Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
symantecSymantec Security ResponseSMNTC-59162
HistoryApr 16, 2013 - 12:00 a.m.

Oracle Java Runtime Environment CVE-2013-2423 Security Bypass Vulnerability

2013-04-1600:00:00
Symantec Security Response
www.symantec.com
96

0.975 High

EPSS

Percentile

100.0%

JSON

Description

Oracle Java Runtime Environment is prone to a security-bypass vulnerability. An attacker can exploit this issue to bypass sandbox protection and perform unauthorized actions in the context of the application. This vulnerability affects the following supported versions: 7 Update 17 and prior Note: This BID was previously titled β€˜Oracle Java SE CVE-2013-2423 Remote Java Runtime Environment Vulnerability’. The title and technical details have been changed to better reflect the underlying component affected.

Technologies Affected

  • Avaya Aura Application Enablement Services 5.2
  • Avaya Aura Application Enablement Services 5.2.1
  • Avaya Aura Application Enablement Services 5.2.2
  • Avaya Aura Application Enablement Services 5.2.3
  • Avaya Aura Application Enablement Services 5.2.4
  • Avaya Aura Application Enablement Services 6.1
  • Avaya Aura Application Enablement Services 6.1.1
  • Avaya Aura Application Enablement Services 6.1.2
  • Avaya Aura Application Server 5300 SIP Core 2.0
  • Avaya Aura Application Server 5300 SIP Core 3.0
  • Avaya Aura Communication Manager 5.2.1
  • Avaya Aura Conferencing 6.0 Standard
  • Avaya Aura Conferencing 7.0
  • Avaya Aura Experience Portal 6.0
  • Avaya Aura Experience Portal 6.0 SP1
  • Avaya Aura Experience Portal 6.0 SP2
  • Avaya Aura Experience Portal 6.0.1
  • Avaya Aura Experience Portal 6.0.2
  • Avaya Aura Messaging 6.0
  • Avaya Aura Messaging 6.0.1
  • Avaya Aura Messaging 6.1
  • Avaya Aura Messaging 6.1.1
  • Avaya Aura Messaging 6.2
  • Avaya Aura Presence Services 6.0
  • Avaya Aura Presence Services 6.1
  • Avaya Aura Presence Services 6.1 SP1
  • Avaya Aura Presence Services 6.1.1
  • Avaya Aura Presence Services 6.1.2
  • Avaya Aura SIP Enablement Services 5.2
  • Avaya Aura SIP Enablement Services 5.2.1
  • Avaya Aura Session Manager 5.2
  • Avaya Aura Session Manager 5.2 SP1
  • Avaya Aura Session Manager 5.2 SP2
  • Avaya Aura Session Manager 5.2.1
  • Avaya Aura Session Manager 6.0
  • Avaya Aura Session Manager 6.0 SP1
  • Avaya Aura Session Manager 6.0.1
  • Avaya Aura Session Manager 6.1
  • Avaya Aura Session Manager 6.1 SP1
  • Avaya Aura Session Manager 6.1 SP2
  • Avaya Aura Session Manager 6.1.1
  • Avaya Aura Session Manager 6.1.2
  • Avaya Aura Session Manager 6.1.3
  • Avaya Aura Session Manager 6.1.5
  • Avaya Aura Session Manager 6.2
  • Avaya Aura Session Manager 6.2 SP1
  • Avaya Aura Session Manager 6.2.1
  • Avaya Aura Session Manager 6.2.2
  • Avaya Aura Session Manager 6.3
  • Avaya Aura System Manager 5.2
  • Avaya Aura System Manager 6.0
  • Avaya Aura System Manager 6.0 SP1
  • Avaya Aura System Manager 6.1
  • Avaya Aura System Manager 6.1 SP1
  • Avaya Aura System Manager 6.1 SP2
  • Avaya Aura System Manager 6.1.1
  • Avaya Aura System Manager 6.1.2
  • Avaya Aura System Manager 6.1.3
  • Avaya Aura System Manager 6.1.5
  • Avaya Aura System Manager 6.2
  • Avaya Aura System Manager 6.2 SP3
  • Avaya CMS R16
  • Avaya CMS R16.3
  • Avaya CMS r15
  • Avaya CMS r17
  • Avaya Communication Server 1000E 6.0
  • Avaya Communication Server 1000E 7.0
  • Avaya Communication Server 1000E 7.5
  • Avaya Communication Server 1000E Signaling Server 6.0
  • Avaya Communication Server 1000E Signaling Server 7.0
  • Avaya Communication Server 1000E Signaling Server 7.5
  • Avaya Communication Server 1000M 6.0
  • Avaya Communication Server 1000M 7.0
  • Avaya Communication Server 1000M 7.5
  • Avaya Communication Server 1000M Signaling Server 6.0
  • Avaya Communication Server 1000M Signaling Server 7.0
  • Avaya Communication Server 1000M Signaling Server 7.5
  • Avaya IP Office Application Server 8.0
  • Avaya IP Office Application Server 8.1
  • Avaya IP Office Server Edition 8.1
  • Avaya Meeting Exchange 5.2
  • Avaya Message Networking 5.2.1
  • Avaya Message Networking 5.2.2
  • Avaya Message Networking 5.2.3
  • Avaya Message Networking 5.2.4
  • Avaya Message Networking 5.2.5
  • Avaya Messaging Application Server 5.2.1
  • Avaya Messaging Message Storage Server 5.2.1
  • Avaya Proactive Contact 5.0
  • Avaya Proactive Contact 5.1
  • Avaya Voice Portal 5.0
  • Avaya Voice Portal 5.0 SP1
  • Avaya Voice Portal 5.1
  • Avaya Voice Portal 5.1.1
  • Avaya Voice Portal 5.1.2
  • Avaya Voice Portal 5.1.3
  • CentOS CentOS 5
  • CentOS CentOS 6
  • Fedoraproject Fedora 17
  • Fedoraproject Fedora 18
  • Fedoraproject Fedora 19
  • Gentoo Linux
  • IBM Intelligent Operations Center 1.5
  • IBM Intelligent Operations Center 1.5.0.1
  • IBM Intelligent Operations Center 1.5.0.2
  • IBM Java SDK 6
  • IBM Java SDK 7
  • IBM Java SE 6
  • IBM Java SE 7
  • IBM Lotus Domino 8.0
  • IBM Lotus Domino 8.0.1
  • IBM Lotus Domino 8.0.2
  • IBM Lotus Domino 8.0.2.1
  • IBM Lotus Domino 8.0.2.2
  • IBM Lotus Domino 8.0.2.3
  • IBM Lotus Domino 8.0.2.4
  • IBM Lotus Domino 8.5.0
  • IBM Lotus Domino 8.5.0.1
  • IBM Lotus Domino 8.5.1
  • IBM Lotus Domino 8.5.1.1
  • IBM Lotus Domino 8.5.2
  • IBM Lotus Domino 8.5.3
  • IBM Lotus Domino 8.5.4
  • IBM Lotus Domino 9.0
  • IBM Lotus Notes 8.0
  • IBM Lotus Notes 8.0.1
  • IBM Lotus Notes 8.0.2
  • IBM Lotus Notes 8.0.2.1
  • IBM Lotus Notes 8.0.2.2
  • IBM Lotus Notes 8.0.2.3
  • IBM Lotus Notes 8.0.2.4
  • IBM Lotus Notes 8.0.2.5
  • IBM Lotus Notes 8.0.2.6
  • IBM Lotus Notes 8.5
  • IBM Lotus Notes 8.5.0.1
  • IBM Lotus Notes 8.5.1
  • IBM Lotus Notes 8.5.1.2
  • IBM Lotus Notes 8.5.1.3
  • IBM Lotus Notes 8.5.1.4
  • IBM Lotus Notes 8.5.1.5
  • IBM Lotus Notes 8.5.2
  • IBM Lotus Notes 8.5.2.1
  • IBM Lotus Notes 8.5.2.2
  • IBM Lotus Notes 8.5.2.3
  • IBM Lotus Notes 8.5.3
  • IBM Lotus Notes 9.0
  • IBM Maximo Asset Management 6.2
  • IBM Maximo Asset Management 6.2.1
  • IBM Maximo Asset Management 6.2.2
  • IBM Maximo Asset Management 6.2.3
  • IBM Maximo Asset Management 6.2.4
  • IBM Maximo Asset Management 6.2.5
  • IBM Maximo Asset Management 6.2.6
  • IBM Maximo Asset Management 6.2.7
  • IBM Maximo Asset Management 6.2.8
  • IBM Maximo Asset Management 7.1
  • IBM Maximo Asset Management 7.1.1
  • IBM Maximo Asset Management 7.1.2
  • IBM Maximo Asset Management 7.2
  • IBM Maximo Asset Management 7.2.1
  • IBM Maximo Asset Management 7.5
  • IBM Maximo Asset Management Essentials 6.2
  • IBM Maximo Asset Management Essentials 7.1
  • IBM Maximo Asset Management Essentials 7.5
  • IBM Operational Decision Manager 8.0
  • IBM Operational Decision Manager 8.5
  • IBM Rational Host On-Demand 11.0.0
  • IBM Rational Host On-Demand 11.0.7
  • IBM Smart Analytics System 5600 9.7
  • IBM Tivoli Composite Application Manager for Transactions 7.1.0
  • IBM Tivoli Composite Application Manager for Transactions 7.1.0.1
  • IBM Tivoli Composite Application Manager for Transactions 7.1.0.2
  • IBM Tivoli Composite Application Manager for Transactions 7.2.0
  • IBM Tivoli Composite Application Manager for Transactions 7.2.0.1
  • IBM Tivoli Composite Application Manager for Transactions 7.2.0.2
  • IBM Tivoli Composite Application Manager for Transactions 7.3.0
  • IBM Tivoli Endpoint Manager for Remote Control 9.0.0
  • IBM Tivoli Monitoring 6.2.0
  • IBM Tivoli Monitoring 6.2.1
  • IBM Tivoli Monitoring 6.2.2
  • IBM Tivoli Monitoring 6.2.3
  • IBM Tivoli Monitoring 6.3.0
  • IBM Tivoli System Automation (TSA) for Multiplatforms 3.1
  • IBM Tivoli System Automation (TSA) for Multiplatforms 3.2
  • IBM Tivoli System Automation (TSA) for Multiplatforms 3.2.1
  • IBM Tivoli System Automation (TSA) for Multiplatforms 3.2.2
  • IBM Tivoli System Automation Application Manager 3.1
  • IBM Tivoli System Automation Application Manager 3.2
  • IBM Tivoli System Automation Application Manager 3.2.1
  • IBM Tivoli System Automation Application Manager 3.2.2
  • IBM Tivoli System Automation for Integrated Operations Management 2.1
  • IBM Virtualization Engine TS7700
  • IBM WebSphere ILOG JRules 7.1
  • IBM WebSphere Operational Decision Management 7.5.0.0
  • Mandriva Business Server 1
  • Mandriva Business Server 1 X86 64
  • Oracle Enterprise Linux 5
  • Oracle Enterprise Linux 6
  • Oracle Enterprise Linux 6.2
  • Oracle JDK (Linux Production Release) 1.7.0
  • Oracle JDK (Linux Production Release) 1.7.0_12
  • Oracle JDK (Linux Production Release) 1.7.0_13
  • Oracle JDK (Linux Production Release) 1.7.0_2
  • Oracle JDK (Linux Production Release) 1.7.0_4
  • Oracle JDK (Linux Production Release) 1.7.0_7
  • Oracle JDK (Solaris Production Release) 1.7.0
  • Oracle JDK (Solaris Production Release) 1.7.0_10
  • Oracle JDK (Solaris Production Release) 1.7.0_11
  • Oracle JDK (Solaris Production Release) 1.7.0_2
  • Oracle JDK (Solaris Production Release) 1.7.0_4
  • Oracle JDK (Solaris Production Release) 1.7.0_7
  • Oracle JDK (Windows Production Release) 1.7.0
  • Oracle JDK (Windows Production Release) 1.7.0_2
  • Oracle JDK (Windows Production Release) 1.7.0_4
  • Oracle JDK (Windows Production Release) 1.7.0_7
  • Oracle JDK(Linux Production Release) 1.7.0_10
  • Oracle JDK(Linux Production Release) 1.7.0_11
  • Oracle JDK(Linux Production Release) 1.7.0_17
  • Oracle JDK(Linux Production Release) 1.7.0_8
  • Oracle JDK(Linux Production Release) 1.7.0_9
  • Oracle JDK(Solaris Production Release) 1.7.0_12
  • Oracle JDK(Solaris Production Release) 1.7.0_13
  • Oracle JDK(Solaris Production Release) 1.7.0_8
  • Oracle JDK(Solaris Production Release) 1.7.0_9
  • Oracle JDK(Windows Production Release) 1.7.0_10
  • Oracle JDK(Windows Production Release) 1.7.0_11
  • Oracle JDK(Windows Production Release) 1.7.0_12
  • Oracle JDK(Windows Production Release) 1.7.0_13
  • Oracle JDK(Windows Production Release) 1.7.0_17
  • Oracle JDK(Windows Production Release) 1.7.0_8
  • Oracle JDK(Windows Production Release) 1.7.0_9
  • Oracle JRE (Linux Production Release) 1.7.0_12
  • Oracle JRE (Linux Production Release) 1.7.0_13
  • Oracle JRE (Linux Production Release) 1.7.0_2
  • Oracle JRE (Linux Production Release) 1.7.0_4
  • Oracle JRE (Linux Production Release) 1.7.0_7
  • Oracle JRE (Solaris Production Release) 1.7.0_2
  • Oracle JRE (Solaris Production Release) 1.7.0_4
  • Oracle JRE (Solaris Production Release) 1.7.0_7
  • Oracle JRE (Windows Production Release) 1.7.0_2
  • Oracle JRE (Windows Production Release) 1.7.0_4
  • Oracle JRE (Windows Production Release) 1.7.0_7
  • Oracle JRE(Linux Production Release) 1.7.0_10
  • Oracle JRE(Linux Production Release) 1.7.0_11
  • Oracle JRE(Linux Production Release) 1.7.0_17
  • Oracle JRE(Linux Production Release) 1.7.0_8
  • Oracle JRE(Linux Production Release) 1.7.0_9
  • Oracle JRE(Solaris Production Release) 1.7.0_10
  • Oracle JRE(Solaris Production Release) 1.7.0_11
  • Oracle JRE(Solaris Production Release) 1.7.0_13
  • Oracle JRE(Solaris Production Release) 1.7.0_17
  • Oracle JRE(Solaris Production Release) 1.7.0_8
  • Oracle JRE(Solaris Production Release) 1.7.0_9
  • Oracle JRE(Windows Production Release) 1.7.0_10
  • Oracle JRE(Windows Production Release) 1.7.0_11
  • Oracle JRE(Windows Production Release) 1.7.0_12
  • Oracle JRE(Windows Production Release) 1.7.0_13
  • Oracle JRE(Windows Production Release) 1.7.0_17
  • Oracle JRE(Windows Production Release) 1.7.0_8
  • Oracle JRE(Windows Production Release) 1.7.0_9
  • Redhat Enterprise Linux 5 Server
  • Redhat Enterprise Linux Desktop 5 Client
  • Redhat Enterprise Linux Desktop 6
  • Redhat Enterprise Linux Desktop Supplementary 5 Client
  • Redhat Enterprise Linux Desktop Supplementary 6
  • Redhat Enterprise Linux HPC Node 6
  • Redhat Enterprise Linux HPC Node Supplementary 6
  • Redhat Enterprise Linux Server 6
  • Redhat Enterprise Linux Server AUS 6.4
  • Redhat Enterprise Linux Server EUS 6.4.z
  • Redhat Enterprise Linux Server Supplementary 6
  • Redhat Enterprise Linux Supplementary 5 Server
  • Redhat Enterprise Linux Workstation 6
  • Redhat Enterprise Linux Workstation Supplementary 6
  • SuSE openSUSE 12.2
  • Sun JRE (Linux Production Release) 1.7
  • Sun JRE (Solaris Production Release) 1.7
  • Sun JRE (Windows Production Release) 1.7
  • Ubuntu Ubuntu Linux 12.10 amd64
  • Ubuntu Ubuntu Linux 12.10 i386

Recommendations

Block external access at the network boundary, unless external parties require service.
Filter access to the affected computer at the network boundary if global access isn’t needed. Restricting access to only trusted computers and networks might greatly reduce the likelihood of a successful exploit.

Deploy network intrusion detection systems to monitor network traffic for malicious activity.
Deploy NIDS to monitor network traffic for signs of anomalous or suspicious activity including unexplained incoming and outgoing traffic. This may indicate exploit attempts or activity that results from successful exploits.

Do not follow links provided by unknown or untrusted sources.
Web users should be cautious about following links to sites that are provided by unfamiliar or suspicious sources. Filtering HTML from emails may help remove a possible vector for transmitting malicious links to users.

Set web browser security to disable the execution of script code or active content.
Disabling the execution of script code in the browser may limit exposure to this and other latent vulnerabilities.

Run all software as a nonprivileged user with minimal access rights.
To limit the impact of latent vulnerabilities, configure applications to run as a nonadministrative user with minimal access rights.

Updates are available. Please see the references or vendor advisory for more information. The payloads delivered by the exploit kits are detected by Symantec as β€˜Trojan.Zbot’ and β€˜Trojan.Horse’.

Related

threatpost 8
symantec 4
saint 8
packetstorm 1
attackerkb 3
zdt 1
nessus 29
seebug 2
cve 2
cert 1
openvas 23
prion 2
cisa_kev 2
checkpoint_advisories 4
veracode 1
ubuntucve 1
canvas 1
securityvulns 2
fedora 3
redhat 4
centos 2
oraclelinux 2
amazon 1
ubuntu 1
securelist 1
ibm 13
gentoo 2
threatpost
threatpost
IE 8 0Day in Sunshop Targeted Espionage Malware Campaign
2013-05-21 14:40:44
USAID a Target of DoL Watering Hole Attackers
2013-05-13 10:52:56
Microsoft Patches IE Zero Day Used In Watering Hole Attack
2013-05-14 16:14:18
symantec
symantec
Microsoft Internet Explorer CVE-2013-1347 Use-After-Free Remote Code Execution Vulnerability
2013-05-03 00:00:00
Adobe Acrobat and Reader CVE-2010-0188 Remote Code Execution Vulnerability
2010-02-11 00:00:00
Oracle Java SE Rhino Script Engine Remote Code Execution Vulnerability
2011-10-18 00:00:00
saint
saint
Internet Explorer CGenericElement Object Use-after-free Vulnerability
2013-05-08 00:00:00
Internet Explorer CGenericElement Object Use-after-free Vulnerability
2013-05-08 00:00:00
Internet Explorer CGenericElement Object Use-after-free Vulnerability
2013-05-08 00:00:00
packetstorm
packetstorm
Microsoft Internet Explorer CGenericElement Object Use-After-Free
2013-05-07 00:00:00
attackerkb
attackerkb
Microsoft Internet Explorer CGenericElement Use-After-Free
2013-05-05 00:00:00
CVE-2013-2423
2013-04-17 00:00:00
Microsoft Internet Explorer SetMouseCapture Use-After-Free
2020-10-14 00:00:00
zdt
zdt
Microsoft Internet Explorer CGenericElement Object Use-After-Free
2013-05-07 00:00:00
nessus
nessus
MS KB2847140: Vulnerability in Internet Explorer 8 Could Allow Remote Code Execution (deprecated)
2013-05-09 00:00:00
MS13-038: Security Update for Internet Explorer (2847204)
2013-05-15 00:00:00
openSUSE Security Update : java-1_7_0-openjdk (openSUSE-SU-2013:0745-1)
2014-06-13 00:00:00
seebug
seebug
Microsoft IE 8θΏœη¨‹δ»£η ζ‰§θ‘ŒζΌζ΄ž(CVE-2013-1347)
2013-05-07 00:00:00
Microsoft Internet Explorer ι‡Šζ”ΎεŽι‡η”¨θΏœη¨‹δ»£η ζ‰§θ‘ŒζΌζ΄ž(CVE-2013-1347)(MS13-038)
2013-05-17 00:00:00
cve
cve
CVE-2013-1347
2013-05-05 11:07:00
CVE-2013-2423
2013-04-17 18:55:07
cert
cert
Microsoft Internet Explorer 8 CGenericElement object use-after-free vulnerability
2013-05-06 00:00:00
openvas
openvas
MS Internet Explorer Remote Code Execution Vulnerability (2847140)
2013-05-06 00:00:00
MS Internet Explorer Remote Code Execution Vulnerability (2847140)
2013-05-06 00:00:00
Oracle Java SE Multiple Vulnerabilities -03 (May 2013) - Windows
2013-05-06 00:00:00
prion
prion
Code injection
2013-05-05 11:07:00
Type confusion
2013-04-17 18:55:00
cisa_kev
cisa_kev
Microsoft Internet Explorer Remote Code Execution Vulnerability
2022-03-03 00:00:00
Oracle JRE Unspecified Vulnerability
2022-05-25 00:00:00
checkpoint_advisories
checkpoint_advisories
Microsoft Internet Explorer 8 Use After Free Code Execution - Zero Day (CVE-2013-1347)
2013-05-05 00:00:00
Java Applet Reflection Type Confusion Remote Code Execution (CVE-2013-2423)
2013-04-28 00:00:00
Oracle Java Final Field Overwrite (CVE-2013-2423)
2013-05-05 00:00:00
veracode
veracode
Permission Check Bypass
2019-05-02 04:44:37
ubuntucve
ubuntucve
CVE-2013-2423
2013-04-17 00:00:00
canvas
canvas
Immunity Canvas: JAVA_DYNAMICBINDING
2013-04-17 18:55:00
securityvulns
securityvulns
Microsoft Internet Explorer multiple security vulnerabilities
2013-05-27 00:00:00
Oracle Java / OpenJDK multiple security vulnerabilities
2013-04-22 00:00:00
fedora
fedora
[SECURITY] Fedora 18 Update: java-1.7.0-openjdk-1.7.0.19-2.3.9.1.fc18
2013-04-18 02:47:29
[SECURITY] Fedora 19 Update: java-1.7.0-openjdk-1.7.0.19-2.3.9.6.fc19
2013-04-25 14:19:39
[SECURITY] Fedora 17 Update: java-1.7.0-openjdk-1.7.0.19-2.3.9.1.fc17
2013-04-19 05:01:04
redhat
redhat
(RHSA-2013:0752) Important: java-1.7.0-openjdk security update
2013-04-17 00:00:00
(RHSA-2013:0751) Critical: java-1.7.0-openjdk security update
2013-04-17 00:00:00
(RHSA-2013:0822) Critical: java-1.7.0-ibm security update
2013-05-14 00:00:00
centos
centos
java security update
2013-04-17 22:33:59
java security update
2013-04-17 21:01:08
oraclelinux
oraclelinux
java-1.7.0-openjdk security update
2013-04-17 00:00:00
java-1.7.0-openjdk security update
2013-04-17 00:00:00
amazon
amazon
Critical: java-1.7.0-openjdk
2013-04-18 13:59:00
ubuntu
ubuntu
OpenJDK 7 vulnerabilities
2013-04-23 00:00:00
securelist
securelist
Investigation Report for the September 2014 Equation malware detection incident in the US
2017-11-16 10:00:34
ibm
ibm
Security Bulletin: IBM WebSphere Business Services Fabric – Information regarding a security vulnerability in IBM SDK for Java that shipped with IBM WebSphere Application Server and addressed by Oracle CPU April 2013 (CVE-2013-0169)
2022-09-25 21:06:56
Security Bulletin: WebSphere Application Server - IBM SDK for Java April 2013 CPU
2022-09-26 05:45:55
Security Bulletin: IBM Intelligent Operations Center 1.5 WebSphere Application Server - Oracle Java CPU April 2013
2022-09-25 21:06:56
gentoo
gentoo
IcedTea JDK: Multiple vulnerabilities
2014-06-29 00:00:00
Oracle JRE/JDK: Multiple vulnerabilities
2014-01-27 00:00:00

0.975 High

EPSS

Percentile

100.0%

JSON
Related for SMNTC-59162
threatpost8symantec4saint8packetstorm1attackerkb3zdt1nessus29seebug2cve2cert1openvas23prion2cisa_kev2checkpoint_advisories4veracode1ubuntucve1canvas1securityvulns2fedora3redhat4centos2oraclelinux2amazon1ubuntu1securelist1ibm13gentoo2