CVE-2012-4681
En bref
- Source
- NVD
- EPSS
- EPSS 98.54 % · centile 100 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- mitre
- Statut NVD
- Analyzed
Description
Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses SecurityManager restrictions by (1) using com.sun.beans.finder.ClassFinder.findClass and leveraging an exception with the forName method to access restricted classes from arbitrary packages such as sun.awt.SunToolkit, then (2) using "reflection with a trusted immediate caller" to leverage the getField method to access and modify private fields, as exploited in the wild in August 2012 using Gondzz.class and Gondvv.class.
Faiblesses (CWE)
- CWE-284 — Contrôle d'accès incorrect
Références
- http://blog.fireeye.com/research/2012/08/zero-day-season-is-not-over-yet.html
- http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00016.html
- http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00032.html
- http://www.us-cert.gov/cas/techalerts/TA12-240A.html
- http://labs.alienvault.com/labs/index.php/2012/new-java-0day-exploited-in-the-wild/
- http://marc.info/?l=bugtraq&m=135109152819176&w=2
- https://community.rapid7.com/community/metasploit/blog/2012/08/27/lets-start-the-week-with-a-new-java-0day
- http://www.deependresearch.org/2012/08/java-7-vulnerability-analysis.html
- http://www.oracle.com/technetwork/topics/security/alert-cve-2012-4681-1835715.html
- http://rhn.redhat.com/errata/RHSA-2012-1225.html
- http://immunityproducts.blogspot.com/2012/08/java-0day-analysis-cve-2012-4681.html
- http://secunia.com/advisories/51044
- http://www.securityfocus.com/bid/55213
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-4681
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
| CVSS 2.0 | HIGH 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2012-4606
- GCVE · GCVE-0-2012-4681
Avis du CERT-FR
- CERTFR-2017-AVI-228 — Multiples vulnérabilités dans SCADA Schneider Electric Trio TView · cert.ssi.gouv.fr
- CERTA-2012-AVI-595 — Multiples vulnérabilités dans les composants Java de HP-UX · cert.ssi.gouv.fr
- CERTA-2012-AVI-576 — Multiples vulnérabilités dans Oracle Java · cert.ssi.gouv.fr
- CERTA-2012-AVI-574 — Vulnérabilité dans le système SCADA Schneider Electric Critical Power and Cooling Services · cert.ssi.gouv.fr
- CERTA-2012-AVI-473 — Vulnérabilité dans Oracle Java · cert.ssi.gouv.fr
- CERTA-2012-ALE-005 — Vulnérabilité dans Oracle Java · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:oracle:jdk:1.6.0:-:*:*:*:*:*:*cpe:2.3:a:oracle:jdk:1.6.0:update1:*:*:*:*:*:*cpe:2.3:a:oracle:jdk:1.6.0:update10:*:*:*:*:*:*cpe:2.3:a:oracle:jdk:1.6.0:update11:*:*:*:*:*:*cpe:2.3:a:oracle:jdk:1.6.0:update12:*:*:*:*:*:*cpe:2.3:a:oracle:jdk:1.6.0:update13:*:*:*:*:*:*cpe:2.3:a:oracle:jdk:1.6.0:update14:*:*:*:*:*:*cpe:2.3:a:oracle:jdk:1.6.0:update15:*:*:*:*:*:*cpe:2.3:a:oracle:jdk:1.6.0:update16:*:*:*:*:*:*cpe:2.3:a:oracle:jdk:1.6.0:update17:*:*:*:*:*:*cpe:2.3:a:oracle:jdk:1.6.0:update18:*:*:*:*:*:*cpe:2.3:a:oracle:jdk:1.6.0:update19:*:*:*:*:*:*cpe:2.3:a:oracle:jdk:1.6.0:update2:*:*:*:*:*:*cpe:2.3:a:oracle:jdk:1.6.0:update20:*:*:*:*:*:*cpe:2.3:a:oracle:jdk:1.6.0:update21:*:*:*:*:*:*cpe:2.3:a:oracle:jdk:1.6.0:update22:*:*:*:*:*:*cpe:2.3:a:oracle:jdk:1.6.0:update23:*:*:*:*:*:*cpe:2.3:a:oracle:jdk:1.6.0:update24:*:*:*:*:*:*cpe:2.3:a:oracle:jdk:1.6.0:update25:*:*:*:*:*:*cpe:2.3:a:oracle:jdk:1.6.0:update26:*:*:*:*:*:*cpe:2.3:a:oracle:jdk:1.6.0:update27:*:*:*:*:*:*cpe:2.3:a:oracle:jdk:1.6.0:update29:*:*:*:*:*:*cpe:2.3:a:oracle:jdk:1.6.0:update3:*:*:*:*:*:*cpe:2.3:a:oracle:jdk:1.6.0:update30:*:*:*:*:*:*cpe:2.3:a:oracle:jdk:1.6.0:update31:*:*:*:*:*:*cpe:2.3:a:oracle:jdk:1.6.0:update32:*:*:*:*:*:*cpe:2.3:a:oracle:jdk:1.6.0:update33:*:*:*:*:*:*cpe:2.3:a:oracle:jdk:1.6.0:update34:*:*:*:*:*:*cpe:2.3:a:oracle:jdk:1.6.0:update4:*:*:*:*:*:*cpe:2.3:a:oracle:jdk:1.6.0:update5:*:*:*:*:*:*cpe:2.3:a:oracle:jdk:1.6.0:update6:*:*:*:*:*:*cpe:2.3:a:oracle:jdk:1.6.0:update7:*:*:*:*:*:*cpe:2.3:a:oracle:jdk:1.6.0:update8:*:*:*:*:*:*cpe:2.3:a:oracle:jdk:1.6.0:update9:*:*:*:*:*:*cpe:2.3:a:oracle:jdk:1.7.0:-:*:*:*:*:*:*cpe:2.3:a:oracle:jdk:1.7.0:update1:*:*:*:*:*:*cpe:2.3:a:oracle:jdk:1.7.0:update2:*:*:*:*:*:*cpe:2.3:a:oracle:jdk:1.7.0:update3:*:*:*:*:*:*cpe:2.3:a:oracle:jdk:1.7.0:update4:*:*:*:*:*:*cpe:2.3:a:oracle:jdk:1.7.0:update5:*:*:*:*:*:*- +45 autres
Produits affectés
| Produit | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| CISA Known Exploited Vulnerabilities | CC0 1.0 |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |