Upstream information
Description
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public getMBeanInstantiator method in the JmxMBeanServer class to obtain a reference to a private MBeanInstantiator object, then retrieving arbitrary Class references using the findClass method, and (2) using the Reflection API with recursion in a way that bypasses a security check by the java.lang.invoke.MethodHandles.Lookup.checkSecurityManager method due to the inability of the sun.reflect.Reflection.getCallerClass method to skip frames related to the new reflection API, as exploited in the wild in January 2013, as demonstrated by Blackhole and Nuclear Pack, and a different vulnerability than CVE-2012-4681 and CVE-2012-3174. NOTE: some parties have mapped the recursive Reflection API issue to CVE-2012-3174, but CVE-2012-3174 is for a different vulnerability whose details are not public as of 20130114. CVE-2013-0422 covers both the JMX/MBean and Reflection API issues. NOTE: it was originally reported that Java 6 was also vulnerable, but the reporter has retracted this claim, stating that Java 6 is not exploitable because the relevant code is called in a way that does not bypass security checks. NOTE: as of 20130114, a reliable third party has claimed that the findClass/MBeanInstantiator vector was not fixed in Oracle Java 7 Update 11. If there is still a vulnerable condition, then a separate CVE identifier might be created for the unfixed issue.SUSE information
Overall state of this security issue: Resolved
This issue is currently rated as having critical severity.
| National Vulnerability Database | |
|---|---|
| Base Score | 10 |
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
| Access Vector | Network |
| Access Complexity | Low |
| Authentication | None |
| Confidentiality Impact | Complete |
| Integrity Impact | Complete |
| Availability Impact | Complete |
SUSE Security Advisories:
- TID7011765, published Sun May 20 21:49:45 CEST 2018
- TID7021279, published Sa 3. Mär 12:00:59 CET 2018
- TID7021300, published Sat Mar 3 09:45:58 UTC 2018
- TID7021433, published Sat Mar 3 09:45:57 UTC 2018
- TID7021518, published Sa 3. Mär 12:01:00 CET 2018
- TID7021676, published Sa 3. Mär 10:24:18 CET 2018
- TID7021823, published Sa 3. Mär 10:24:20 CET 2018
- TID7021848, published Sa 3. Mär 12:00:57 CET 2018
- TID7021874, published Sat Mar 3 09:45:59 UTC 2018
- TID7022077, published Sat Mar 3 09:45:43 UTC 2018
- TID7022102, published Sat Mar 3 09:45:41 UTC 2018
- openSUSE-SU-2013:0199-1, published Fri Dec 8 15:48:58 2023
List of released packages
| Product(s) | Fixed package version(s) | References |
|---|---|---|
| SUSE Linux Enterprise Desktop 11 SP2 SUSE Linux Enterprise Software Development Kit 11 SP2 |
| Patchnames: sdksp2-java-1_7_0-ibm |
| SUSE Linux Enterprise Desktop 12 SP1 |
| Patchnames: SUSE Linux Enterprise Desktop 12 SP1 GA java-1_7_0-openjdk-1.7.0.91-21.2 |
| SUSE Linux Enterprise Desktop 12 SP2 |
| Patchnames: SUSE Linux Enterprise Desktop 12 SP2 GA java-1_7_0-openjdk-1.7.0.111-33.1 |
| SUSE Linux Enterprise Desktop 12 SP3 |
| Patchnames: SUSE Linux Enterprise Desktop 12 SP3 GA java-1_7_0-openjdk-1.7.0.141-42.1 |
| SUSE Linux Enterprise Desktop 12 SP4 |
| Patchnames: SUSE Linux Enterprise Desktop 12 SP4 GA java-1_7_0-openjdk-1.7.0.181-43.15.2 |
| SUSE Linux Enterprise Desktop 12 |
| Patchnames: SUSE Linux Enterprise Desktop 12 GA java-1_7_0-openjdk-1.7.0.65-3.7 |
| SUSE Linux Enterprise High Performance Computing 12 SP5 |
| Patchnames: SUSE Linux Enterprise High Performance Computing 12 SP5 GA java-1_7_0-openjdk-1.7.0.231-43.27.2 |
| SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Server for SAP Applications 11 SP2 |
| Patchnames: sdksp2-java-1_7_0-ibm slessp2-java-1_7_0-ibm |
| SUSE Linux Enterprise Server 11 SP3 |
| Patchnames: SUSE Linux Enterprise Server 11 SP3 GA java-1_7_0-ibm-1.7.0_sr4.1-0.5.1 |
| SUSE Linux Enterprise Server 12 SP1 |
| Patchnames: SUSE Linux Enterprise Server 12 SP1 GA java-1_7_0-openjdk-1.7.0.91-21.2 |
| SUSE Linux Enterprise Server 12 SP2 |
| Patchnames: SUSE Linux Enterprise Server 12 SP2 GA java-1_7_0-openjdk-1.7.0.111-33.1 |
| SUSE Linux Enterprise Server 12 SP3 |
| Patchnames: SUSE Linux Enterprise Server 12 SP3 GA java-1_7_0-openjdk-1.7.0.141-42.1 |
| SUSE Linux Enterprise Server 12 SP4 |
| Patchnames: SUSE Linux Enterprise Server 12 SP4 GA java-1_7_0-openjdk-1.7.0.181-43.15.2 |
| SUSE Linux Enterprise Server 12 SP5 |
| Patchnames: SUSE Linux Enterprise Server 12 SP5 GA java-1_7_0-openjdk-1.7.0.231-43.27.2 |
| SUSE Linux Enterprise Server 12 |
| Patchnames: SUSE Linux Enterprise Server 12 GA java-1_7_0-openjdk-1.7.0.6-33.3 SUSE Linux Enterprise Server 12 GA java-1_7_0-openjdk-1.7.0.65-3.7 |
| SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 |
| Patchnames: SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 GA java-1_7_0-openjdk-1.7.0.111-33.1 |
| openSUSE Tumbleweed |
| Patchnames: openSUSE-Tumbleweed-2024-10534 |
Status of this issue by product and package
Please note that this evaluation state might be work in progress, incomplete or outdated. Also information for service packs in the LTSS phase is only included for issues meeting the LTSS criteria. If in doubt, feel free to contact us for clarification. The updates are grouped by state of their lifecycle. SUSE product lifecycles are documented on the lifecycle page.
| Product(s) | Source package | State |
|---|---|---|
| Products past their end of life and not receiving proactive updates anymore. | ||
| SUSE Linux Enterprise Desktop 11 SP2 | java-1_7_0-ibm | Affected |
| SUSE Linux Enterprise Desktop 11 SP3 | java-1_7_0-ibm | Affected |
| SUSE Linux Enterprise Desktop 11 SP3 | java-1_7_0-openjdk | Already fixed |
| SUSE Linux Enterprise Desktop 11 SP4 | java-1_7_0-openjdk | Already fixed |
| SUSE Linux Enterprise Point of Sale 11 SP3 | java-1_7_0-ibm | Affected |
| SUSE Linux Enterprise Point of Service 11 SP3 | java-1_7_0-ibm | Affected |
| SUSE Linux Enterprise Server 11 SP2 | java-1_7_0-ibm | Affected |
| SUSE Linux Enterprise Server 11 SP2-LTSS | java-1_7_0-ibm | Affected |
| SUSE Linux Enterprise Server 11 SP3 | java-1_7_0-ibm | Affected |
| SUSE Linux Enterprise Server 11 SP3-LTSS | java-1_7_0-ibm | Affected |
| SUSE Linux Enterprise Server for SAP Applications 11 SP2 | java-1_7_0-ibm | Affected |
| SUSE Linux Enterprise Server for SAP Applications 11 SP3 | java-1_7_0-ibm | Affected |
| SUSE Linux Enterprise Software Development Kit 11 SP2 | java-1_7_0-ibm | Affected |
| SUSE Linux Enterprise Software Development Kit 11 SP3 | java-1_7_0-ibm | Affected |
SUSE Timeline for this CVE
CVE page created: Fri Jun 28 13:18:50 2013CVE page last modified: Sun Oct 13 00:14:07 2024