PT-2012-2616 · Oracle+3 · Java Se+6

Publicado 2012-02-15 · Atualizado 2022-05-13 · CVE-2012-0500

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Java SE versions 7 Update 2 and earlier, 6 Update 30 and earlier JavaFX versions 2.0.2 and earlier

Description The issue allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to the implementation of the Java Runtime Environment (JRE) component.

Recommendations For Java SE versions 7 Update 2 and earlier, 6 Update 30 and earlier, consider disabling the use of untrusted Java Web Start applications and untrusted Java applets until a patch is available. For JavaFX versions 2.0.2 and earlier, restrict access to untrusted Java applets to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2012-0500

HPSBUX02757

HPSBUX02784

RHSA-2012:0139

RHSA-2012:0514

RHSA-2012_0139

RHSA-2012_0514

RHSA-2013:1455

Produtos afetados

Hp-Ux

Java Platform

Java Runtime Environment

Java Se

Javafx

Red Hat

Suse

Referências · 25

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/java_ws_vmargs.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_atomicreferencearray.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/misc/java_rmi_server.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/hashcollision_dos.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ssl/ssl_version.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/misc/java_rmi_server.rb · Exploit
• 🔥 https://github.com/FireFart/HashCollision-DOS-POC/blob/master/HashtablePOC.py · Exploit
• 🔥 https://github.com/mpgn/BEAST-PoC · Exploit
• 🔥 https://exploit-db.com/exploits/18520 · Exploit
• http://secunia.com/advisories/48950 · Nota
• https://oracle.com/security-alerts/javacpufeb2012verbose.html · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14844 · Nota
• https://oracle.com/security-alerts/javacpufeb2012.html · Nota
• http://rhn.redhat.com/errata/RHSA-2013-1455.html · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=133847939902305&w=2 · Aviso do Fabricante