CVE-2012-4681

Scores

EPSS

0.941high94.1%
0%20%40%60%80%100%

Percentile: 94.1%

CVSS

9.8critical3.x
0246810

CVSS Score: 9.8/10

All CVSS Scores

CVSS 3.x
9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS 2.0
6.8

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Description

Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses SecurityManager restrictions by (1) using com.sun.beans.finder.ClassFinder.findClass and leveraging an exception with the forName method to access restricted classes from arbitrary packages such as sun.awt.SunToolkit, then (2) using “reflection with a trusted immediate caller” to leverage the getField method to access and modify private fields, as exploited in the wild in August 2012 using Gondzz.class and Gondvv.class.

Scaner-VS 7 — a modern vulnerability management solution

Uses this database for vulnerability detection. High-speed search, cross-platform, advanced configuration audit, and flexible filtering. Suitable for organizations of any size.
Learn more about Scaner-VS 7

Sources

debiannvdredhatubuntu

CWEs

CWE-284

Related Vulnerabilities

Exploits

Exploit ID: 20865

Source: exploitdb

URL: https://www.exploit-db.com/exploits/20865

Exploit ID: CVE-2012-4681

Source: github-poc

URL: https://github.com/benjholla/CVE-2012-4681-Armoring

Recommendations

Source: nvd

Before applying this update, make sure all previously-released erratarelevant to your system have been applied.
This update is available via the Red Hat Network. Details on how touse the Red Hat Network to apply this update are available athttps://access.redhat.com/knowledge/articles/11258

URL: http://rhn.redhat.com/errata/RHSA-2012-1225.html

Vulnerable Software (14)

Type: Configuration

Product: java-1.7.0-ibm

Operating System: rhel

Trait:
{  "fixed": "1.7.0.2.0-1jpp.3.el6_3"}

Source: redhat

Type: Configuration

Product: java-1.7.0-openjdk

Operating System: rhel 6

Trait:
{  "fixed": "1.7.0.5-2.2.1.el6_3.3"}

Source: redhat

Type: Configuration

Product: java-1.7.0-oracle

Operating System: rhel

Trait:
{  "fixed": "1.7.0.7-1jpp.5.el6_3"}

Source: redhat

Type: Configuration

Product: openjdk-6

Operating System: ubuntu hardy 8.04

Trait:
{  "unfixed": true}

Source: ubuntu

Type: Configuration

Product: openjdk-6

Operating System: debian

Trait:
{  "unaffected": true}

Source: debian

Type: Configuration

Product: openjdk-7

Operating System: debian

Trait:
{  "fixed": "7u3-2.1.2-1"}

Source: debian

Type: Configuration

Product: sun-java5

Operating System: ubuntu hardy 8.04

Trait:
{  "unfixed": true}

Source: ubuntu

Type: Configuration

Product: sun-java6

Operating System: ubuntu hardy 8.04

Trait:
{  "unfixed": true}

Source: ubuntu

Type: Configuration

Vendor: *

Product: enterprise_linux_desktop

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*",      "vulnerable": true    },    {      "cpe23uri": "cpe:2.3:o:redhat:enterprise_linux_eus...

Source: nvd

Type: Configuration

Vendor: *

Product: enterprise_linux_eus

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*",      "vulnerable": true    },    {      "cpe23uri": "cpe:2.3:o:redhat:enterprise_linux_eus...

Source: nvd

Type: Configuration

Vendor: *

Product: enterprise_linux_server

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*",      "vulnerable": true    },    {      "cpe23uri": "cpe:2.3:o:redhat:enterprise_linux_eus...

Source: nvd

Type: Configuration

Vendor: *

Product: enterprise_linux_workstation

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*",      "vulnerable": true    },    {      "cpe23uri": "cpe:2.3:o:redhat:enterprise_linux_eus...

Source: nvd

Type: Configuration

Vendor: *

Product: jdk

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:a:oracle:jdk:1.6.0:-:*:*:*:*:*:*",      "vulnerable": true    },    {      "cpe23uri": "cpe:2.3:a:oracle:jdk:1.6.0:update1:*:*:*:*:*:*",      "...

Source: nvd

Type: Configuration

Vendor: *

Product: jre

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:a:oracle:jdk:1.6.0:-:*:*:*:*:*:*",      "vulnerable": true    },    {      "cpe23uri": "cpe:2.3:a:oracle:jdk:1.6.0:update1:*:*:*:*:*:*",      "...

Source: nvd

End of list