CVE-2012-4681

Опубликовано: 28 авг. 2012

Источник: nvd

CVSS3: 9.8

CVSS2: 10

EPSS Критический

Описание

Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses SecurityManager restrictions by (1) using com.sun.beans.finder.ClassFinder.findClass and leveraging an exception with the forName method to access restricted classes from arbitrary packages such as sun.awt.SunToolkit, then (2) using "reflection with a trusted immediate caller" to leverage the getField method to access and modify private fields, as exploited in the wild in August 2012 using Gondzz.class and Gondvv.class.

Ссылки

http://blog.fireeye.com/research/2012/08/zero-day-season-is-not-over-yet.html
Third Party Advisory
http://immunityproducts.blogspot.com/2012/08/java-0day-analysis-cve-2012-4681.html
Exploit
Third Party Advisory
http://labs.alienvault.com/labs/index.php/2012/new-java-0day-exploited-in-the-wild/
Broken Link
Exploit
http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00032.html
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00016.html
Mailing List
http://marc.info/?l=bugtraq&m=135109152819176&w=2
Issue Tracking
Mailing List
Third Party Advisory
http://marc.info/?l=bugtraq&m=135109152819176&w=2
Issue Tracking
Mailing List
Third Party Advisory
http://marc.info/?l=bugtraq&m=135109152819176&w=2
Issue Tracking
Mailing List
Third Party Advisory
http://marc.info/?l=bugtraq&m=135109152819176&w=2
Issue Tracking
Mailing List
Third Party Advisory
http://marc.info/?l=bugtraq&m=135109152819176&w=2
Issue Tracking
Mailing List
Third Party Advisory
http://marc.info/?l=bugtraq&m=135109152819176&w=2
Issue Tracking
Mailing List
Third Party Advisory
http://marc.info/?l=bugtraq&m=135109152819176&w=2
Issue Tracking
Mailing List
Third Party Advisory
http://marc.info/?l=bugtraq&m=135109152819176&w=2
Issue Tracking
Mailing List
Third Party Advisory
http://marc.info/?l=bugtraq&m=135109152819176&w=2
Issue Tracking
Mailing List
Third Party Advisory
http://marc.info/?l=bugtraq&m=135109152819176&w=2
Issue Tracking
Mailing List
Third Party Advisory
http://marc.info/?l=bugtraq&m=135109152819176&w=2
Issue Tracking
Mailing List
Third Party Advisory
http://marc.info/?l=bugtraq&m=135109152819176&w=2
Issue Tracking
Mailing List
Third Party Advisory
http://marc.info/?l=bugtraq&m=135109152819176&w=2
Issue Tracking
Mailing List
Third Party Advisory
http://marc.info/?l=bugtraq&m=135109152819176&w=2
Issue Tracking
Mailing List
Third Party Advisory
http://marc.info/?l=bugtraq&m=135109152819176&w=2
Issue Tracking
Mailing List
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:oracle:jdk:1.6.0:-:*:*:*:*:*:*

cpe:2.3:a:oracle:jdk:1.6.0:update1:*:*:*:*:*:*

cpe:2.3:a:oracle:jdk:1.6.0:update10:*:*:*:*:*:*

cpe:2.3:a:oracle:jdk:1.6.0:update11:*:*:*:*:*:*

cpe:2.3:a:oracle:jdk:1.6.0:update12:*:*:*:*:*:*

cpe:2.3:a:oracle:jdk:1.6.0:update13:*:*:*:*:*:*

cpe:2.3:a:oracle:jdk:1.6.0:update14:*:*:*:*:*:*

cpe:2.3:a:oracle:jdk:1.6.0:update15:*:*:*:*:*:*

cpe:2.3:a:oracle:jdk:1.6.0:update16:*:*:*:*:*:*

cpe:2.3:a:oracle:jdk:1.6.0:update17:*:*:*:*:*:*

cpe:2.3:a:oracle:jdk:1.6.0:update18:*:*:*:*:*:*

cpe:2.3:a:oracle:jdk:1.6.0:update19:*:*:*:*:*:*

cpe:2.3:a:oracle:jdk:1.6.0:update2:*:*:*:*:*:*

cpe:2.3:a:oracle:jdk:1.6.0:update20:*:*:*:*:*:*

cpe:2.3:a:oracle:jdk:1.6.0:update21:*:*:*:*:*:*

cpe:2.3:a:oracle:jdk:1.6.0:update22:*:*:*:*:*:*

cpe:2.3:a:oracle:jdk:1.6.0:update23:*:*:*:*:*:*

cpe:2.3:a:oracle:jdk:1.6.0:update24:*:*:*:*:*:*

cpe:2.3:a:oracle:jdk:1.6.0:update25:*:*:*:*:*:*

cpe:2.3:a:oracle:jdk:1.6.0:update26:*:*:*:*:*:*

cpe:2.3:a:oracle:jdk:1.6.0:update27:*:*:*:*:*:*

cpe:2.3:a:oracle:jdk:1.6.0:update29:*:*:*:*:*:*

cpe:2.3:a:oracle:jdk:1.6.0:update3:*:*:*:*:*:*

cpe:2.3:a:oracle:jdk:1.6.0:update30:*:*:*:*:*:*

cpe:2.3:a:oracle:jdk:1.6.0:update31:*:*:*:*:*:*

cpe:2.3:a:oracle:jdk:1.6.0:update32:*:*:*:*:*:*

cpe:2.3:a:oracle:jdk:1.6.0:update33:*:*:*:*:*:*

cpe:2.3:a:oracle:jdk:1.6.0:update34:*:*:*:*:*:*

cpe:2.3:a:oracle:jdk:1.6.0:update4:*:*:*:*:*:*

cpe:2.3:a:oracle:jdk:1.6.0:update5:*:*:*:*:*:*

cpe:2.3:a:oracle:jdk:1.6.0:update6:*:*:*:*:*:*

cpe:2.3:a:oracle:jdk:1.6.0:update7:*:*:*:*:*:*

cpe:2.3:a:oracle:jdk:1.6.0:update8:*:*:*:*:*:*

cpe:2.3:a:oracle:jdk:1.6.0:update9:*:*:*:*:*:*

cpe:2.3:a:oracle:jdk:1.7.0:-:*:*:*:*:*:*

cpe:2.3:a:oracle:jdk:1.7.0:update1:*:*:*:*:*:*

cpe:2.3:a:oracle:jdk:1.7.0:update2:*:*:*:*:*:*

cpe:2.3:a:oracle:jdk:1.7.0:update3:*:*:*:*:*:*

cpe:2.3:a:oracle:jdk:1.7.0:update4:*:*:*:*:*:*

cpe:2.3:a:oracle:jdk:1.7.0:update5:*:*:*:*:*:*

cpe:2.3:a:oracle:jdk:1.7.0:update6:*:*:*:*:*:*

cpe:2.3:a:oracle:jre:1.6.0:-:*:*:*:*:*:*

cpe:2.3:a:oracle:jre:1.6.0:update1:*:*:*:*:*:*

cpe:2.3:a:oracle:jre:1.6.0:update10:*:*:*:*:*:*

cpe:2.3:a:oracle:jre:1.6.0:update11:*:*:*:*:*:*

cpe:2.3:a:oracle:jre:1.6.0:update12:*:*:*:*:*:*

cpe:2.3:a:oracle:jre:1.6.0:update13:*:*:*:*:*:*

cpe:2.3:a:oracle:jre:1.6.0:update14:*:*:*:*:*:*

cpe:2.3:a:oracle:jre:1.6.0:update15:*:*:*:*:*:*

cpe:2.3:a:oracle:jre:1.6.0:update16:*:*:*:*:*:*

cpe:2.3:a:oracle:jre:1.6.0:update17:*:*:*:*:*:*

cpe:2.3:a:oracle:jre:1.6.0:update18:*:*:*:*:*:*

cpe:2.3:a:oracle:jre:1.6.0:update19:*:*:*:*:*:*

cpe:2.3:a:oracle:jre:1.6.0:update2:*:*:*:*:*:*

cpe:2.3:a:oracle:jre:1.6.0:update20:*:*:*:*:*:*

cpe:2.3:a:oracle:jre:1.6.0:update21:*:*:*:*:*:*

cpe:2.3:a:oracle:jre:1.6.0:update22:*:*:*:*:*:*

cpe:2.3:a:oracle:jre:1.6.0:update23:*:*:*:*:*:*

cpe:2.3:a:oracle:jre:1.6.0:update24:*:*:*:*:*:*

cpe:2.3:a:oracle:jre:1.6.0:update25:*:*:*:*:*:*

cpe:2.3:a:oracle:jre:1.6.0:update26:*:*:*:*:*:*

cpe:2.3:a:oracle:jre:1.6.0:update27:*:*:*:*:*:*

cpe:2.3:a:oracle:jre:1.6.0:update29:*:*:*:*:*:*

cpe:2.3:a:oracle:jre:1.6.0:update3:*:*:*:*:*:*

cpe:2.3:a:oracle:jre:1.6.0:update30:*:*:*:*:*:*

cpe:2.3:a:oracle:jre:1.6.0:update31:*:*:*:*:*:*

cpe:2.3:a:oracle:jre:1.6.0:update32:*:*:*:*:*:*

cpe:2.3:a:oracle:jre:1.6.0:update33:*:*:*:*:*:*

cpe:2.3:a:oracle:jre:1.6.0:update34:*:*:*:*:*:*

cpe:2.3:a:oracle:jre:1.6.0:update4:*:*:*:*:*:*

cpe:2.3:a:oracle:jre:1.6.0:update5:*:*:*:*:*:*

cpe:2.3:a:oracle:jre:1.6.0:update6:*:*:*:*:*:*

cpe:2.3:a:oracle:jre:1.6.0:update7:*:*:*:*:*:*

cpe:2.3:a:oracle:jre:1.6.0:update9:*:*:*:*:*:*

cpe:2.3:a:oracle:jre:1.7.0:-:*:*:*:*:*:*

cpe:2.3:a:oracle:jre:1.7.0:update1:*:*:*:*:*:*

cpe:2.3:a:oracle:jre:1.7.0:update2:*:*:*:*:*:*

cpe:2.3:a:oracle:jre:1.7.0:update3:*:*:*:*:*:*

cpe:2.3:a:oracle:jre:1.7.0:update4:*:*:*:*:*:*

cpe:2.3:a:oracle:jre:1.7.0:update5:*:*:*:*:*:*

cpe:2.3:a:oracle:jre:1.7.0:update6:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:6.3:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*

EPSS

Процентиль: 100%

0.9414

Критический

9.8 Critical

CVSS3

10 Critical

CVSS2

Дефекты

NVD-CWE-noinfo

CWE-284

Связанные уязвимости

CVE-2012-4681

CVSS3: 9.8

ubuntu

около 13 лет назад

CVE-2012-4681

redhat

около 13 лет назад

CVE-2012-4681

CVSS3: 9.8

debian

около 13 лет назад

Multiple vulnerabilities in the Java Runtime Environment (JRE) compone ...

GHSA-fw99-8m5g-58p8

CVSS3: 9.8

github

больше 3 лет назад

BDU:2021-04417

fstec

около 13 лет назад

Уязвимость компонента Java Runtime Environment (JRE) программных платформ Java SE, позволяющая нарушителю выполнить произвольный код

EPSS

Процентиль: 100%

0.9414

Критический

9.8 Critical

CVSS3

10 Critical

CVSS2

Дефекты

NVD-CWE-noinfo

CWE-284