PT-2013-2299 · Oracle+4 · Java Se+6
Publicado
2013-03-08
·
Atualizado
2024-06-15
·
CVE-2013-0401
CVSS v2.0
10
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Java SE versions 7 Update 17 and earlier
Java SE versions 6 Update 43 and earlier
Java SE versions 5.0 Update 41 and earlier
OpenJDK versions 6 and 7
Description
The issue allows remote attackers to execute arbitrary code via vectors related to AWT. This was demonstrated by Ben Murphy during a Pwn2Own competition at CanSecWest 2013. The problem may be related to the invocation of the system class loader by the
sun.awt.datatransfer.ClassLoaderObjectInputStream class, which could allow remote attackers to bypass Java sandbox restrictions.Recommendations
For Java SE versions 7 Update 17 and earlier, update to a version later than Update 17.
For Java SE versions 6 Update 43 and earlier, update to a version later than Update 43.
For Java SE versions 5.0 Update 41 and earlier, update to a version later than Update 41.
For OpenJDK versions 6 and 7, consider disabling the
sun.awt.datatransfer.ClassLoaderObjectInputStream class as a temporary workaround until a patch is available.Exploit
Correção
RCE
Code Injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Centos
Hp-Ux
Java Platform
Java Se
Openjdk
Red Hat
Suse