CVE-2013-1488

HIGH

Description

The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, allows remote attackers to execute arbitrary code via unspecified vectors involving reflection, Libraries, "improper toString calls," and the JDBC driver manager, as demonstrated by James Forshaw during a Pwn2Own competition at CanSecWest 2013.

References

http://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released/

http://blog.fuseyism.com/index.php/2013/04/25/security-icedtea-1-11-11-1-12-5-for-openjdk-6-released/

http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157

http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/a19614a3dabb

http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00007.html

http://lists.opensuse.org/opensuse-updates/2013-05/msg00017.html

http://lists.opensuse.org/opensuse-updates/2013-06/msg00099.html

http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-April/022796.html

http://rhn.redhat.com/errata/RHSA-2013-0752.html

http://rhn.redhat.com/errata/RHSA-2013-0757.html

http://security.gentoo.org/glsa/glsa-201406-32.xml

http://www.mandriva.com/security/advisories?name=MDVSA-2013:145

http://www.mandriva.com/security/advisories?name=MDVSA-2013:161

http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html

http://www.ubuntu.com/usn/USN-1806-1

http://www.us-cert.gov/ncas/alerts/TA13-107A

http://www.zdnet.com/pwn2own-down-go-all-the-browsers-7000012283/

https://bugzilla.redhat.com/show_bug.cgi?id=920247

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16511

https://twitter.com/thezdi/status/309425888188043264

https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0124

https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0130

Details

Source: MITRE

Published: 2013-03-08

Updated: 2017-09-19

Type: CWE-94

Risk Information

CVSS v2.0

Base Score: 10

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Impact Score: 10

Exploitability Score: 10

Severity: HIGH

Tenable Plugins

View all (35 total)

IDNameProductFamilySeverity
76303GLSA-201406-32 : IcedTea JDK: Multiple vulnerabilities (BEAST) (ROBOT)NessusGentoo Local Security Checks
critical
74999openSUSE Security Update : java-1_7_0-openjdk (openSUSE-SU-2013:0964-1)NessusSuSE Local Security Checks
critical
74991openSUSE Security Update : java-1_6_0-openjdk (openSUSE-SU-2013:0777-1)NessusSuSE Local Security Checks
critical
74990openSUSE Security Update : java-1_7_0-openjdk (openSUSE-SU-2013:0745-1)NessusSuSE Local Security Checks
critical
72139GLSA-201401-30 : Oracle JRE/JDK: Multiple vulnerabilities (ROBOT)NessusGentoo Local Security Checks
critical
71861IBM Domino 9.x < 9.0.1 Multiple Vulnerabilities (credentialed check)NessusWindows
critical
71859IBM Domino 9.x < 9.0.1 Multiple Vulnerabilities (uncredentialed check)NessusMisc.
critical
70744IBM Notes 8.5.x < 8.5.3 FP5 Multiple VulnerabilitiesNessusWindows
critical
70743IBM Domino 8.5.x < 8.5.3 FP5 Multiple VulnerabilitiesNessusWindows
critical
70742IBM Domino 8.5.x < 8.5.3 FP 5 Multiple VulnerabilitiesNessusMisc.
critical
69744Amazon Linux AMI : java-1.6.0-openjdk (ALAS-2013-185)NessusAmazon Linux Local Security Checks
critical
69742Amazon Linux AMI : java-1.7.0-openjdk (ALAS-2013-183)NessusAmazon Linux Local Security Checks
critical
68815Oracle Linux 5 / 6 : java-1.6.0-openjdk (ELSA-2013-0770)NessusOracle Linux Local Security Checks
critical
68812Oracle Linux 5 : java-1.7.0-openjdk (ELSA-2013-0752)NessusOracle Linux Local Security Checks
critical
68811Oracle Linux 6 : java-1.7.0-openjdk (ELSA-2013-0751)NessusOracle Linux Local Security Checks
critical
66538SuSE 11.2 Security Update : java-1_6_0-openjdk (SAT Patch Number 7718)NessusSuSE Local Security Checks
critical
66439RHEL 5 / 6 : java-1.7.0-ibm (RHSA-2013:0822)NessusRed Hat Local Security Checks
critical
66348Ubuntu 10.04 LTS / 11.10 / 12.04 LTS : openjdk-6 vulnerabilities (USN-1819-1)NessusUbuntu Local Security Checks
critical
66330Mandriva Linux Security Advisory : java-1.7.0-openjdk (MDVSA-2013:161)NessusMandriva Local Security Checks
critical
66228Scientific Linux Security Update : java-1.6.0-openjdk on SL5.x, SL6.x i386/x86_64 (20130424)NessusScientific Linux Local Security Checks
critical
66212RHEL 5 / 6 : java-1.6.0-openjdk (RHSA-2013:0770)NessusRed Hat Local Security Checks
critical
66205CentOS 5 / 6 : java-1.6.0-openjdk (CESA-2013:0770)NessusCentOS Local Security Checks
critical
66200Ubuntu 12.10 : openjdk-7 vulnerabilities (USN-1806-1)NessusUbuntu Local Security Checks
critical
66029RHEL 5 / 6 : java-1.7.0-oracle (RHSA-2013:0757)NessusRed Hat Local Security Checks
critical
66027CentOS 6 : java-1.7.0-openjdk (CESA-2013:0751)NessusCentOS Local Security Checks
critical
66019Scientific Linux Security Update : java-1.7.0-openjdk on SL6.x i386/x86_64 (20130417)NessusScientific Linux Local Security Checks
critical
66018Scientific Linux Security Update : java-1.7.0-openjdk on SL5.x i386/x86_64 (20130417)NessusScientific Linux Local Security Checks
critical
66014RHEL 5 : java-1.7.0-openjdk (RHSA-2013:0752)NessusRed Hat Local Security Checks
critical
66013RHEL 6 : java-1.7.0-openjdk (RHSA-2013:0751)NessusRed Hat Local Security Checks
critical
66002CentOS 5 : java-1.7.0-openjdk (CESA-2013:0752)NessusCentOS Local Security Checks
critical
6761Oracle Java JDK / JRE / SE Multiple Vulnerabilities (April 2013 CPU)Nessus Network MonitorWeb Clients
critical
65996Oracle Java SE Multiple Vulnerabilities (April 2013 CPU) (Unix)NessusMisc.
critical
65995Oracle Java SE Multiple Vulnerabilities (April 2013 CPU)NessusWindows
critical
64700Mac OS X : Java for OS X 2013-001NessusMacOS X Local Security Checks
critical
64699Mac OS X : Java for Mac OS X 10.6 Update 13NessusMacOS X Local Security Checks
critical