CVE-2013-0422
Critical · 9.8 CISA KEV · ransomwareCVSS
9.8
EPSS
97.0%
Published
Jan 10, 2013
CISA due date
Jun 15, 2022
The record
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public getMBeanInstantiator method in the JmxMBeanServer class to obtain a reference to a private MBeanInstantiator object, then retrieving arbitrary Class references using the findClass method, and (2) using the Reflection API with recursion in a way that bypasses a security check by the java.lang.invoke.MethodHandles.Lookup.checkSecurityManager method due to the inability of the sun.reflect.Reflection.getCallerClass method to skip frames related to the new reflection API, as exploited in the wild in January 2013, as demonstrated by Blackhole and Nuclear Pack, and a different vulnerability than CVE-2012-4681 and CVE-2012-3174. NOTE: some parties have mapped the recursive Reflection API issue to CVE-2012-3174, but CVE-2012-3174 is for a different vulnerability whose details are not public as of 20130114. CVE-2013-0422 covers both the JMX/MBean and Reflection API issues. NOTE: it was originally reported that Java 6 was also vulnerable, but the reporter has retracted this claim, stating that Java 6 is not exploitable because the relevant code is called in a way that does not bypass security checks. NOTE: as of 20130114, a reliable third party has claimed that the findClass/MBeanInstantiator vector was not fixed in Oracle Java 7 Update 11. If there is still a vulnerable condition, then a separate CVE identifier might be created for the unfixed issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Red Hat:enterprise_linux:5::server | java-1.7.0-openjdk | 0 | 1:1.7.0.9-2.3.4.el5_9.1 |
| Red Hat:enterprise_linux:5::server | java-1.7.0-openjdk-debuginfo | 0 | 1:1.7.0.9-2.3.4.el5_9.1 |
| Red Hat:enterprise_linux:5::server | java-1.7.0-openjdk-demo | 0 | 1:1.7.0.9-2.3.4.el5_9.1 |
| Red Hat:enterprise_linux:5::server | java-1.7.0-openjdk-devel | 0 | 1:1.7.0.9-2.3.4.el5_9.1 |
| Red Hat:enterprise_linux:5::server | java-1.7.0-openjdk-javadoc | 0 | 1:1.7.0.9-2.3.4.el5_9.1 |
| Red Hat:enterprise_linux:5::server | java-1.7.0-openjdk-src | 0 | 1:1.7.0.9-2.3.4.el5_9.1 |
| Red Hat:enterprise_linux:6::client | java-1.7.0-openjdk | 0 | 1:1.7.0.9-2.3.4.1.el6_3 |
| Red Hat:enterprise_linux:6::client | java-1.7.0-openjdk-debuginfo | 0 | 1:1.7.0.9-2.3.4.1.el6_3 |
| Red Hat:enterprise_linux:6::client | java-1.7.0-openjdk-demo | 0 | 1:1.7.0.9-2.3.4.1.el6_3 |
| Red Hat:enterprise_linux:6::client | java-1.7.0-openjdk-devel | 0 | 1:1.7.0.9-2.3.4.1.el6_3 |
| Red Hat:enterprise_linux:6::client | java-1.7.0-openjdk-javadoc | 0 | 1:1.7.0.9-2.3.4.1.el6_3 |
| Red Hat:enterprise_linux:6::client | java-1.7.0-openjdk-src | 0 | 1:1.7.0.9-2.3.4.1.el6_3 |
| Red Hat:enterprise_linux:6::computenode | java-1.7.0-openjdk | 0 | 1:1.7.0.9-2.3.4.1.el6_3 |
| Red Hat:enterprise_linux:6::computenode | java-1.7.0-openjdk-debuginfo | 0 | 1:1.7.0.9-2.3.4.1.el6_3 |
| Red Hat:enterprise_linux:6::computenode | java-1.7.0-openjdk-demo | 0 | 1:1.7.0.9-2.3.4.1.el6_3 |
| Red Hat:enterprise_linux:6::computenode | java-1.7.0-openjdk-devel | 0 | 1:1.7.0.9-2.3.4.1.el6_3 |
| Red Hat:enterprise_linux:6::computenode | java-1.7.0-openjdk-javadoc | 0 | 1:1.7.0.9-2.3.4.1.el6_3 |
| Red Hat:enterprise_linux:6::computenode | java-1.7.0-openjdk-src | 0 | 1:1.7.0.9-2.3.4.1.el6_3 |
| Red Hat:enterprise_linux:6::server | java-1.7.0-openjdk | 0 | 1:1.7.0.9-2.3.4.1.el6_3 |
| Red Hat:enterprise_linux:6::server | java-1.7.0-openjdk-debuginfo | 0 | 1:1.7.0.9-2.3.4.1.el6_3 |
| Red Hat:enterprise_linux:6::server | java-1.7.0-openjdk-demo | 0 | 1:1.7.0.9-2.3.4.1.el6_3 |
| Red Hat:enterprise_linux:6::server | java-1.7.0-openjdk-devel | 0 | 1:1.7.0.9-2.3.4.1.el6_3 |
| Red Hat:enterprise_linux:6::server | java-1.7.0-openjdk-javadoc | 0 | 1:1.7.0.9-2.3.4.1.el6_3 |
| Red Hat:enterprise_linux:6::server | java-1.7.0-openjdk-src | 0 | 1:1.7.0.9-2.3.4.1.el6_3 |
| Red Hat:enterprise_linux:6::workstation | java-1.7.0-openjdk | 0 | 1:1.7.0.9-2.3.4.1.el6_3 |
| Red Hat:enterprise_linux:6::workstation | java-1.7.0-openjdk-debuginfo | 0 | 1:1.7.0.9-2.3.4.1.el6_3 |
| Red Hat:enterprise_linux:6::workstation | java-1.7.0-openjdk-demo | 0 | 1:1.7.0.9-2.3.4.1.el6_3 |
| Red Hat:enterprise_linux:6::workstation | java-1.7.0-openjdk-devel | 0 | 1:1.7.0.9-2.3.4.1.el6_3 |
| Red Hat:enterprise_linux:6::workstation | java-1.7.0-openjdk-javadoc | 0 | 1:1.7.0.9-2.3.4.1.el6_3 |
| Red Hat:enterprise_linux:6::workstation | java-1.7.0-openjdk-src | 0 | 1:1.7.0.9-2.3.4.1.el6_3 |
| Red Hat:rhel_extras:5::server | java-1.7.0-ibm | 0 | 1:1.7.0.4.0-1jpp.2.el5_9 |
| Red Hat:rhel_extras:5::server | java-1.7.0-ibm-demo | 0 | 1:1.7.0.4.0-1jpp.2.el5_9 |
| Red Hat:rhel_extras:5::server | java-1.7.0-ibm-devel | 0 | 1:1.7.0.4.0-1jpp.2.el5_9 |
| Red Hat:rhel_extras:5::server | java-1.7.0-ibm-jdbc | 0 | 1:1.7.0.4.0-1jpp.2.el5_9 |
| Red Hat:rhel_extras:5::server | java-1.7.0-ibm-plugin | 0 | 1:1.7.0.4.0-1jpp.2.el5_9 |
| Red Hat:rhel_extras:5::server | java-1.7.0-ibm-src | 0 | 1:1.7.0.4.0-1jpp.2.el5_9 |
| Red Hat:rhel_extras:5::server | java-1.7.0-oracle | 0 | 1:1.7.0.11-1jpp.3.el5_9 |
| Red Hat:rhel_extras:5::server | java-1.7.0-oracle-devel | 0 | 1:1.7.0.11-1jpp.3.el5_9 |
| Red Hat:rhel_extras:5::server | java-1.7.0-oracle-javafx | 0 | 1:1.7.0.11-1jpp.3.el5_9 |
| Red Hat:rhel_extras:5::server | java-1.7.0-oracle-jdbc | 0 | 1:1.7.0.11-1jpp.3.el5_9 |
| Red Hat:rhel_extras:5::server | java-1.7.0-oracle-plugin | 0 | 1:1.7.0.11-1jpp.3.el5_9 |
| Red Hat:rhel_extras:5::server | java-1.7.0-oracle-src | 0 | 1:1.7.0.11-1jpp.3.el5_9 |
| Red Hat:rhel_extras:6 | java-1.7.0-ibm | 0 | 1:1.7.0.4.0-1jpp.2.el6_4 |
| Red Hat:rhel_extras:6 | java-1.7.0-ibm-demo | 0 | 1:1.7.0.4.0-1jpp.2.el6_4 |
| Red Hat:rhel_extras:6 | java-1.7.0-ibm-devel | 0 | 1:1.7.0.4.0-1jpp.2.el6_4 |
| Red Hat:rhel_extras:6 | java-1.7.0-ibm-jdbc | 0 | 1:1.7.0.4.0-1jpp.2.el6_4 |
| Red Hat:rhel_extras:6 | java-1.7.0-ibm-plugin | 0 | 1:1.7.0.4.0-1jpp.2.el6_4 |
| Red Hat:rhel_extras:6 | java-1.7.0-ibm-src | 0 | 1:1.7.0.4.0-1jpp.2.el6_4 |
| Red Hat:rhel_extras:6 | java-1.7.0-oracle | 0 | 1:1.7.0.11-1jpp.3.el6_3 |
| Red Hat:rhel_extras:6 | java-1.7.0-oracle-devel | 0 | 1:1.7.0.11-1jpp.3.el6_3 |
| Red Hat:rhel_extras:6 | java-1.7.0-oracle-javafx | 0 | 1:1.7.0.11-1jpp.3.el6_3 |
| Red Hat:rhel_extras:6 | java-1.7.0-oracle-jdbc | 0 | 1:1.7.0.11-1jpp.3.el6_3 |
| Red Hat:rhel_extras:6 | java-1.7.0-oracle-plugin | 0 | 1:1.7.0.11-1jpp.3.el6_3 |
| Red Hat:rhel_extras:6 | java-1.7.0-oracle-src | 0 | 1:1.7.0.11-1jpp.3.el6_3 |
| openSUSE:Tumbleweed | java-1_7_0-openjdk | 0 | 1.7.0.121-1.1 |
Related vulnerabilities
- CVE-2016-10165 The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote… Also affects java-1.7.0-openjdk
- CVE-2017-3241 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE… Also affects java-1.7.0-openjdk
- CVE-2016-5542 Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; and Java SE Embedded… Also affects java-1.7.0-openjdk
- CVE-2016-3458 Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92; and Java SE Embedded… Also affects java-1.7.0-openjdk
- CVE-2016-3427 Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77… Also affects java-1.7.0-openjdk
- CVE-2016-0686 Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 and Java SE Embedded… Also affects java-1.7.0-openjdk
- CVE-2016-0636 Unspecified vulnerability in Oracle Java SE 7u97, 8u73, and 8u74 allows remote attackers… Also affects java-1.7.0-openjdk
- CVE-2016-0483 Unspecified vulnerability in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65… Also affects java-1.7.0-openjdk