Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public getMBeanInstantiator method in the JmxMBeanServer class to obtain a reference to a private MBeanInstantiator object, then retrieving arbitrary Class references using the findClass method, and (2) using the Reflection API with recursion in a way that bypasses a security check by the java.lang.invoke.MethodHandles.Lookup.checkSecurityManager method due to the inability of the sun.reflect.Reflection.getCallerClass method to skip frames related to the new reflection API, as exploited in the wild in January 2013, as demonstrated by Blackhole and Nuclear Pack, and a different vulnerability than CVE-2012-4681 and CVE-2012-3174. NOTE: some parties have mapped the recursive Reflection API issue to CVE-2012-3174, but CVE-2012-3174 is for a different vulnerability whose details are not public as of 20130114. CVE-2013-0422 covers both the JMX/MBean and Reflection API issues. NOTE: it was originally reported that Java 6 was also vulnerable, but the reporter has retracted this claim, stating that Java 6 is not exploitable because the relevant code is called in a way that does not bypass security checks. NOTE: as of 20130114, a reliable third party has claimed that the findClass/MBeanInstantiator vector was not fixed in Oracle Java 7 Update 11. If there is still a vulnerable condition, then a separate CVE identifier might be created for the unfixed issue.

java-1_7_0-openjdk was updated to icedtea-2.3.4 fixing bugs and also severe security issues :

  - Security fixes

  - S8004933, CVE-2012-3174: Improve MethodHandle     interaction with libraries

  - S8006017, CVE-2013-0422: Improve lookup resolutions

  - S8006125: Update MethodHandles library interactions

  - Bug fixes

  - S7197906: BlockOffsetArray::power_to_cards_back() needs     to handle > 32 bit shifts

  - G422525: Fix building with PaX enabled kernels.

  - use gpg-offline to check the validity of icedtea tarball

  - use jamvm on %arm

  - use icedtea package name instead of protected openjdk     for jamvm builds

  - fix armv5 build

  - update to java access bridge 1.26.2

  - bugfix release, mainly 64bit JNI and JVM support

  - fix a segfault in AWT code - (bnc#792951)

  - add openjdk-7-src-b147-awt-crasher.patch

  - turn pulseaudio off on pre 11.4 distros

The remote host is affected by the vulnerability described in GLSA-201401-30 (Oracle JRE/JDK: Multiple vulnerabilities)

    Multiple vulnerabilities have been reported in the Oracle Java       implementation. Please review the CVE identifiers referenced below for       details.
  Impact :

    An unauthenticated, remote attacker could exploit these vulnerabilities       to execute arbitrary code.
      Furthermore, a local or remote attacker could exploit these       vulnerabilities to cause unspecified impact, possibly including remote       execution of arbitrary code.
  Workaround :

    There is no known workaround at this time.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-0165 advisory.

    [1.7.0.9-2.3.4.1.0.1.el6_3]
    - Update DISTRO_NAME in specfile

    [1.7.0.9-2.3.4.1.el6]
    - Rewerted to IcedTea 2.3.4
      - rewerted patch105: java-1.7.0-openjdk-disable-system-lcms.patch
      - removed jxmd and idlj to alternatives
      - make NOT executed with   DISABLE_INTREE_EC=true and UNLIMITED_CRYPTO=true
      - re-applied patch302 and restored systemtap.patch
      - buildver set to 9
      - icedtea_version set to 2.3.4
      - unapplied patch112 java-1.7.openjdk-doNotUseDisabledEcc.patch
      - restored tmp-patches source tarball
      - removed /lib/security/US_export_policy.jar and lib/security/local_policy.jar
      - java-1.7.0-openjdk-java-access-bridge-security.patch's path moved from         java.security-linux back to java.security
    - Resolves: rhbz#895033

    [1.7.0.11-2.4.0.1.el6]
    - Rewritten patch105: java-1.7.0-openjdk-disable-system-lcms.patch
    - Added jxmd and idlj to alternatives
    - make executed with   DISABLE_INTREE_EC=true and UNLIMITED_CRYPTO=true
    - Unapplied patch302 and deleted systemtap.patch
    - buildver increased to 11
    - icedtea_version set to 2.4.0
    - Added and applied patch112 java-1.7.openjdk-doNotUseDisabledEcc.patch
    - removed tmp-patches source tarball
    - Added /lib/security/US_export_policy.jar and lib/security/local_policy.jar
    - Resolves: rhbz#895033

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated java-1.7.0-openjdk packages fix security vulnerabilities :

Two improper permission check issues were discovered in the reflection API in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions (CVE-2012-3174, CVE-2013-0422).

Multiple improper permission check issues were discovered in the AWT, CORBA, JMX, Libraries, and Beans components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions (CVE-2013-0442, CVE-2013-0445, CVE-2013-0441, CVE-2013-1475, CVE-2013-1476, CVE-2013-0429, CVE-2013-0450, CVE-2013-0425, CVE-2013-0426, CVE-2013-0428, CVE-2013-0444).

Multiple flaws were found in the way image parsers in the 2D and AWT components handled image raster parameters. A specially crafted image could cause Java Virtual Machine memory corruption and, possibly, lead to arbitrary code execution with the virtual machine privileges (CVE-2013-1478, CVE-2013-1480).

A flaw was found in the AWT component's clipboard handling code. An untrusted Java application or applet could use this flaw to access clipboard data, bypassing Java sandbox restrictions (CVE-2013-0432).

The default Java security properties configuration did not restrict access to certain com.sun.xml.internal packages. An untrusted Java application or applet could use this flaw to access information, bypassing certain Java sandbox restrictions. This update lists the whole package as restricted (CVE-2013-0435).

Multiple improper permission check issues were discovered in the JMX, Libraries, Networking, and JAXP components. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions (CVE-2013-0431, CVE-2013-0427, CVE-2013-0433, CVE-2013-0434).

It was discovered that the RMI component's CGIHandler class used user inputs in error messages without any sanitization. An attacker could use this flaw to perform a cross-site scripting (XSS) attack (CVE-2013-0424).

It was discovered that the SSL/TLS implementation in the JSSE component did not properly enforce handshake message ordering, allowing an unlimited number of handshake restarts. A remote attacker could use this flaw to make an SSL/TLS server using JSSE consume an excessive amount of CPU by continuously restarting the handshake (CVE-2013-0440).

It was discovered that the JSSE component did not properly validate Diffie-Hellman public keys. An SSL/TLS client could possibly use this flaw to perform a small subgroup attack (CVE-2013-0443).

Multiple improper permission check issues were discovered in the JMX and Libraries components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions (CVE-2013-1486, CVE-2013-1484).

An improper permission check issue was discovered in the Libraries component in OpenJDK. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions (CVE-2013-1485).

It was discovered that OpenJDK leaked timing information when decrypting TLS/SSL protocol encrypted records when CBC-mode cipher suites were used. A remote attacker could possibly use this flaw to retrieve plain text from the encrypted packets by using a TLS/SSL server as a padding oracle (CVE-2013-0169).

An integer overflow flaw was found in the way the 2D component handled certain sample model instances. A specially crafted sample model instance could cause Java Virtual Machine memory corruption and, possibly, lead to arbitrary code execution with virtual machine privileges (CVE-2013-0809).

It was discovered that the 2D component did not properly reject certain malformed images. Specially crafted raster parameters could cause Java Virtual Machine memory corruption and, possibly, lead to arbitrary code execution with virtual machine privileges (CVE-2013-1493).

IBM Java 7 was updated to SR4, fixing various critical security issues and bugs.

Please see the IBM JDK Alert page for more information :

http://www.ibm.com/developerworks/java/jdk/alerts/

Security issues fixed :

  - / CVE-2012-3174. (CVE-2013-1487 / CVE-2013-1486 /     CVE-2013-1478 / CVE-2013-0445 / CVE-2013-1480 /     CVE-2013-0441 / CVE-2013-1476 / CVE-2012-1541 /     CVE-2013-0446 / CVE-2012-3342 / CVE-2013-0442 /     CVE-2013-0450 / CVE-2013-0425 / CVE-2013-0426 /     CVE-2013-0428 / CVE-2012-3213 / CVE-2013-0419 /     CVE-2013-0423 / CVE-2013-0351 / CVE-2013-0432 /     CVE-2013-1473 / CVE-2013-0435 / CVE-2013-0434 /     CVE-2013-0409 / CVE-2013-0427 / CVE-2013-0433 /     CVE-2013-0424 / CVE-2013-0440 / CVE-2013-0438 /     CVE-2013-0443 / CVE-2013-1484 / CVE-2013-1485 /     CVE-2013-0437 / CVE-2013-0444 / CVE-2013-0449 /     CVE-2013-0431 / CVE-2013-0422)

Updated java-1.7.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6 Supplementary.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

IBM Java SE version 7 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Detailed vulnerability descriptions are linked from the IBM Security alerts page, listed in the References section. (CVE-2012-1541, CVE-2012-3174, CVE-2012-3213, CVE-2012-3342, CVE-2013-0351, CVE-2013-0409, CVE-2013-0419, CVE-2013-0422, CVE-2013-0423, CVE-2013-0424, CVE-2013-0425, CVE-2013-0426, CVE-2013-0427, CVE-2013-0428, CVE-2013-0431, CVE-2013-0432, CVE-2013-0433, CVE-2013-0434, CVE-2013-0435, CVE-2013-0437, CVE-2013-0438, CVE-2013-0440, CVE-2013-0441, CVE-2013-0442, CVE-2013-0443, CVE-2013-0444, CVE-2013-0445, CVE-2013-0446, CVE-2013-0449, CVE-2013-0450, CVE-2013-0809, CVE-2013-1473, CVE-2013-1476, CVE-2013-1478, CVE-2013-1480, CVE-2013-1484, CVE-2013-1485, CVE-2013-1486, CVE-2013-1487, CVE-2013-1493)

All users of java-1.7.0-ibm are advised to upgrade to these updated packages, containing the IBM Java SE 7 SR4 release. All running instances of IBM Java must be restarted for the update to take effect.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is earlier than 7 Update 11 and is, therefore, potentially affected by the following security issues :

  - An unspecified issue exists in the Libraries     component. (CVE-2012-3174)

  - An error exists in the 'MBeanInstantiator.findClass'     method that could allow remote, arbitrary code execution.
    (CVE-2013-0422)

Note that, according the advisory, these issues apply to client deployments of Java only and can only be exploited through untrusted 'Java Web Start' applications and untrusted Java applets.

It was discovered that OpenJDK 7's security mechanism could be bypassed via Java applets. If a user were tricked into opening a malicious website, a remote attacker could exploit this to perform arbitrary code execution as the user invoking the program.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Two improper permission check issues were discovered in the reflection API in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. (CVE-2012-3174, CVE-2013-0422)

This erratum also upgrades the OpenJDK package to IcedTea7 2.3.4.

All running instances of OpenJDK Java must be restarted for the update to take effect.

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:0165 advisory.

  - OpenJDK: MethodHandles incorrect permission checks (Libraries, 8004933) (CVE-2012-3174)

  - OpenJDK: MethodHandles.Lookup incorrect permission checks, Java 7 0day (Libraries, 8006017)     (CVE-2013-0422)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update fixes rhbz#895035 , which consists of a set of flaws that potentially allow arbitrary code execution (including remotely via applets).

It is strongly recommended that all Java users in Fedora immediately update to this release.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated java-1.7.0-openjdk packages that fix two security issues are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

These packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Software Development Kit.

Two improper permission check issues were discovered in the reflection API in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. (CVE-2012-3174, CVE-2013-0422)

This erratum also upgrades the OpenJDK package to IcedTea7 2.3.4.
Refer to the NEWS file, linked to in the References, for further information.

All users of java-1.7.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect.

Updated java-1.7.0-oracle packages that fix two security issues are now available for Red Hat Enterprise Linux 5 and 6 Supplementary.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Oracle Java SE version 7 includes the Oracle Java Runtime Environment and the Oracle Java Software Development Kit.

This update fixes two vulnerabilities in the Oracle Java Runtime Environment and the Oracle Java Software Development Kit. Further information about these flaws can be found on the Oracle Security Alert page, listed in the References section. (CVE-2012-3174, CVE-2013-0422)

Red Hat is aware that a public exploit for CVE-2013-0422 is available that executes code without user interaction when a user visits a malicious web page using a browser with the Oracle Java 7 web browser plug-in enabled.

All users of java-1.7.0-oracle are advised to upgrade to these updated packages, which provide Oracle Java 7 Update 11 and resolve these issues. All running instances of Oracle Java must be restarted for the update to take effect.

This version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is 7 Update 10 or earlier and is, therefore, potentially affected by the following security issues:

  - An unspecified issue exists in the Libraries component. (CVE-2012-3174)

  - An error exists in the 'MBeanInstantiator.findClass' method that could allow remote, arbitrary code execution. (CVE-2013-0422)

Note that, according the advisory, these issues apply to client deployments of Java only and can only be exploited through untrusted 'Java Web Start' applications and untrusted Java applets

ID	Name	Product	Family	Severity
75022	openSUSE Security Update : java-1_7_0-openjdk (openSUSE-SU-2013:0199-1)	Nessus	SuSE Local Security Checks	critical
72139	GLSA-201401-30 : Oracle JRE/JDK: Multiple vulnerabilities (ROBOT)	Nessus	Gentoo Local Security Checks	critical
68709	Oracle Linux 5 / 6 : java-1.7.0-openjdk (ELSA-2013-0165)	Nessus	Oracle Linux Local Security Checks	critical
66107	Mandriva Linux Security Advisory : java-1.7.0-openjdk (MDVSA-2013:095)	Nessus	Mandriva Local Security Checks	critical
65246	SuSE 11.2 Security Update : Java (SAT Patch Number 7454)	Nessus	SuSE Local Security Checks	critical
65204	RHEL 5 / 6 : java-1.7.0-ibm (RHSA-2013:0626)	Nessus	Red Hat Local Security Checks	critical
64840	Oracle Java SE 7 < Update 11 Multiple Vulnerabilities (Unix)	Nessus	Misc.	critical
63609	Ubuntu 12.10 : openjdk-7 vulnerabilities (USN-1693-1)	Nessus	Ubuntu Local Security Checks	critical
63607	Scientific Linux Security Update : java-1.7.0-openjdk on SL5.x, SL6.x i386/x86_64 (20130116)	Nessus	Scientific Linux Local Security Checks	critical
63590	RHEL 5 / 6 : java-1.7.0-openjdk (RHSA-2013:0165)	Nessus	Red Hat Local Security Checks	critical
63586	Fedora 16 : java-1.7.0-openjdk-1.7.0.9-2.3.4.fc16 (2013-0888)	Nessus	Fedora Local Security Checks	critical
63585	Fedora 17 : java-1.7.0-openjdk-1.7.0.9-2.3.4.fc17 (2013-0868)	Nessus	Fedora Local Security Checks	critical
63584	Fedora 18 : java-1.7.0-openjdk-1.7.0.9-2.3.4.fc18 (2013-0853)	Nessus	Fedora Local Security Checks	critical
63581	CentOS 5 / 6 : java-1.7.0-openjdk (CESA-2013:0165)	Nessus	CentOS Local Security Checks	critical
63534	RHEL 5 / 6 : java-1.7.0-oracle (RHSA-2013:0156)	Nessus	Red Hat Local Security Checks	critical
63521	Oracle Java SE 7 < Update 11 Multiple Vulnerabilities	Nessus	Windows	high
6664	Oracle Java SE 7 <= Update 10 Remote Code Execution	Nessus Network Monitor	Web Clients	critical

Detections

Analytics

CVE-2013-0422

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

critical