PT-2012-1238 · Oracle+4 · Java Runtime Environment+5

Tomas Hoger · CVE-2012-0507 · Publicado 2012-02-09 · Atualizado 2025-04-03

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Java Runtime Environment versions 5.0 Update 33 and earlier Java Runtime Environment versions 6 Update 30 and earlier Java Runtime Environment versions 7 Update 2 and earlier

Description The issue is related to an unspecified vulnerability in the Java Runtime Environment component, allowing remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Concurrency. This may be caused by the AtomicReferenceArray class implementation not ensuring that the array is of the Object[] type, potentially allowing attackers to cause a denial of service or bypass Java sandbox restrictions.

Recommendations For Java Runtime Environment versions 5.0 Update 33 and earlier, update to a version later than Update 33 to resolve the issue. For Java Runtime Environment versions 6 Update 30 and earlier, update to a version later than Update 30 to resolve the issue. For Java Runtime Environment versions 7 Update 2 and earlier, update to a version later than Update 2 to resolve the issue. As a temporary workaround, consider restricting access to the Concurrency component until a patch is available.

Exploit

Correção

DoS

Type Confusion

Enumeração de Fraquezas

CWE-843

CWE-136

Identificadores relacionados

BDU:2022-04096

CESA-2012_0135

CVE-2012-0507

DSA-2420-1

HPSBUX02757

HPSBUX02760

HPSBUX02784

RHSA-2012:0135

RHSA-2012:0139

RHSA-2012:0322

RHSA-2012:0508

RHSA-2012:0514

RHSA-2012_0135

RHSA-2012_0139

RHSA-2012_0322

RHSA-2012_0508

RHSA-2012_0514

RHSA-2013:1455

Produtos afetados

Centos

Hp-Ux

Java Platform

Java Runtime Environment

Red Hat

Suse

Referências · 53

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/misc/java_rmi_server.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_rhino.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/java_ws_vmargs.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_atomicreferencearray.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/hashcollision_dos.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ssl/ssl_version.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/misc/java_rmi_server.rb · Exploit
• 🔥 https://github.com/FireFart/HashCollision-DOS-POC/blob/master/HashtablePOC.py · Exploit
• 🔥 https://github.com/mpgn/BEAST-PoC · Exploit
• 🔥 https://github.com/bunseokbot/CVE-2016-5699-poc · Exploit
• 🔥 https://github.com/insuyun/CVE-2016-5636 · Exploit
• 🔥 https://github.com/tna0y/CVE-2018-1000802-PoC · Exploit
• 🔥 http://securityfocus.com/bid/52161 · Exploit
• 🔥 http://weblog.ikvm.net/PermaLink.aspx?guid=cd48169a-9405-4f63-9087-798c4a1866d3 · Exploit
• 🔥 https://exploit-db.com/exploits/18679 · Exploit