Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-03-03
• Known to be used in ransomware campaigns
• EPSS: 99% chance of exploitation in the next 30 days (higher than 100% of CVEs)
• Critical severity: CVSS 9.8

[ Description ]Official description

Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses SecurityManager restrictions by (1) using com.sun.beans.finder.ClassFinder.findClass and leveraging an exception with the forName method to access restricted classes from arbitrary packages such as sun.awt.SunToolkit, then (2) using "reflection with a trusted immediate caller" to leverage the getField method to access and modify private fields, as exploited in the wild in August 2012 using Gondzz.class and Gondvv.class.

CISA: The Java Runtime Environment (JRE) component in Oracle Java SE allow for remote code execution.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 24 Mar 2022): Apply updates per vendor instructions.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• blog.fireeye.com/research/2012/08/zero-day-season-is-not-over-yet.htmlThird Party Advisory
• immunityproducts.blogspot.com/2012/08/java-0day-analysis-cve-2012-4681.htmlExploitThird Party Advisory
• labs.alienvault.com/labs/index.php/2012/new-java-0day-exploited-in-the-wildBroken LinkExploit
• lists.opensuse.org/opensuse-security-announce/2012-09/msg00032.htmlMailing List
• lists.opensuse.org/opensuse-security-announce/2012-10/msg00016.htmlMailing List
• marc.infoIssue TrackingMailing ListThird Party Advisory
• rhn.redhat.com/errata/RHSA-2012-1225.htmlThird Party Advisory
• secunia.com/advisories/51044Not Applicable
• www.deependresearch.org/2012/08/java-7-vulnerability-analysis.htmlBroken LinkThird Party Advisory
• www.oracle.com/technetwork/topics/security/alert-cve-2012-4681-1835715.htmlVendor Advisory
• www.securityfocus.com/bid/55213Broken LinkThird Party AdvisoryVDB Entry
• www.us-cert.gov/cas/techalerts/TA12-240A.htmlThird Party AdvisoryUS Government Resource
• community.rapid7.com/community/metasploit/blog/2012/08/27/lets-start-the-week-with-a-ne…Broken LinkThird Party Advisory
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource