CVE-2012-4681
7.3 High
AI Score
Confidence
Low
10 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
0.975 High
EPSS
Percentile
100.0%
Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses SecurityManager restrictions by (1) using com.sun.beans.finder.ClassFinder.findClass and leveraging an exception with the forName method to access restricted classes from arbitrary packages such as sun.awt.SunToolkit, then (2) using βreflection with a trusted immediate callerβ to leverage the getField method to access and modify private fields, as exploited in the wild in August 2012 using Gondzz.class and Gondvv.class.
References
blog.fireeye.com/research/2012/08/zero-day-season-is-not-over-yet.html
immunityproducts.blogspot.com/2012/08/java-0day-analysis-cve-2012-4681.html
labs.alienvault.com/labs/index.php/2012/new-java-0day-exploited-in-the-wild/
lists.opensuse.org/opensuse-security-announce/2012-09/msg00032.html
lists.opensuse.org/opensuse-security-announce/2012-10/msg00016.html
marc.info/?l=bugtraq&m=135109152819176&w=2
rhn.redhat.com/errata/RHSA-2012-1225.html
secunia.com/advisories/51044
www.deependresearch.org/2012/08/java-7-vulnerability-analysis.html
www.oracle.com/technetwork/topics/security/alert-cve-2012-4681-1835715.html
www.securityfocus.com/bid/55213
www.us-cert.gov/cas/techalerts/TA12-240A.html
community.rapid7.com/community/metasploit/blog/2012/08/27/lets-start-the-week-with-a-new-java-0day
Social References
More
Related
7.3 High
AI Score
Confidence
Low
10 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
0.975 High
EPSS
Percentile
100.0%