PT-2013-2339 · Oracle+4 · Oracle Java Se+6

Tomas Hoger · Published 2013-02-01 · Updated 2024-06-15 · CVE-2013-0444

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 7 through Update 11 OpenJDK 7

Description The issue allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Beans. It is reportedly related to insufficient checks for cached results by the Java Beans MethodFinder, which might allow attackers to access methods that should only be accessible to privileged code.

Recommendations For Oracle Java SE versions 7 through Update 11, update to a version later than Update 11. For OpenJDK 7, consider disabling the Java Beans MethodFinder as a temporary workaround until a patch is available.

Exploit

Fix

Related Identifiers

CESA-2013_0247

CVE-2013-0444

HPSBUX02857

OPENSUSE-SU-2013_0377-1

OPENSUSE-SU-2024:10534-1

RHSA-2013:0237

RHSA-2013:0247

RHSA-2013:0626

RHSA-2013_0237

RHSA-2013_0247

RHSA-2013_0626

Affected Products

Centos

Hp-Ux

Java Platform

Openjdk

Oracle Java Se

Red Hat

Suse

References · 457

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_jre17_jmxbean.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/java_cmm.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_jre17_jmxbean_2.rb · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-0422 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0446 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0449 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3213 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0427 · Security Note
• http://rhn.redhat.com/errata/RHSA-2013-0237.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0424 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0441 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3342 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2013-1493 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0443 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0440 · Security Note