PT-2013-3166 · Oracle+4 · Java Se+5

Published 2013-02-20 · Updated 2024-06-15 · CVE-2013-1484

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Java SE version 7 Update 13 and earlier

Description The issue affects the confidentiality, integrity, and availability of the system. It is related to the Libraries component in the Java Runtime Environment. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.

Recommendations For Java SE version 7 Update 13 and earlier, update to a version later than Update 13 to resolve the issue. As a temporary workaround, consider restricting access to the newProxyInstance function and the setUncaughtExceptionHandler method until a patch is available. Avoid using the Proxy.newProxyInstance and setUncaughtExceptionHandler methods in the affected Java SE versions until the issue is resolved.

Exploit

Fix

Related Identifiers

CESA-2013_0275

CVE-2013-1484

HPSBUX02857

OPENSUSE-SU-2024:10534-1

RHSA-2013:0275

RHSA-2013:0532

RHSA-2013:0626

RHSA-2013_0275

RHSA-2013_0532

RHSA-2013_0626

ZDI-13-040

ZDI-13-042

Affected Products

Centos

Hp-Ux

Java Platform

Java Se

Red Hat

Suse

References · 425

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_jre17_jmxbean.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/java_cmm.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_jre17_jmxbean_2.rb · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-0422 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0446 · Security Note
• http://oracle.com/technetwork/topics/security/javacpufeb2013update-1905892.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0449 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3213 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0427 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0424 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0441 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3342 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2013-1493 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0443 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0440 · Security Note