CVE-2013-0422 kev+ ransomware in the critical feed json
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public getMBea…
published 13y ago modified 4mo ago also EUVD-2013-0433
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Exploited
- added 2022-05-25, used in ransomware
- epss
- 97.1%
- EPSS 97.1% chance of exploitation in 30 days, percentile 99.8%
- public exploits
- 2
- Metasploit and Exploit-DB
Summary
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public getMBeanInstantiator method in the JmxMBeanServer class to obtain a reference to a private MBeanInstantiator object, then retrieving arbitrary Class references using the findClass method, and (2) using the Reflection API with recursion in a way that bypasses a security check by the java.lang.invoke.MethodHandles.Lookup.checkSecurityManager method due to the inability of the sun.reflect.Reflection.getCallerClass method to skip frames related to the new reflection API, as exploited in the wild in January 2013, as demonstrated by Blackhole and Nuclear Pack, and a different vulnerability than CVE-2012-4681 and CVE-2012-3174. NOTE: some parties have mapped the recursive Reflection API issue to CVE-2012-3174, but CVE-2012-3174 is for a different vulnerability whose details are not public as of 20130114. CVE-2013-0422 covers both the JMX/MBean and Reflection API issues. NOTE: it was originally reported that Java 6 was also vulnerable, but the reporter has retracted this claim, stating that Java 6 is not exploitable because the relevant code is called in a way that does not bypass security checks. NOTE: as of 20130114, a reliable third party has claimed that the findClass/MBeanInstantiator vector was not fixed in Oracle Java 7 Update 11. If there is still a vulnerable condition, then a separate CVE identifier might be created for the unfixed issue.
Patch / fix
cisa required action Apply updates per vendor instructions.
- java-1.7.0-ibm RHEL 5 EXTRAS 1:1.7.0.4.0-1jpp.2.el5_9
- java-1.7.0-ibm RHEL 6 EXTRAS 1:1.7.0.4.0-1jpp.2.el6_4
- java-1.7.0-ibm-src RHEL 5 EXTRAS 1:1.7.0.4.0-1jpp.2.el5_9
- java-1.7.0-ibm-src RHEL 6 EXTRAS 1:1.7.0.4.0-1jpp.2.el6_4
- java-1.7.0-ibm-demo RHEL 5 EXTRAS 1:1.7.0.4.0-1jpp.2.el5_9
- java-1.7.0-ibm-demo RHEL 6 EXTRAS 1:1.7.0.4.0-1jpp.2.el6_4
- java-1.7.0-ibm-jdbc RHEL 5 EXTRAS 1:1.7.0.4.0-1jpp.2.el5_9
- java-1.7.0-ibm-jdbc RHEL 6 EXTRAS 1:1.7.0.4.0-1jpp.2.el6_4
red hat advisories RHSA-2013:0626RHSA-2013:0165RHSA-2013:0156
- java-1_7_0-openjdk openSUSE Tumbleweed 1.7.0.121-1.1
opensuse advisories openSUSE-SU-2024:10534-1
Is CVE-2013-0422 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerVendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2013-0422 updated cvss 6.8
OpenJDK: MethodHandles.Lookup incorrect permission checks, Java 7 0day (Libraries, 8006017)
-
Red Hat Enterprise Linux (v. 5 server) java-1.7.0-openjdk 1.7.0.9-2.3.4.el5_9.1, java-1.7.0-openjdk-src 1.7.0.9-2.3.4.el5_9.1, java-1.7.0-openjdk-demo 1.7.0.9-2.3.4.el5_9.1, java-1.7.0-openjdk-javadoc 1.7.0.9-2.3.4.el5_9.1 Red Hat Enterprise Linux Desktop (v. 6) java-1.7.0-openjdk 1.7.0.9-2.3.4.1.el6_3 Red Hat Enterprise Linux Desktop Optional (v. 6) java-1.7.0-openjdk 1.7.0.9-2.3.4.1.el6_3, java-1.7.0-openjdk-src 1.7.0.9-2.3.4.1.el6_3, java-1.7.0-openjdk-demo 1.7.0.9-2.3.4.1.el6_3, java-1.7.0-openjdk-javadoc 1.7.0.9-2.3.4.1.el6_3fixed: vendor fix RHSA-2013:0165
-
Red Hat Enterprise Linux Desktop Supplementary (v. 6) java-1.7.0-ibm 1.7.0.4.0-1jpp.2.el6_4, java-1.7.0-oracle 1.7.0.11-1jpp.3.el6_3, java-1.7.0-ibm-src 1.7.0.4.0-1jpp.2.el6_4, java-1.7.0-ibm-demo 1.7.0.4.0-1jpp.2.el6_4, java-1.7.0-ibm-jdbc 1.7.0.4.0-1jpp.2.el6_4, java-1.7.0-oracle-src 1.7.0.11-1jpp.3.el6_3, +4 morefixed: vendor fix RHSA-2013:0626
-
Red Hat Enterprise Linux HPC Node (v. 6) java-1.7.0-openjdk 1.7.0.9-2.3.4.1.el6_3 Red Hat Enterprise Linux HPC Node Optional (v. 6) java-1.7.0-openjdk 1.7.0.9-2.3.4.1.el6_3, java-1.7.0-openjdk-src 1.7.0.9-2.3.4.1.el6_3, java-1.7.0-openjdk-demo 1.7.0.9-2.3.4.1.el6_3, java-1.7.0-openjdk-javadoc 1.7.0.9-2.3.4.1.el6_3fixed: vendor fix RHSA-2013:0165
-
Red Hat Enterprise Linux HPC Node Supplementary (v. 6) java-1.7.0-ibm 1.7.0.4.0-1jpp.2.el6_4, java-1.7.0-oracle 1.7.0.11-1jpp.3.el6_3, java-1.7.0-ibm-src 1.7.0.4.0-1jpp.2.el6_4, java-1.7.0-ibm-demo 1.7.0.4.0-1jpp.2.el6_4, java-1.7.0-oracle-src 1.7.0.11-1jpp.3.el6_3, java-1.7.0-oracle-javafx 1.7.0.11-1jpp.3.el6_3fixed: vendor fix RHSA-2013:0626
-
Red Hat Enterprise Linux Server (v. 6) java-1.7.0-openjdk 1.7.0.9-2.3.4.1.el6_3 Red Hat Enterprise Linux Server Optional (v. 6) java-1.7.0-openjdk 1.7.0.9-2.3.4.1.el6_3, java-1.7.0-openjdk-src 1.7.0.9-2.3.4.1.el6_3, java-1.7.0-openjdk-demo 1.7.0.9-2.3.4.1.el6_3, java-1.7.0-openjdk-javadoc 1.7.0.9-2.3.4.1.el6_3fixed: vendor fix RHSA-2013:0165
-
Red Hat Enterprise Linux Server Supplementary (v. 5) java-1.7.0-ibm 1.7.0.4.0-1jpp.2.el5_9, java-1.7.0-oracle 1.7.0.11-1jpp.3.el5_9, java-1.7.0-ibm-src 1.7.0.4.0-1jpp.2.el5_9, java-1.7.0-ibm-demo 1.7.0.4.0-1jpp.2.el5_9, java-1.7.0-ibm-jdbc 1.7.0.4.0-1jpp.2.el5_9, java-1.7.0-oracle-src 1.7.0.11-1jpp.3.el5_9, +4 more Red Hat Enterprise Linux Server Supplementary (v. 6) java-1.7.0-ibm 1.7.0.4.0-1jpp.2.el6_4, java-1.7.0-oracle 1.7.0.11-1jpp.3.el6_3, java-1.7.0-ibm-src 1.7.0.4.0-1jpp.2.el6_4, java-1.7.0-ibm-demo 1.7.0.4.0-1jpp.2.el6_4, java-1.7.0-ibm-jdbc 1.7.0.4.0-1jpp.2.el6_4, java-1.7.0-oracle-src 1.7.0.11-1jpp.3.el6_3, +4 morefixed: vendor fix RHSA-2013:0626
-
Red Hat Enterprise Linux Workstation (v. 6) java-1.7.0-openjdk 1.7.0.9-2.3.4.1.el6_3 Red Hat Enterprise Linux Workstation Optional (v. 6) java-1.7.0-openjdk 1.7.0.9-2.3.4.1.el6_3, java-1.7.0-openjdk-src 1.7.0.9-2.3.4.1.el6_3, java-1.7.0-openjdk-demo 1.7.0.9-2.3.4.1.el6_3, java-1.7.0-openjdk-javadoc 1.7.0.9-2.3.4.1.el6_3fixed: vendor fix RHSA-2013:0165
-
Red Hat Enterprise Linux Workstation Supplementary (v. 6) java-1.7.0-ibm 1.7.0.4.0-1jpp.2.el6_4, java-1.7.0-oracle 1.7.0.11-1jpp.3.el6_3, java-1.7.0-ibm-src 1.7.0.4.0-1jpp.2.el6_4, java-1.7.0-ibm-demo 1.7.0.4.0-1jpp.2.el6_4, java-1.7.0-ibm-jdbc 1.7.0.4.0-1jpp.2.el6_4, java-1.7.0-oracle-src 1.7.0.11-1jpp.3.el6_3, +4 morefixed: vendor fix RHSA-2013:0626
show 1 moreshow fewer
-
Red Hat Enterprise Linux 5 java-1.5.0-ibm, java-1.6.0-ibm Red Hat Enterprise Linux 6 java-1.5.0-ibm, java-1.6.0-ibm, java-1.5.0-ibm-src, java-1.6.0-ibm-src, java-1.5.0-ibm-demo, java-1.5.0-ibm-jdbc, +6 morenot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Timeline
- First public exploit (Metasploit exploit/multi/browser/java_jre17_jmxbean)
- Published
- Added to CISA KEV
- CISA patch deadline
- CISA SSVC: exploitation active
Known exploited
- Added
- 4y ago
- Patch by
- 2022-06-15 (4y ago)
- Ransomware
- Known to be used in ransomware campaigns
- Required action
- Apply updates per vendor instructions.
- Vendor, product
- Oracle, Java Runtime Environment (JRE)
- CISA name
- Oracle JRE Remote Code Execution Vulnerability
CISA SSVC
- Exploitation
- Active, exploited in the wild
- Automatable
- yes
- Technical impact
- total
- Assessed
- last yr.
Exploit prediction
97.08% chance of exploitation in the next 30 days, higher than 99.8% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- Metasploit exploit/multi/browser/java_jre17_jmxbean Java Applet JMX Remote Code Execution metasploit exploit, excellent rank, 2013-01-10
- EDB-24045 Java Applet JMX - Remote Code Execution (Metasploit) (1) remote, 2013-01-11
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-284 Improper Access Control
References
-
rhn.redhat.com
/errata/RHSA-2013-0156.html
vendor-advisory, third-party-advisory
-
mandriva.com
/security/advisories?name=MDVSA-2013:095
vendor-advisory, not-applicable
-
lists.opensuse.org
/opensuse-security-announce/2013-01/msg00025.html
vendor-advisory, mailing-list, third-party-advisory
-
rhn.redhat.com
/errata/RHSA-2013-0165.html
vendor-advisory, third-party-advisory
-
ubuntu.com
/usn/USN-1693-1
vendor-advisory, third-party-advisory
-
oracle.com
/technetwork/topics/security/alert-cve-2013-0422-1896849.html
vendor-advisory
-
malware.dontneedcoffee.com
/2013/01/0-day-17u10-spotted-in-while-disable.html
third-party-advisory
-
blog.fuseyism.com
/index.php/2013/01/15/security-icedtea-2-1-4-2-2-4-2-3-4-released/
broken-link
-
kb.cert.org
/vuls/id/625617
third-party-advisory, us-government-resource
-
us-cert.gov
/cas/techalerts/TA13-010A.html
third-party-advisory, us-government-resource
-
partners.immunityinc.com
/idocs/Java%20MBeanInstantiator.findClass%200day%20Analysis.pdf
broken-link
-
blog.fireeye.com
/research/2013/01/happy-new-year-from-new-java-zero-day.html
not-applicable
-
www-304.ibm.com
/connections/blogs/PSIRT/entry/oracle_java_7_security_manager_bypass_vulnerability_cve_2013_04224?lang=en_us
not-applicable
-
wiki.mageia.org
/en/Support/Advisories/MGASA-2013-0018
third-party-advisory
-
immunityproducts.blogspot.ca
/2013/01/confirmed-java-only-fixed-one-of-two.html
third-party-advisory
-
threatpost.com
/en_us/blogs/nasty-new-java-zero-day-found-exploit-kits-already-have-it-011013
not-applicable
-
seclists.org
/bugtraq/2013/Jan/48
mailing-list, third-party-advisory
-
krebsonsecurity.com
/2013/01/zero-day-java-exploit-debuts-in-crimeware/
third-party-advisory
-
labs.alienvault.com
/labs/index.php/2013/new-year-new-java-zeroday/
broken-link, third-party-advisory
-
cisa.gov
/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-0422
government-resource, us-government-resource
Sources
- CVE List CVE-2013-0422
- NVD CVE-2013-0422
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.