CVE-2013-1489

HIGH

Description

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 10 and Update 11, when running on Windows using Internet Explorer, Firefox, Opera, and Google Chrome, allows remote attackers to bypass the "Very High" security level of the Java Control Panel and execute unsigned Java code without prompting the user via unknown vectors, aka "Issue 53" and the "Java Security Slider" vulnerability.

References

http://blogs.computerworld.com/malware-and-vulnerabilities/21693/yet-another-java-security-flaw-discovered-number-53

http://marc.info/?l=bugtraq&m=136439120408139&w=2

http://marc.info/?l=bugtraq&m=136733161405818&w=2

http://rhn.redhat.com/errata/RHSA-2013-0237.html

http://seclists.org/fulldisclosure/2013/Jan/241

http://thenextweb.com/insider/2013/01/28/new-vulnerability-bypasses-oracles-attempt-to-stop-malware-drive-by-downloads-via-java-applets/

http://www.informationweek.com/security/application-security/java-security-work-remains-bug-hunter-sa/240147150

http://www.kb.cert.org/vuls/id/858729

http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html

http://www.scmagazine.com.au/News/330453,java-still-unsafe-new-flaws-discovered.aspx

http://www.us-cert.gov/cas/techalerts/TA13-032A.html

http://www.zdnet.com/java-update-doesnt-prevent-silent-exploits-at-all-7000010422/

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15906

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19171

Details

Source: MITRE

Published: 2013-01-31

Updated: 2017-09-19

Risk Information

CVSS v2.0

Base Score: 10

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Impact Score: 10

Exploitability Score: 10

Severity: HIGH

Tenable Plugins

View all (9 total)

IDNameProductFamilySeverity
71861IBM Domino 9.x < 9.0.1 Multiple Vulnerabilities (credentialed check)NessusWindows
critical
71859IBM Domino 9.x < 9.0.1 Multiple Vulnerabilities (uncredentialed check)NessusMisc.
critical
70744IBM Notes 8.5.x < 8.5.3 FP5 Multiple VulnerabilitiesNessusWindows
critical
70743IBM Domino 8.5.x < 8.5.3 FP5 Multiple VulnerabilitiesNessusWindows
critical
70742IBM Domino 8.5.x < 8.5.3 FP 5 Multiple VulnerabilitiesNessusMisc.
critical
64850Oracle Java SE Multiple Vulnerabilities (February 2013 CPU) (Unix)NessusMisc.
critical
64468RHEL 5 / 6 : java-1.7.0-oracle (RHSA-2013:0237)NessusRed Hat Local Security Checks
critical
64454Oracle Java SE Multiple Vulnerabilities (February 2013 CPU)NessusWindows
critical
6685Oracle Java SE 7 <= Update 11 Multiple Vulnerabilities (February 2013 CPU)Nessus Network MonitorWeb Clients
critical