PT-2013-3515 · Hawtjni · Hawtjni

Dfjo · Published 2013-08-28 · Updated 2022-05-17 · CVE-2013-2035

Positive Technologies (AI Summary)

CVSS v2.0

4.4

Medium

Base vector

AV:L/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions HawtJNI versions prior to 1.8

Description A race condition exists in the HawtJNI library, specifically in the Library.java file. This issue allows local users to execute arbitrary Java code by overwriting a temporary JAR file with a predictable name in the /tmp directory, but only when a custom library path is not specified.

Recommendations For HawtJNI versions prior to 1.8, update to version 1.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the temporary directory /tmp to minimize the risk of exploitation.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2013-2035

GHSA-49J7-QGHP-5WJ8

MGASA-2014-0461

RHSA-2013:1785

RHSA-2013:1786

RHSA-2014:0245

RHSA-2014:0254

Affected Products

Hawtjni

References · 31

• 🔥 https://github.com/fusesource/hawtjni/commit/92c266170ce98edc200c656bd034a237098b8aa5 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-2035 · Security Note
• https://osv.dev/vulnerability/MGASA-2014-0461 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-1786.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0400.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-1784.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-1785.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0254.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-2035 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0034.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0029.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0245.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2013-2035 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-1029.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-49j7-qghp-5wj8 · Vendor Advisory