CVE-2013-1569

What it actually does

Memory corruption in the 2D rendering path of the Java Runtime Environment, triggered by malformed glyph table data in the ICU Layout Engine, allowing arbitrary code execution with full read/write/execute impact.

Why it matters to the business

Remote attackers can fully compromise any system running vulnerable Java applications, leading to data theft, system takeover, and disruption of services that depend on Java SE 5/6/7.

How an attack unfolds

An attacker crafts a malicious font or document containing a malformed glyph table and delivers it to a target application that uses the vulnerable Java 2D subsystem; the ICU Layout Engine fails to validate the table, corrupting memory and allowing the attacker to execute arbitrary code with the privileges of the Java process.

How to fix it

Upgrade Oracle Java SE 7 to Update 18 or later, Java SE 6 to Update 44 or later, and Java SE 5 to Update 42 or later; replace any remaining Sun JDK/JRE installations with current Oracle equivalents; disable Java in browsers where it is not required.

How to confirm the fix worked

Inventory all Java installations and confirm versions are newer than the affected ranges listed in the April 2013 CPU; re-test applications that render 2D content with untrusted fonts or documents.

Typical attack path

1. Identify a target application that processes untrusted input with Java 2D (applets, documents, images)
2. Craft or obtain a malicious font/glyph table that triggers the ICU Layout Engine flaw
3. Deliver the payload via network, email attachment, or web page
4. Trigger the 2D code path inside the vulnerable JRE
5. Exploit the resulting memory corruption to achieve code execution

How to detect it

Review web server, application server, and endpoint logs for unexpected Java process crashes or child process creation around the time untrusted 2D content was processed; look for sudden privilege escalation or network connections initiated by java.exe/javaw.exe.

What your security team should do

• Immediately remove or update all Java SE 7u17 and earlier, 6u43 and earlier, and 5u41 and earlier deployments
• Block Java browser plugins on endpoints that do not require them
• Monitor for any remaining legacy Java usage and schedule removal