PT-2013-1342 · Oracle+3 · Java Runtime Environment+4

Kafeine · Published 2013-01-10 · Updated 2025-03-13 · CVE-2013-0422

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Java Runtime Environment (affected versions not specified)

Description The issue is related to the getMBeanInstantiator method in the JmxMBeanServer class of the Java Runtime Environment, which is associated with access control weaknesses. Exploitation of this issue may allow a remote attacker to execute arbitrary code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Improper Access Control

Weakness Enumeration

CWE-264

CWE-284

Related Identifiers

BDU:2022-03304

CESA-2013_0165

CVE-2013-0422

ELSA-2013-0165

OPENSUSE-SU-2013_0199-1

OPENSUSE-SU-2024:10534-1

RHSA-2013:0156

RHSA-2013:0165

RHSA-2013:0626

RHSA-2013_0156

RHSA-2013_0165

RHSA-2013_0626

Affected Products

Centos

Java Platform

Java Runtime Environment

Red Hat

Suse

References · 341

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_jre17_method_handle.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_jre17_jaxws.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/java_ws_double_quote.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_jre17_jmxbean_2.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/java_cmm.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_jre17_jmxbean.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ssl/bleichenbacher_oracle.py · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_jre17_glassfish_averagerangestatisticimpl.rb · Exploit
• 🔥 https://exploit-db.com/exploits/24045 · Exploit
• https://bdu.fstec.ru/vul/2022-03304 · Security Note
• http://rhn.redhat.com/errata/RHSA-2013-0165.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0156.html · Vendor Advisory
• http://oracle.com/technetwork/topics/security/alert-cve-2013-0422-1896849.html · Vendor Advisory
• http://ubuntu.com/usn/USN-1693-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00025.html · Vendor Advisory