CVE-2012-4681KEV Β· OVERDUECWE-284broken-access-control

Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability

Critical Β· published August 28, 2012

Patch now

Confirmed exploited, and the score agrees

CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 99.9th percentile for exploit probability.

1674
days past CISA
deadline
CVSS v3.1
9.8
EPSS
99%
Percentile
99.9
In the wild
Confirmed
What it is

πŸ”₯ Just a crafted applet is all it takes to bypass security and execute arbitrary code in Oracle Java SE 7 Update 6 and earlier! Think of it like a sneaky magician pulling off a trick by using a secret passage to bypass all the security at a high-profile event. This vulnerability allows attackers to access restricted areas in the code like slipping backstage undetected! An attacker could exploit this vulnerability to run malicious code, leading to devastating consequences like data theft, system compromise, or even total control of affected systems. This is absolutely critical, as it not only endangers individual users but could also pose a significant threat to organizations and their sensitive data.

Put simply

Think of it like a sneaky magician pulling off a trick by using a secret passage to bypass all the security at a high-profile event. This vulnerability allows attackers to access restricted areas in the code like slipping backstage undetected! This vulnerability involves using a crafted applet that bypasses the Java SecurityManager’s restrictions, allowing access to restricted classes and modification of private fields through reflection, creating a direct pathway for arbitrary code execution.

What to do

An attacker could exploit this vulnerability to run malicious code, leading to devastating consequences like data theft, system compromise, or even total control of affected systems. This is absolutely critical, as it not only endangers individual users but could also pose a significant threat to organizations and their sensitive data. Update your Java Runtime Environment to the latest version immediately to patch this vulnerability. Ensure that you're on Java SE 7 Update 7 or later. Additionally, review security settings and consider disabling Java in browsers if it's not in use, as a precautionary measure. You've got this! Stay vigilant, and with these steps, you'll have your defenses bolstered in no time! πŸ›‘οΈ

The record
Technical detail
CVSS v3.1
9.8 Β· CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.98536 Β· 99.9th percentile
Weakness
CWE-284 Β· Improper Access Control
Published
2012-08-28T04:55Z
KEV added
2022-03-03 Β· due 2022-03-24
Affected products (85)
ProductVersionsFixed in
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jdkall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
oracle/jreall versionsβ€”
redhat/enterprise_linux_desktopall versionsβ€”
redhat/enterprise_linux_eusall versionsβ€”
redhat/enterprise_linux_serverall versionsβ€”
redhat/enterprise_linux_workstationall versionsβ€”
References (27)
http://blog.fireeye.com/research/2012/08/zero-day-season-is-not-over-yet.html Β· [email protected]http://immunityproducts.blogspot.com/2012/08/java-0day-analysis-cve-2012-4681.html Β· [email protected]http://labs.alienvault.com/labs/index.php/2012/new-java-0day-exploited-in-the-wild/ Β· [email protected]http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00032.html Β· [email protected]http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00016.html Β· [email protected]http://marc.info/?l=bugtraq&m=135109152819176&w=2 Β· [email protected]http://rhn.redhat.com/errata/RHSA-2012-1225.html Β· [email protected]http://secunia.com/advisories/51044 Β· [email protected]http://www.deependresearch.org/2012/08/java-7-vulnerability-analysis.html Β· [email protected]http://www.oracle.com/technetwork/topics/security/alert-cve-2012-4681-1835715.html Β· [email protected]http://www.securityfocus.com/bid/55213 Β· [email protected]http://www.us-cert.gov/cas/techalerts/TA12-240A.html Β· [email protected]https://community.rapid7.com/community/metasploit/blog/2012/08/27/lets-start-the-week-with-a-new-java-0day Β· [email protected]http://blog.fireeye.com/research/2012/08/zero-day-season-is-not-over-yet.html Β· af854a3a-2127-422b-91ae-364da2661108http://immunityproducts.blogspot.com/2012/08/java-0day-analysis-cve-2012-4681.html Β· af854a3a-2127-422b-91ae-364da2661108http://labs.alienvault.com/labs/index.php/2012/new-java-0day-exploited-in-the-wild/ Β· af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00032.html Β· af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00016.html Β· af854a3a-2127-422b-91ae-364da2661108http://marc.info/?l=bugtraq&m=135109152819176&w=2 Β· af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2012-1225.html Β· af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/51044 Β· af854a3a-2127-422b-91ae-364da2661108http://www.deependresearch.org/2012/08/java-7-vulnerability-analysis.html Β· af854a3a-2127-422b-91ae-364da2661108http://www.oracle.com/technetwork/topics/security/alert-cve-2012-4681-1835715.html Β· af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/55213 Β· af854a3a-2127-422b-91ae-364da2661108http://www.us-cert.gov/cas/techalerts/TA12-240A.html Β· af854a3a-2127-422b-91ae-364da2661108https://community.rapid7.com/community/metasploit/blog/2012/08/27/lets-start-the-week-with-a-new-java-0day Β· af854a3a-2127-422b-91ae-364da2661108https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-4681 Β· 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 03 MAR 00:00Z
    Added to CISA KEV β€” remediate by Mar 24
    kev
  • 28 AUG 00:00Z
    Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary…
    cvelistv5