PT-2013-1342 · Oracle+3 · Java Runtime Environment+4

Kafeine · Publicado 2013-01-10 · Atualizado 2025-03-13 · CVE-2013-0422

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Java Runtime Environment (affected versions not specified)

Description The issue is related to the getMBeanInstantiator method in the JmxMBeanServer class of the Java Runtime Environment, which is associated with access control weaknesses. Exploitation of this issue may allow a remote attacker to execute arbitrary code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Improper Access Control

Enumeração de Fraquezas

CWE-264

CWE-284

Identificadores relacionados

BDU:2022-03304

CESA-2013_0165

CVE-2013-0422

ELSA-2013-0165

OPENSUSE-SU-2013_0199-1

OPENSUSE-SU-2024:10534-1

RHSA-2013:0156

RHSA-2013:0165

RHSA-2013:0626

RHSA-2013_0156

RHSA-2013_0165

RHSA-2013_0626

Produtos afetados

Centos

Java Platform

Java Runtime Environment

Red Hat

Suse

Referências · 341

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_jre17_method_handle.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_jre17_jaxws.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/java_ws_double_quote.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_jre17_jmxbean_2.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/java_cmm.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_jre17_jmxbean.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ssl/bleichenbacher_oracle.py · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_jre17_glassfish_averagerangestatisticimpl.rb · Exploit
• 🔥 https://exploit-db.com/exploits/24045 · Exploit
• https://suse.com/security/cve/CVE-2012-5069 · Nota
• https://suse.com/security/cve/CVE-2013-5783 · Nota
• https://suse.com/security/cve/CVE-2014-0376 · Nota
• https://suse.com/security/cve/CVE-2013-2454 · Nota
• https://suse.com/security/cve/CVE-2014-2412 · Nota
• https://suse.com/security/cve/CVE-2014-6517 · Nota