Vulnerability CVE-2012-4821 - CERT Civis.Net

Vulnerability Name:

CVE-2012-4821 (CCN-78765)

Assigned:

2012-11-13

Published:

2012-11-13

Updated:

2019-07-18

Summary:

Multiple unspecified vulnerabilities in the JRE component in IBM Java 7 SR2 and earlier, Java 6.0.1 SR3 and earlier, Java 6 SR11 and earlier, Java 5 SR14 and earlier, and Java 142 SR13 FP13 and earlier; as used in IBM Rational Host On-Demand, Rational Change, Tivoli Monitoring, Smart Analytics System 5600, Tivoli Remote Control 5.1.2, WebSphere Real Time, Lotus Notes & Domino, Tivoli Storage Productivity Center, and Service Deliver Manager; and other products from other vendors such as Red Hat, allow remote attackers to execute arbitrary code via "insecure use" of the (1) java.lang.Class getDeclaredMethods or nd (2) java.lang.reflect.AccessibleObject setAccessible() methods.

CVSS v3 Severity:

10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

CVSS v2 Severity:

9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
6.9 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

9.3 High (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
6.9 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

6.8 Medium (REDHAT CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
5.0 Medium (REDHAT Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

Vulnerability Type:

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2012-4821

Source: CCN
Type: RHSA-2012-1467
Critical: java-1.7.0-ibm security update

Source: REDHAT
Type: Third Party Advisory
RHSA-2012:1467

Source: BUGTRAQ
Type: Mailing List, Third Party Advisory
20120911 [SE-2012-01] Security vulnerabilities in IBM Java

Source: CCN
Type: SA51244
IBM Java Multiple Vulnerabilities

Source: CCN
Type: SA51247
IBM WebSphere Real Time Java Multiple Vulnerabilities

Source: CCN
Type: SA51277
IBM Lotus Notes / Lotus Domino Java Multiple Vulnerabilities

Source: CCN
Type: SA51278
IBM Tivoli Management Framework Java Multiple Vulnerabilities

Source: SECUNIA
Type: Third Party Advisory
51326

Source: CCN
Type: SA51634
IBM OS/400 Java Multiple Vulnerabilities

Source: SECUNIA
Type: Third Party Advisory
51634

Source: AIXAPAR
Type: Vendor Advisory
IV29659

Source: CCN
Type: IBM Security Bulletin 1615705
Rational Host On-Demand clients affected by vulnerabilities in IBM JRE (CVE-2012-4820, CVE-2012-4821, CVE-2012-4822, CVE-2012-4823)

Source: CONFIRM
Type: Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21615705

Source: CCN
Type: IBM Security Bulletin 1615800
Rational Change client side deployments affected by vulnerabilities if IBM JRE is installed by end user (CVE-2012-4820, CVE-2012-4821, CVE-2012-4822, CVE-2012-4823)

Source: CONFIRM
Type: Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21615800

Source: CCN
Type: IBM Security Bulletin 1616490
IBM Tivoli Monitoring clients affected by vulnerabilities in IBM JRE excuted under a security manager

Source: CONFIRM
Type: Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21616490

Source: CCN
Type: IBM Security Bulletin 1616594
Tivoli Remote Control 5.1.2 clients affected by vulnerabilities in IBM JRE (CVE-2012-4820, CVE-2012-4821, CVE-2012-4822, CVE-2012-4823)

Source: CONFIRM
Type: Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21616594

Source: CCN
Type: IBM Security Bulletin 1616616
IBM WebSphere Real Time clients affected by vulnerabilities in IBM JRE (CVE-2012-4820, CVE-2012-4821, CVE-2012-4822, CVE-2012-4823)

Source: CONFIRM
Type: Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21616616

Source: CCN
Type: IBM Security Bulletin 1616617
Vulnerabilities in IBM Java SDK (CVE-2012-4820, CVE-2012-4821, CVE-2012-4822, CVE-2012-4823)

Source: CONFIRM
Type: Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21616617

Source: CCN
Type: IBM Security Bulletin 1616652
IBM Lotus Notes & Domino affected by vulnerabilities in IBM JRE (CVE-2012-4820, CVE-2012-4821, CVE-2012-4822, CVE-2012-4823)

Source: CONFIRM
Type: Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21616652

Source: CCN
Type: IBM Security Bulletin 1616708
Tivoli Storage Productivity Center clients affected by vulnerabilities in IBM JRE (CVE-2012-4820, CVE-2012-4821, CVE-2012-4822, CVE-2012-4823)

Source: CONFIRM
Type: Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21616708

Source: CCN
Type: IBM Security Bulletin 1621154
IBM Service Deliver Manager clients affected by vulnerabilities in IBM JRE (CVE-2012-4820, CVE-2012-4821, CVE-2012-4822, CVE-2012-4823)

Source: CONFIRM
Type: Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21621154

Source: CCN
Type: IBM Security Bulletin 1631786
TADDM: Vulnerabilities in embedded JRE

Source: CCN
Type: IBM developerWorks
IBM Security Update November 2012

Source: BID
Type: Third Party Advisory, VDB Entry
55495

Source: CCN
Type: BID-55495
IBM Java Multiple Remote Code Execution Vulnerabilities

Source: XF
Type: Third Party Advisory, VDB Entry
ibm-java-gdm-sa-ce(78765)

Source: XF
Type: UNKNOWN
ibm-java-gdm-sa-ce(78765)

Source: CCN
Type: IBM Security Bulletin 1616546
IBM Smart Analytics System 5600 clients affected by vulnerabilities in IBM JRE (CVE-2012-4820, CVE-2012-4821, CVE-2012-4822, CVE-2012-4823)

Source: CONFIRM
Type: Vendor Advisory
https://www-304.ibm.com/support/docview.wss?uid=swg21616546

Vulnerable Configuration:

Configuration 1:

cpe:/a:ibm:java:*:*:*:*:*:*:*:* (Version >= 1.4.2 and <= 1.4.2.13.13)

OR cpe:/a:ibm:java:*:*:*:*:*:*:*:* (Version >= 5.0.0.0 and <= 5.0.14.0)

OR cpe:/a:ibm:java:*:*:*:*:*:*:*:* (Version >= 6.0.0.0 and <= 6.0.11.0)

OR cpe:/a:ibm:java:*:*:*:*:*:*:*:* (Version >= 7.0.0.0 and <= 7.0.2.0)

OR cpe:/a:ibm:lotus_domino:8.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_domino:8.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_domino:8.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_domino:8.0.2.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_domino:8.0.2.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_domino:8.0.2.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_domino:8.0.2.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_domino:8.5.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_domino:8.5.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_domino:8.5.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_domino:8.5.1.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_domino:8.5.1.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_domino:8.5.1.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_domino:8.5.1.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_domino:8.5.1.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_domino:8.5.2.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_domino:8.5.2.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_domino:8.5.2.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_domino:8.5.2.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_domino:8.5.2.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_domino:8.5.3.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_domino:8.5.3.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_domino:8.5.3.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes:8.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes:8.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes:8.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes:8.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes:8.0.2.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes:8.0.2.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes:8.0.2.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes:8.0.2.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes:8.0.2.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes:8.0.2.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes:8.0.2.6:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes:8.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes:8.5.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes:8.5.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes:8.5.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes:8.5.1.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes:8.5.1.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes:8.5.1.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes:8.5.1.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes:8.5.1.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes:8.5.1.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes:8.5.2.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes:8.5.2.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes:8.5.2.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes:8.5.2.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes:8.5.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes:8.5.3.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes:8.5.3.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes:8.5.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes_sametime:8.0.80407:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes_sametime:8.0.80822:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes_sametime:8.5.1.20100709-1631:*:*:*:advanced_embedded:*:*:*

OR cpe:/a:ibm:lotus_notes_traveler:8.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes_traveler:8.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes_traveler:8.0.1.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes_traveler:8.0.1.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes_traveler:8.5.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes_traveler:8.5.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes_traveler:8.5.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes_traveler:8.5.1.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes_traveler:8.5.1.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes_traveler:8.5.1.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes_traveler:8.5.2.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes_traveler:8.5.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes_traveler:8.5.3.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes_traveler:8.5.3.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes_traveler:8.5.3.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes_traveler:8.5.3.3:interim_fix_1:*:*:*:*:*:*

OR cpe:/a:ibm:rational_change:4.7:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_change:5.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_change:5.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_change:5.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_host_on-demand:1.6.0.12:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_host_on-demand:8.0.8.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_host_on-demand:9.0.8.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_host_on-demand:10.0.9.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_host_on-demand:10.0.10.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_host_on-demand:11.0.3.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_host_on-demand:11.0.4.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_host_on-demand:11.0.5.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_host_on-demand:11.0.5.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_host_on-demand:11.0.6.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_host_on-demand:11.0.6.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:service_delivery_manager:7.2.1.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:service_delivery_manager:7.2.2.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:smart_analytics_system_5600_software:-:*:*:*:*:*:*:*

OR cpe:/a:ibm:smart_analytics_system_5600_software:9.7:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_monitoring:6.1.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_monitoring:6.1.0.7:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_monitoring:6.2.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_monitoring:6.2.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_monitoring:6.2.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_monitoring:6.2.0.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_monitoring:6.2.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_monitoring:6.2.1.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_monitoring:6.2.1.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_monitoring:6.2.1.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_monitoring:6.2.1.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_monitoring:6.2.1.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_monitoring:6.2.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_monitoring:6.2.2.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_monitoring:6.2.2.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_monitoring:6.2.2.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_monitoring:6.2.2.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_monitoring:6.2.2.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_monitoring:6.2.2.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_monitoring:6.2.2.6:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_monitoring:6.2.2.7:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_monitoring:6.2.2.8:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_monitoring:6.2.2.9:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_monitoring:6.2.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_monitoring:6.2.3.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_monitoring:6.2.3.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_monitoring:6.2.3.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_remote_control:5.1.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_real_time:2.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_real_time:3.0:*:*:*:*:*:*:*

OR cpe:/a:tivoli_storage_productivity_center:5.0:*:*:*:*:*:*:*:*

OR cpe:/a:tivoli_storage_productivity_center:5.1:*:*:*:*:*:*:*:*

OR cpe:/a:tivoli_storage_productivity_center:5.1.1:*:*:*:*:*:*:*:*

OR cpe:/h:ibm:smart_analytics_system_5600:7200:*:*:*:*:*:*:*

Configuration RedHat 1:

cpe:/a:redhat:rhel_extras:6:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:ibm:java_sdk:7.0.9.10:*:*:*:technology:*:*:*

AND

cpe:/a:ibm:lotus_notes:8.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_domino:8.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_domino:8.5.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes:8.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_monitoring:6.2.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_monitoring:6.2.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_monitoring:6.2.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_management_framework:4.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_host_on-demand:11.0.3.0:*:*:*:*:*:*:*

OR cpe:/a:tivoli_storage_productivity_center:5.1:-:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_real_time:2.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_real_time:3.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_monitoring:6.2.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_remote_control:5.1.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:service_delivery_manager:7.2.1.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:service_delivery_manager:7.2.2.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_application_dependency_discovery_manager:7.2.1:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.mitre.oval:def:23893	P	ELSA-2012:1467: java-1.7.0-ibm security update (Critical)	2014-05-26
oval:org.mitre.oval:def:21002	P	RHSA-2012:1467: java-1.7.0-ibm security update (Critical)	2014-02-24
oval:com.redhat.rhsa:def:20121467	P	RHSA-2012:1467: java-1.7.0-ibm security update (Critical)	2012-11-15