PT-2012-2614 · Oracle+3 · Java Se+4

Published 2012-02-15 · Updated 2022-05-13 · CVE-2012-0498

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 7 Update 2 and earlier, 6 Update 30 and earlier, 5.0 Update 33 and earlier

Description The issue affects the Java Runtime Environment component, allowing remote attackers to impact confidentiality, integrity, and availability through unknown vectors related to 2D.

Recommendations For Oracle Java SE versions 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier, update to a version that is not affected by this issue. As a temporary workaround, consider restricting access to the Java Runtime Environment until a patch is available. Avoid using the readMabCurveData function with untrusted input for the nTblSize variable until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2012-0498

HPSBUX02757

HPSBUX02760

HPSBUX02784

RHSA-2012:0139

RHSA-2012:0508

RHSA-2012:0514

RHSA-2012_0139

RHSA-2012_0508

RHSA-2012_0514

RHSA-2013:1455

ZDI-12-060

Affected Products

Hp-Ux

Java Platform

Java Se

Red Hat

Suse

References · 85

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ssl/ssl_version.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/hashcollision_dos.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/misc/java_rmi_server.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_atomicreferencearray.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/misc/java_rmi_server.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/java_ws_vmargs.rb · Exploit
• 🔥 https://github.com/mpgn/BEAST-PoC · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3548 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3552 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0507 · Security Note
• http://marc.info/?l=bugtraq&m=133847939902305&w=2 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0501 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-12-060 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-5035 · Security Note
• http://rhn.redhat.com/errata/RHSA-2012-0508.html · Vendor Advisory