PT-2013-3170 · Oracle+3 · Oracle Java Se+5

James Forshaw + 1 · Published 2013-03-08 · Updated 2025-09-29 · CVE-2013-1488

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 7 Update 17 and earlier OpenJDK versions 6 and 7

Description The issue allows remote attackers to execute arbitrary code via unspecified vectors involving reflection, Libraries, and the JDBC driver manager. This was demonstrated by James Forshaw during a Pwn2Own competition at CanSecWest 2013.

Recommendations For Oracle Java SE versions 7 Update 17 and earlier, update to a version later than 7 Update 17 to resolve the issue. For OpenJDK versions 6 and 7, consider disabling the JDBC driver manager as a temporary workaround until a patch is available.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

ALSA-2025_16880

CESA-2013_0751

CESA-2013_0770

CVE-2013-1488

ELSA-2013-0751

ELSA-2013-0770

OPENSUSE-SU-2024:10534-1

RHSA-2013:0751

RHSA-2013:0752

RHSA-2013:0757

RHSA-2013:0770

RHSA-2013:0822

RHSA-2013_0751

RHSA-2013_0752

RHSA-2013_0757

RHSA-2013_0770

RHSA-2013_0822

ZDI-13-076

Affected Products

Centos

Java Platform

Openjdk

Oracle Java Se

Red Hat

Suse

References · 336

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_jre17_driver_manager.rb · Exploit
• 🔥 https://github.com/v-p-b/buherablog-cve-2013-1488 · Exploit
• 🔥 https://exploit-db.com/exploits/26135 · Exploit
• http://security.gentoo.org/glsa/glsa-201406-32.xml · Vendor Advisory
• http://ubuntu.com/usn/USN-1806-1 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-13-076 · Security Note
• http://rhn.redhat.com/errata/RHSA-2013-0752.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2013-0751.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-1488 · Security Note
• https://linux.oracle.com/errata/ELSA-2013-0770.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2013:145 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2013-05/msg00017.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00007.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10534-1 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2013:161 · Vendor Advisory