49 matches found
Oracle Java JDK / JRE 6 < Update 35 SunToolKit getField() and getMethod() Access Issue
The version of Oracle formerly Sun Java Runtime Environment JRE 6.x installed on the remote host is earlier than Update 35. It, therefore, potentially contains two methods that do not properly restrict access to information about other classes. Specifically, the 'getField' and 'getMethod' methods...
Oracle Releases Fix For Java CVE-2012-4681 Flaw
Oracle on Thursday released a new version of Java that included a fix for the CVE-2012-4681 vulnerability that has been used in limited targeted attacks in the last couple of weeks. The release of Java 7 update 7 comes about four days after the Java flaw was publicly disclosed, but several months...
Use of Java Zero-Day Flaws Tied to Nitro Attack Crew
Researchers say that one of the attack groups using the two new Java zero-day vulnerabilities is the same group that was behind an earlier targeted attack campaign from 2011. That group was traced back to China and was essentially running a spear-phishing campaign, but now the crew, known as Nitr...
Oracle Java findMethod findClass Security Bypass
Added: 08/30/2012 CVE: CVE-2012-4681 BID: 55213 OSVDB: 84867 Background Java is a programming language that compiles programs to bytecode, which is then executed inside a Java Virtual Machine. This is optimal for applications that must run on various hardware platforms, such as web applets. Probl...
FreeBSD Ports: openjdk
The remote host is missing an update to the system as announced in the referenced advisory. VID 16846d1e-f1de-11e1-8bd8-0022156e8794 OpenVAS Vulnerability Test $ Description: Auto generated from VID 16846d1e-f1de-11e1-8bd8-0022156e8794 Authors: Thomas Reinke Copyright: Copyright c 2012 E-Soft Inc...
Oracle Java findMethod findClass Security Bypass
Added: 08/30/2012 CVE: CVE-2012-4681 BID: 55213 OSVDB: 84867 Background Java is a programming language that compiles programs to bytecode, which is then executed inside a Java Virtual Machine. This is optimal for applications that must run on various hardware platforms, such as web applets. Probl...
Immunity Canvas: JAVA_FORNAME_GETFIELD
Name| javaforNamegetField ---|--- CVE| CVE-2012-4681 Exploit Pack| CANVAS Description| Java forName/getField Method Invocation Sandbox Bypass Notes| CVE Name: CVE-2012-4681 VENDOR: Sun Notes: There is a method invocation vulnerability using sun.awt.SunToolkit.getField This vulnerability can then ...
CVE-2012-4681
CVE-2012-4681 affects Oracle Java SE 7 (JRE) up to Update 6, and earlier; vulnerability chain bypasses SecurityManager via beans permission checks and restricted package access, using ClassFinder.findClass and reflection with a trusted immediate caller to reach private fields. Exploitation in the...
