CVE-2013-0422

Oracle JRE Remote Code Execution Vulnerability

Jdk

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public getMBeanInstantiator method in the JmxMBeanServer class to obtain a reference to a private MBeanInstantiator object, then retrieving arbitrary Class references using the findClass method, and (2) using the Reflection API with recursion in a way that bypasses a security check by the java.lang.invoke.MethodHandles.Lookup.checkSecurityManager…

10. Jan 2013

Ausgewertete Quellen

• Red Hat
  http://rhn.redhat.com/errata/RHSA-2013-0156.html
• Red Hat
  http://rhn.redhat.com/errata/RHSA-2013-0165.html
• Ubuntu
  http://www.ubuntu.com/usn/USN-1693-1
• Hersteller
  http://www.oracle.com/technetwork/topics/security/alert-cve-2013-0422-1896849.html
• Hinweis
  http://immunityproducts.blogspot.ca/2013/01/confirmed-java-only-fixed-one-of-two.html
• Hinweis
  http://krebsonsecurity.com/2013/01/zero-day-java-exploit-debuts-in-crimeware/
• Hinweis
  http://labs.alienvault.com/labs/index.php/2013/new-year-new-java-zeroday/
• Hinweis
  http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00025.html
• Hinweis
  http://malware.dontneedcoffee.com/2013/01/0-day-17u10-spotted-in-while-disable.html
• Hinweis
  http://seclists.org/bugtraq/2013/Jan/48
• Hinweis
  http://www.kb.cert.org/vuls/id/625617
• Hinweis
  http://www.us-cert.gov/cas/techalerts/TA13-010A.html
• Hinweis
  https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0018
• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-0422
• CISA
  Oracle JRE Remote Code Execution Vulnerability
• NVD
  CVE-2013-0422