Detections
Analytics
Oracle Java SE 7 <= Update 10 Remote Code Execution
critical Nessus Network Monitor Plugin ID 6664
Synopsis
The remote Windows host contains a programming platform that is affected by a code execution vulnerabilityDescription
This version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is 7 Update 10 or earlier and is, therefore, potentially affected by the following security issues:- An unspecified issue exists in the Libraries component. (CVE-2012-3174)
- An error exists in the 'MBeanInstantiator.findClass' method that could allow remote, arbitrary code execution. (CVE-2013-0422)
Note that, according the advisory, these issues apply to client deployments of Java only and can only be exploited through untrusted 'Java Web Start' applications and untrusted Java applets
Solution
Update to JDK / JRE 7 Update 11 or later and, if necessary, remove any affected versions.See Also
http://www.nessus.org/u?eaf95a3d
http://www.oracle.com/technetwork/java/javase/7u11-relnotes-1896856.html
Plugin Details
Severity: Critical
ID: 6664
Family: Web Clients
Published: 1/10/2012
Updated: 3/6/2019
Nessus ID: 63521
Risk Information
VPR
Risk Factor: Critical
Score: 9.8
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 8.3
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 9.1
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:oracle:java_se
Patch Publication Date: 1/10/2013
Vulnerability Publication Date: 1/10/2013
Exploitable With
CANVAS (CANVAS)
Metasploit (Java Applet JMX Remote Code Execution)
Reference Information
CVE: CVE-2012-3174, CVE-2013-0422