Oracle · Java SE
CVE-2012-4681
Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
Nedir
Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses SecurityManager restrictions by (1) using com.sun.beans.finder.ClassFinder.findClass and leveraging an exception with the forName method to access restricted classes from arbitrary packages such as sun.awt.SunToolkit, then (2) using "reflection with a trusted immediate caller" to leverage the getField method to access and modify private fields, as exploited in the wild in August 2012 using Gondzz.class and Gondvv.class.
CISA: The Java Runtime Environment (JRE) component in Oracle Java SE allow for remote code execution.
Ne yapmalı
Apply updates per vendor instructions.
ABD federal kurumları için son tarih: 24 Mart 2022
- CISA listesine eklenme
- 3 Mart 2022
- Yayımlanma
- 28 Ağustos 2012
- Önem
- Kritik 9,8 CVSS 3.1
- Önümüzdeki 30 günde saldırı olasılığı (EPSS)
- 99% bilinen tüm açıkların en üstteki 0,1% diliminde
- Daha fazla ayrıntı
- NVD · CVE.org · CISA
Tüm kaynaklar (14)
- http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00016.html
- http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00032.html
- http://marc.info/?l=bugtraq&m=135109152819176&w=2
- http://rhn.redhat.com/errata/RHSA-2012-1225.html
- http://marc.info/?l=bugtraq&m=135109152819176&w=2
- http://blog.fireeye.com/research/2012/08/zero-day-season-is-not-over-yet.html
- http://www.us-cert.gov/cas/techalerts/TA12-240A.html
- http://labs.alienvault.com/labs/index.php/2012/new-java-0day-exploited-in-the-wild/
- https://community.rapid7.com/community/metasploit/blog/2012/08/27/lets-start-the-week-with-a-new-java-0day
- http://www.deependresearch.org/2012/08/java-7-vulnerability-analysis.html
- http://www.oracle.com/technetwork/topics/security/alert-cve-2012-4681-1835715.html
- http://immunityproducts.blogspot.com/2012/08/java-0day-analysis-cve-2012-4681.html
- http://secunia.com/advisories/51044
- http://www.securityfocus.com/bid/55213
Oracle için istismar edilen diğer açıklar
| Eklenme | Açık | Ürün | Önem | Saldırı olasılığı |
|---|---|---|---|---|
| 28 Mar 2022 | Sandbox Bypass | Java SE | Kritik 9,8 | 91% |
| 28 Mar 2022 | Unspecified | Java SE | Kritik 9,8 | 99% |
| 3 Mar 2022 | Runtime Environment (JRE) Arbitrary Code Execution | Java SE | Kritik 9,8 | 98% |
| 3 Mar 2022 | Runtime Environment (JRE) Arbitrary Code Execution | Java SE | Kritik 9,8 | 94% |
| 3 Mar 2022 | and Java SE Embedded Remote Code Execution | Java SE | Kritik 9,8 | 25% |
| 3 Mar 2022 | Integrity Check | Java SE | Orta 5,3 | 14% |
| 24 Ağu 2026 | Improper Access Control | HTTP Server and Oracle Weblogic Server Proxy Plug-in | Kritik 10,0 | 73% |
| 15 Tem 2026 | Improper Privilege Management | E-Business Suite | Kritik 9,8 | 12% |
Kaynaklar: Known Exploited Vulnerabilities (CISA, kamu malı), CVE records (cve.org) ve EPSS (FIRST). Saldırı olasılığı, birinin önümüzdeki 30 günde açığı istismar etmeye çalışacağına dair EPSS tahminidir.