2012-4681.html
- http://secunia.com/advisories/51044
- http://www.securityfocus.com/bid/55213
Mais falhas exploradas de Oracle
| Adicionado | Vulnerabilidade | Produto | Gravidade | Chance de ataque |
|---|---|---|---|---|
| 28 de mar. de 2022 | Sandbox Bypass | Java SE | Crítica 9,8 | 91% |
| 28 de mar. de 2022 | Unspecified | Java SE | Crítica 9,8 | 99% |
| 3 de mar. de 2022 | Runtime Environment (JRE) Arbitrary Code Execution | Java SE | Crítica 9,8 | 98% |
| 3 de mar. de 2022 | Runtime Environment (JRE) Arbitrary Code Execution | Java SE | Crítica 9,8 | 94% |
| 3 de mar. de 2022 | and Java SE Embedded Remote Code Execution | Java SE | Crítica 9,8 | 25% |
| 3 de mar. de 2022 | Integrity Check | Java SE | Média 5,3 | 14% |
| 24 de ago. de 2026 | Improper Access Control | HTTP Server and Oracle Weblogic Server Proxy Plug-in | Crítica 10,0 | 73% |
| 15 de jul. de 2026 | Improper Privilege Management | E-Business Suite | Crítica 9,8 | 12% |
Fontes: Known Exploited Vulnerabilities (CISA, domínio público), CVE records (cve.org) e EPSS (FIRST). A chance de ataque é a estimativa EPSS de que alguém tente explorar a falha nos próximos 30 dias.