Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses SecurityManager restrictions by (1) using com.sun.beans.finder.ClassFinder.findClass and leveraging an exception with the forName method to access restricted classes from arbitrary packages such as sun.awt.SunToolkit, then (2) using "reflection with a trusted immediate caller" to leverage the getField method to access and modify private fields, as exploited in the wild in August 2012 using Gondzz.class and Gondvv.class.

Java-1_7_0-openjdk was updated to fix a remote exploit (CVE-2012-4681).

Also bugfixes were done :

  - fix build on ARM and i586

  - remove files that are no longer used

  - zero build can be enabled using rpmbuild (osc build)
    --with zero

  - add hotspot 2.1 needed for zero

  - fix filelist on %(ix86)

  - Security fixes

  - S7162476, CVE-2012-1682: XMLDecoder security issue via     ClassFinder

  - S7194567, CVE-2012-3136: Improve long term persistence     of java.beans objects

  - S7163201, CVE-2012-0547: Simplify toolkit internals     references

  - RH852051, CVE-2012-4681, S7162473: Reintroduce     PackageAccessible checks removed in 6788531.

  - OpenJDK

  - Fix Zero FTBFS issues with 2.3

  - S7180036: Build failure in Mac platform caused by fix #     7163201

  - S7182135: Impossible to use some editors directly

  - S7183701: [TEST]     closed/java/beans/security/TestClassFinder.java &ndash;
    compilation failed

  - S7185678:
    java/awt/Menu/NullMenuLabelTest/NullMenuLabelTest.java     failed with NPE

  - Bug fixes

  - PR1149: Zero-specific patch files not being packaged

  - use icedtea tarball for build again, this led into     following dropped files because the are already in the     tarball and simplified %prep and %build

  - drop class-rewriter.tar.gz

  - drop systemtap-tapset.tar.gz

  - drop desktop-files.tar.gz

  - drop nss.cfg

  - drop pulseaudio.tar.gz

  - drop remove-intree-libraries.sh

  - add archives from icedtea7-forest-2.3 for openjdk,     corba, jaxp, jaxws, jdk, langtools and hotspot

  - drop rhino.patch, pulse-soundproperties and systemtap     patch

  - move gnome bridge patches before make as it's irritating     to have the patch fail after openjdk is built

  - use explicit file attributes in %files sections to     prevent the file permissions problems in a future (like     bnc#770040)

  - changed version scheme, so it now matches Oracle Java     1.7.0.6 == Java7 u 6

  - update to icedtea-2.3.1 / OpenJDK7 u6 (bnc#777499)

  - Security fixes

  - RH852051, CVE-2012-4681: Reintroduce PackageAccessible     checks removed in 6788531.

  - Bug fixes

  - PR902: PulseAudioClip getMicrosecondsLength() returns     length in milliseconds, not microseconds

  - PR986: IcedTea7 fails to build with IcedTea6 CACAO due     to low max heapsize

  - PR1050: Stream objects not garbage collected

  - PR1119: Only add classes to rt-source-files.txt if the     class (or one or more of its methods/fields) are     actually missing from the boot JDK

  - PR1137: Allow JARs to be optionally compressed by     setting COMPRESS_JARS

  - OpenJDK

  - Make dynamic support for GConf work again.

  - PR1095: Add configure option for -Werror

  - PR1101: Undefined symbols on GNU/Linux SPARC

  - PR1140: Unnecessary diz files should not be installed

  - S7192804, PR1138: Build should not install jvisualvm man     page for OpenJDK

  - JamVM

  - ARMv6 armhf: Changes for Raspbian (Raspberry Pi)

  - PPC: Don't use lwsync if it isn't supported

  - X86: Generate machine-dependent stubs for i386

  - When suspending, ignore detached threads that have died,     this prevents a user caused deadlock when an external     thread has been attached to the VM via JNI and it has     exited without detaching

  - Add missing REF_TO_OBJs for references passed from JNI,     this enable JamVM to run Qt-Jambi

  - there are number of fixes in 2.3, see NEWS

The remote host is affected by the vulnerability described in GLSA-201401-30 (Oracle JRE/JDK: Multiple vulnerabilities)

    Multiple vulnerabilities have been reported in the Oracle Java       implementation. Please review the CVE identifiers referenced below for       details.
  Impact :

    An unauthenticated, remote attacker could exploit these vulnerabilities       to execute arbitrary code.
      Furthermore, a local or remote attacker could exploit these       vulnerabilities to cause unspecified impact, possibly including remote       execution of arbitrary code.
  Workaround :

    There is no known workaround at this time.

From Red Hat Security Advisory 2012:1223 :

Updated java-1.7.0-openjdk packages that fix several security issues are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

These packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Software Development Kit.

Multiple improper permission check issues were discovered in the Beans component in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. (CVE-2012-4681, CVE-2012-1682, CVE-2012-3136)

A hardening fix was applied to the AWT component in OpenJDK, removing functionality from the restricted SunToolkit class that was used in combination with other flaws to bypass Java sandbox restrictions.
(CVE-2012-0547)

All users of java-1.7.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is earlier than 7 Update 7 and is, therefore, potentially affected the following vulnerabilities :

  - The 'getField' method in the 'sun.awt.SunToolkit class'     provided by the bundled SunToolkit can be used to     obtain any field of a class - even private fields.
    This error can allow privilege escalation.
    (CVE-2012-0547)

  - Two unspecified remote code execution vulnerabilities     exist related to the     'com.sun.beans.finder.ConstructorFinder' and     'com.sun.beans.finder.FieldFinder' methods. No further     details have been provided. (CVE-2012-1682,     CVE-2012-3136)

  - The 'setField' method provided by the bundled SunToolkit     can be used to execute a privileged operation and calls     'setAccessible(true)' on the returned field reference,     allowing an attacker to disable any 'final' or 'private'     directives and gain full control to run code in the Java     virtual machine. (CVE-2012-4681)

Note that at least one of these vulnerabilities is currently being exploited in the wild.

The version of Oracle (formerly Sun) Java Runtime Environment (JRE) 6.x installed on the remote host is earlier than Update 35. It is, therefore, affected by the following vulnerabilities:

  - Multiple improper permission check issues were discovered     in the Beans component in OpenJDK. An untrusted Java     application or applet could use these flaws to use     classes from restricted packages, allowing it to bypass     Java sandbox restrictions. (CVE-2012-4681, CVE-2012-1682,     CVE-2012-3136, CVE-2012-0547)

Please note this issue is not directly exploitable, rather it can aid in attacks against other, directly exploitable vulnerabilities, such as that found in CVE-2012-4681.

IBM Java 1.7.0 was updated to SR2 which fixes critical security issues.

java-openjdk was upgraded to version 1.11.5 to fix various security and non-security issues.

Updated java-1.7.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 6 Supplementary.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

IBM Java SE version 7 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Detailed vulnerability descriptions are linked from the IBM Security alerts page, listed in the References section. (CVE-2012-0547, CVE-2012-0551, CVE-2012-1682, CVE-2012-1713, CVE-2012-1716, CVE-2012-1717, CVE-2012-1719, CVE-2012-1721, CVE-2012-1722, CVE-2012-1725, CVE-2012-1726, CVE-2012-3136, CVE-2012-4681)

All users of java-1.7.0-ibm are advised to upgrade to these updated packages, containing the IBM Java SE 7 SR2 release. All running instances of IBM Java must be restarted for the update to take effect.

These vulnerabilities may be remotely exploitable without authentication, i.e., they may be exploited over a network without the need for a username and password. To be successfully exploited, an unsuspecting user running an affected release in a browser will need to visit a malicious web page that leverages this vulnerability.
Successful exploits can impact the availability, integrity, and confidentiality of the user's system.

In addition, this Security Alert includes a security-in-depth fix in the AWT subcomponent of the Java Runtime Environment.

Due to the severity of these vulnerabilities, the public disclosure of technical details and the reported exploitation of CVE-2012-4681 'in the wild,' we strongly recommend that you apply the updates as soon as possible.

Updated java-1.7.0-openjdk packages that fix several security issues are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

These packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Software Development Kit.

Multiple improper permission check issues were discovered in the Beans component in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. (CVE-2012-4681, CVE-2012-1682, CVE-2012-3136)

A hardening fix was applied to the AWT component in OpenJDK, removing functionality from the restricted SunToolkit class that was used in combination with other flaws to bypass Java sandbox restrictions.
(CVE-2012-0547)

All users of java-1.7.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect.

These packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Software Development Kit.

Multiple improper permission check issues were discovered in the Beans component in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. (CVE-2012-4681, CVE-2012-1682, CVE-2012-3136)

A hardening fix was applied to the AWT component in OpenJDK, removing functionality from the restricted SunToolkit class that was used in combination with other flaws to bypass Java sandbox restrictions.
(CVE-2012-0547)

All users of java-1.7.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect.

Updated java-1.7.0-oracle packages that fix several security issues are now available for Red Hat Enterprise Linux 6 Supplementary.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The Oracle Java 7 release includes the Oracle Java 7 Runtime Environment and the Oracle Java 7 Software Development Kit.

This update fixes several vulnerabilities in the Oracle Java 7 Runtime Environment and the Oracle Java 7 Software Development Kit. Further information about these flaws can be found on the Oracle Java SE Security Alert page, listed in the References section. (CVE-2012-4681, CVE-2012-1682, CVE-2012-3136, CVE-2012-0547)

Red Hat is aware that a public exploit for CVE-2012-4681 is available that executes code without user interaction when a user visits a malicious web page using a browser with the Oracle Java 7 web browser plug-in enabled.

All users of java-1.7.0-oracle are advised to upgrade to these updated packages, which provide Oracle Java 7 Update 7 and resolve these issues. All running instances of Oracle Java must be restarted for the update to take effect.

US-CERT reports :

Oracle Java Runtime Environment (JRE) 1.7 contains a vulnerability that may allow an applet to call setSecurityManager in a way that allows setting of arbitrary permissions.

By leveraging the public, privileged getField() function, an untrusted Java applet can escalate its privileges by calling the setSecurityManager() function to allow full privileges, without requiring code signing.

This vulnerability is being actively exploited in the wild, and exploit code is publicly available.

This exploit does not only affect Java applets, but every piece of software that relies on the Java Security Manager for sandboxing executable code is affected: malicious code can totally disable Security Manager.

This version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is 7 Update 6 or earlier and is, therefore, potentially affected by an unspecified code execution vulnerability.  Note that this vulnerability is currently being exploited in the wild.

ID	Name	Product	Family	Severity
74748	openSUSE Security Update : java-1_7_0-openjdk (openSUSE-SU-2012:1154-1)	Nessus	SuSE Local Security Checks	critical
72139	GLSA-201401-30 : Oracle JRE/JDK: Multiple vulnerabilities (ROBOT)	Nessus	Gentoo Local Security Checks	critical
68611	Oracle Linux 6 : java-1.7.0-openjdk (ELSA-2012-1223)	Nessus	Oracle Linux Local Security Checks	critical
64841	Oracle Java SE 7 < Update 7 Multiple Vulnerabilities (Unix)	Nessus	Misc.	critical
64839	Oracle Java JDK / JRE 6 < Update 35 Multiple Vulnerabilities	Nessus	Misc.	critical
64170	SuSE 11.2 Security Update : IBM Java (SAT Patch Number 6839)	Nessus	SuSE Local Security Checks	critical
64169	SuSE 11.2 Security Update : OpenJDK (SAT Patch Number 6987)	Nessus	SuSE Local Security Checks	critical
62196	RHEL 6 : java-1.7.0-ibm (RHSA-2012:1289)	Nessus	Red Hat Local Security Checks	critical
62071	Scientific Linux Security Update : java-1.6.0-sun on SL5.x i386/x86_64 (20120904)	Nessus	Scientific Linux Local Security Checks	critical
61789	CentOS 6 : java-1.7.0-openjdk (CESA-2012:1223)	Nessus	CentOS Local Security Checks	critical
61786	Scientific Linux Security Update : java-1.7.0-openjdk on SL6.x i386/x86_64 (20120903)	Nessus	Scientific Linux Local Security Checks	critical
61770	RHEL 6 : java-1.7.0-oracle (RHSA-2012:1225)	Nessus	Red Hat Local Security Checks	critical
61769	RHEL 6 : java-1.7.0-openjdk (RHSA-2012:1223)	Nessus	Red Hat Local Security Checks	critical
61740	FreeBSD : Java 1.7 -- security manager bypass (16846d1e-f1de-11e1-8bd8-0022156e8794)	Nessus	FreeBSD Local Security Checks	critical
6554	Oracle Java SE 7 <= Update 6 Code Execution	Nessus Network Monitor	Web Clients	high
61681	Oracle Java SE 7 < Update 7 Multiple Vulnerabilities	Nessus	Windows	critical

Detections

Analytics

CVE-2012-4681

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

critical