Vulnerability 83689 - CERT Civis.Net

Vulnerability Name:

CCN-83689

Published:

2013-04-22

Updated:

2013-04-22

Summary:

Oracle Java Runtime Environment could allow a remote attacker to execute arbitrary code on the system, caused by errors related to malicious Reflection API calls in the "allowed" classes space. By persuading a victim to visit a specially-crafted Web site containing a malicious Java applet, an attacker could exploit this vulnerability to execute arbitrary code on the system.

CVSS v3 Severity:

10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

CVSS v2 Severity:

9.3 High (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
7.5 High (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:U/RC:UR)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

Vulnerability Consequences:

Gain Access

References:

Source: CCN
Type: BugTraq Mailing List, Mon Apr 22 2013 - 02:08:21 CDT
[SE-2012-01] Yet another Reflection API flaw affecting Oracle's Java SE

Source: CCN
Type: Oracle Web site
Java Runtime Environment

Source: CCN
Type: BID-59656
IBM Java 'Reflection API' Multiple Security Bypass Vulnerabilities

Source: XF
Type: UNKNOWN
oracle-java-reflectionapi-code-exec(83689)

Vulnerable Configuration:

Configuration CCN 1:

cpe:/a:oracle:jre:1.7.0:*:*:*:*:*:*:*

OR cpe:/a:oracle:jre:1.7.0:update15:*:*:*:*:*:*

OR cpe:/a:oracle:jre:1.7.0:update17:*:*:*:*:*:*

OR cpe:/a:oracle:jre:1.7.0:update21:*:*:*:*:*:*

AND

cpe:/a:ibm:java:1.4.2:*:*:*:*:*:*:*

Denotes that component is vulnerable

BACK