Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to…

published 2012-08-28 14 y ago modified 2026-08-06 3 mo ago also EUVD-2012-4606

cvss: 9.8; version 3.1, CNA
cisa kev: Exploited; added 2022-03-03, used in ransomware
epss: 98.5%; EPSS 98.5% chance of exploitation in 30 days, percentile 99.9%
public exploits: 2; Metasploit, Exploit-DB

Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses SecurityManager restrictions by (1) using com.sun.beans.finder.ClassFinder.findClass and leveraging an exception with the forName method to access restricted classes from arbitrary packages such as sun.awt.SunToolkit, then (2) using "reflection with a trusted immediate caller" to leverage the getField method to access and modify private fields, as exploited in the wild in August 2012 using Gondzz.class and Gondvv.class.

Patch / fix

cisa required action Apply updates per vendor instructions.

distros 2

red hat opensuse

java-1.7.0-ibm RHEL 6 EXTRAS 1:1.7.0.2.0-1jpp.3.el6_3
java-1.7.0-ibm-src RHEL 6 EXTRAS 1:1.7.0.2.0-1jpp.3.el6_3
java-1.7.0-ibm-demo RHEL 6 EXTRAS 1:1.7.0.2.0-1jpp.3.el6_3
java-1.7.0-ibm-jdbc RHEL 6 EXTRAS 1:1.7.0.2.0-1jpp.3.el6_3
java-1.7.0-ibm-plugin RHEL 6 EXTRAS 1:1.7.0.2.0-1jpp.3.el6_3
java-1.7.0-oracle RHEL 6 EXTRAS 1:1.7.0.7-1jpp.5.el6_3
java-1.7.0-oracle-src RHEL 6 EXTRAS 1:1.7.0.7-1jpp.5.el6_3
java-1.7.0-oracle-jdbc RHEL 6 EXTRAS 1:1.7.0.7-1jpp.5.el6_3

red hat advisories RHSA-2012:1289 RHSA-2012:1225 RHSA-2012:1223

java-1_7_0-openjdk openSUSE Tumbleweed 1.7.0.121-1.1

opensuse advisories openSUSE-SU-2024:10534-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2012-4681 updated 2026-11-04 cvss 6.8

OpenJDK: beans insufficient permission checks, Java 7 0day (beans, 7162473)

Red Hat Enterprise Linux 5 java-1.7.0-oracle, java-1.7.0-openjdk, java-1.7.0-oracle-src, java-1.7.0-oracle-demo, java-1.7.0-oracle-jdbc, java-1.7.0-oracle-javafx, +1 more
affected: no fix available
Red Hat Enterprise Linux Desktop (v. 6) java-1.7.0-openjdk 1.7.0.5-2.2.1.el6_3.3 Red Hat Enterprise Linux Desktop Optional (v. 6) java-1.7.0-openjdk 1.7.0.5-2.2.1.el6_3.3, java-1.7.0-openjdk-src 1.7.0.5-2.2.1.el6_3.3, java-1.7.0-openjdk-demo 1.7.0.5-2.2.1.el6_3.3, java-1.7.0-openjdk-javadoc 1.7.0.5-2.2.1.el6_3.3
fixed: vendor fix RHSA-2012:1223
Red Hat Enterprise Linux Desktop Supplementary (v. 6) java-1.7.0-ibm 1.7.0.2.0-1jpp.3.el6_3, java-1.7.0-oracle 1.7.0.7-1jpp.5.el6_3, java-1.7.0-ibm-src 1.7.0.2.0-1jpp.3.el6_3, java-1.7.0-ibm-demo 1.7.0.2.0-1jpp.3.el6_3, java-1.7.0-ibm-jdbc 1.7.0.2.0-1jpp.3.el6_3, java-1.7.0-oracle-src 1.7.0.7-1jpp.5.el6_3, +3 more
fixed: vendor fix RHSA-2012:1289
Red Hat Enterprise Linux HPC Node Optional (v. 6) java-1.7.0-openjdk 1.7.0.5-2.2.1.el6_3.3, java-1.7.0-openjdk-src 1.7.0.5-2.2.1.el6_3.3, java-1.7.0-openjdk-demo 1.7.0.5-2.2.1.el6_3.3, java-1.7.0-openjdk-javadoc 1.7.0.5-2.2.1.el6_3.3
fixed: vendor fix RHSA-2012:1223
Red Hat Enterprise Linux HPC Node Supplementary (v. 6) java-1.7.0-ibm 1.7.0.2.0-1jpp.3.el6_3, java-1.7.0-oracle 1.7.0.7-1jpp.5.el6_3, java-1.7.0-ibm-src 1.7.0.2.0-1jpp.3.el6_3, java-1.7.0-ibm-demo 1.7.0.2.0-1jpp.3.el6_3, java-1.7.0-oracle-src 1.7.0.7-1jpp.5.el6_3
fixed: vendor fix RHSA-2012:1289
Red Hat Enterprise Linux Server (v. 6) java-1.7.0-openjdk 1.7.0.5-2.2.1.el6_3.3 Red Hat Enterprise Linux Server Optional (v. 6) java-1.7.0-openjdk 1.7.0.5-2.2.1.el6_3.3, java-1.7.0-openjdk-src 1.7.0.5-2.2.1.el6_3.3, java-1.7.0-openjdk-demo 1.7.0.5-2.2.1.el6_3.3, java-1.7.0-openjdk-javadoc 1.7.0.5-2.2.1.el6_3.3
fixed: vendor fix RHSA-2012:1223
Red Hat Enterprise Linux Server Supplementary (v. 6) java-1.7.0-ibm 1.7.0.2.0-1jpp.3.el6_3, java-1.7.0-oracle 1.7.0.7-1jpp.5.el6_3, java-1.7.0-ibm-src 1.7.0.2.0-1jpp.3.el6_3, java-1.7.0-ibm-demo 1.7.0.2.0-1jpp.3.el6_3, java-1.7.0-ibm-jdbc 1.7.0.2.0-1jpp.3.el6_3, java-1.7.0-oracle-src 1.7.0.7-1jpp.5.el6_3, +3 more
fixed: vendor fix RHSA-2012:1289
Red Hat Enterprise Linux Workstation (v. 6) java-1.7.0-openjdk 1.7.0.5-2.2.1.el6_3.3 Red Hat Enterprise Linux Workstation Optional (v. 6) java-1.7.0-openjdk 1.7.0.5-2.2.1.el6_3.3, java-1.7.0-openjdk-src 1.7.0.5-2.2.1.el6_3.3, java-1.7.0-openjdk-demo 1.7.0.5-2.2.1.el6_3.3, java-1.7.0-openjdk-javadoc 1.7.0.5-2.2.1.el6_3.3
fixed: vendor fix RHSA-2012:1223

show 2 more

Red Hat Enterprise Linux Workstation Supplementary (v. 6) java-1.7.0-ibm 1.7.0.2.0-1jpp.3.el6_3, java-1.7.0-oracle 1.7.0.7-1jpp.5.el6_3, java-1.7.0-ibm-src 1.7.0.2.0-1jpp.3.el6_3, java-1.7.0-ibm-demo 1.7.0.2.0-1jpp.3.el6_3, java-1.7.0-ibm-jdbc 1.7.0.2.0-1jpp.3.el6_3, java-1.7.0-oracle-src 1.7.0.7-1jpp.5.el6_3, +3 more
fixed: vendor fix RHSA-2012:1289
Red Hat Enterprise Linux 5 java-1.6.0-ibm, java-1.6.0-sun, java-1.6.0-openjdk, java-1.6.0-sun-src, java-1.6.0-sun-demo, java-1.6.0-sun-jdbc, +2 more Red Hat Enterprise Linux 6 java-1.6.0-ibm, java-1.6.0-sun, java-1.6.0-ibm-src, java-1.6.0-openjdk, java-1.6.0-sun-src, java-1.6.0-ibm-demo, +9 more
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

2012-08-26 First public exploit (Metasploit exploit/multi/browser/java_jre17_exec)
2012-08-28 Published
2022-03-02 CISA SSVC: exploitation active
2022-03-03 Added to CISA KEV
2022-03-24 CISA patch deadline

Known exploited

Added: 4 y ago (2022-03-03)
Patch by: 2022-03-24 (4 y ago)
Ransomware: Known to be used in ransomware campaigns
Required action: Apply updates per vendor instructions.
Vendor, product: Oracle, Java SE
CISA name: Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability

CISA SSVC

Exploitation: Active, exploited in the wild
Automatable: yes
Technical impact: total
Assessed: 4 y ago (2022-03-02)

Exploit prediction

98.54% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

Metasploit exploit/multi/browser/java_jre17_exec Java 7 Applet Remote Code Execution metasploit exploit, excellent rank, 2012-08-26
EDB-20865 Java 7 Applet - Remote Code Execution (Metasploit) remote, 2012-08-27
labs.alienvault.com http://labs.alienvault.com/labs/index.php/2012/new-java-0day-exploited-in-the-wild/ referenced PoC, tagged "exploit" by a source, unverified
immunityproducts.blogspot.com http://immunityproducts.blogspot.com/2012/08/java-0day-analysis-cve-2012-4681.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	10.0	AV:N/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness

CWE-284 Improper Access Control

References

labs.alienvault.com /labs/index.php/2012/new-java-0day-exploited-in-the-wild/
broken-link, exploit
immunityproducts.blogspot.com /2012/08/java-0day-analysis-cve-2012-4681.html
exploit, third-party-advisory
lists.opensuse.org /opensuse-security-announce/2012-10/msg00016.html
vendor-advisory, mailing-list
lists.opensuse.org /opensuse-security-announce/2012-09/msg00032.html
vendor-advisory, mailing-list
marc.info /?l=bugtraq&m=135109152819176&w=2
vendor-advisory, issue-tracking, mailing-list, third-party-advisory
rhn.redhat.com /errata/RHSA-2012-1225.html
vendor-advisory, third-party-advisory
oracle.com /technetwork/topics/security/alert-cve-2012-4681-1835715.html
vendor-advisory
blog.fireeye.com /research/2012/08/zero-day-season-is-not-over-yet.html
third-party-advisory
us-cert.gov /cas/techalerts/TA12-240A.html
third-party-advisory, us-government-resource
community.rapid7.com /community/metasploit/blog/2012/08/27/lets-start-the-week-with-a-new-java-0day
broken-link, third-party-advisory
deependresearch.org /2012/08/java-7-vulnerability-analysis.html
broken-link, third-party-advisory
secunia.com /advisories/51044
third-party-advisory, not-applicable
securityfocus.com /bid/55213
vdb-entry, broken-link, third-party-advisory
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-4681
government-resource, us-government-resource

Sources

CVE List CVE-2012-4681
NVD CVE-2012-4681

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary