Login Request a demo
Critical severity · published Aug 28, 2012
CVE-2012-4681
Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
RansomwareIn wildKEV
9.8
CVSS
98.5%
EPSS
Yes
On KEV
Description
Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses SecurityManager restrictions by (1) using com.sun.beans.finder.ClassFinder.findClass and leveraging an exception with the forName method to access restricted classes from arbitrary packages such as sun.awt.SunToolkit, then (2) using "reflection with a trusted immediate caller" to leverage the getField method to access and modify private fields, as exploited in the wild in August 2012 using Gondzz.class and Gondvv.class.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)98.5% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Mar 3, 2022
Federal remediation dueMar 24, 2022
Ransomware campaign useKnown
Affected products
Which versions
EL
Enterprise Linux Desktop · Redhat
6.0 · source: NVD
EL
Enterprise Linux Eus · Redhat
6.3 · source: NVD
EL
Enterprise Linux Server · Redhat
6.0 · source: NVD
EL
Enterprise Linux Workstation · Redhat
6.0 · source: NVD
JD
Jdk · Oracle
1.6.0; 1.6.0; 1.6.0; 1.6.0; 1.6.0; 1.6.0; +34 more · source: NVD
JR
Jre · Oracle
1.6.0; 1.6.0; 1.6.0; 1.6.0; 1.6.0; 1.6.0; +34 more · source: NVD
JS
Java SE · Oracle
All versions, or not specified · source: KEV
Affected product
JD
Jdk
Oracle
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-4681
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-4681
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_MISC
http://blog.fireeye.com/research/2012/08/zero-day-season-is-not-over-yet.html
vendor-advisory
http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00016.html
vendor-advisory
http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00032.html
third-party-advisory
http://www.us-cert.gov/cas/techalerts/TA12-240A.html
x_refsource_MISC
http://labs.alienvault.com/labs/index.php/2012/new-java-0day-exploited-in-the-wild/
vendor-advisory
http://marc.info/?l=bugtraq&m=135109152819176&w=2
More from Jdk
9.8
CVE-2016-3427
Oracle Java SE and JRockit Unspecified Vulnerability
9.8
CVE-2015-2590
Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability
9.8
CVE-2013-0422
Oracle JRE Remote Code Execution Vulnerability
9.8
CVE-2012-1723
Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
9.8
CVE-2011-3544
Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability