PT-2013-4093 · Ibm+2 · Ibm Java+2

Adam Gowdiak · Published 2013-07-15 · Updated 2017-11-29 · CVE-2013-3009

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM Java versions 1.4.2 before 1.4.2 SR13-FP18 IBM Java versions 5.0 before 5.0 SR16-FP3 IBM Java versions 6 before 6 SR14 IBM Java versions 6.0.1 before 6.0.1 SR6 IBM Java versions 7 before 7 SR5

Description The issue allows remote attackers to bypass a sandbox protection mechanism. This is achieved by exploiting the improper exposure of the invoke method of the java.lang.reflect.Method class in the com.ibm.CORBA.iiop.ClientDelegate class. The attack vectors are related to the AccessController doPrivileged block, enabling attackers to call setSecurityManager.

Recommendations For IBM Java version 1.4.2, update to 1.4.2 SR13-FP18 or later. For IBM Java version 5.0, update to 5.0 SR16-FP3 or later. For IBM Java version 6, update to 6 SR14 or later. For IBM Java version 6.0.1, update to 6.0.1 SR6 or later. For IBM Java version 7, update to 7 SR5 or later.

Exploit

Fix

Related Identifiers

CVE-2013-3009

RHSA-2013:1059

RHSA-2013:1060

RHSA-2013:1081

RHSA-2013_1059

RHSA-2013_1060

RHSA-2013_1081

Affected Products

Ibm Java

Red Hat

Suse

References · 75

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_jre17_provider_skeleton.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_storeimagearray.rb · Exploit
• http://www-01.ibm.com/support/docview.wss?uid=swg1IV44792 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-1059.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00029.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00027.html · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg21642336 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-3009 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00000.html · Vendor Advisory
• http://ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_July_2013 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00026.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00003.html · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg21644197 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg1PM91727 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-1060.html · Vendor Advisory