CVE-2012-4681

CVSS 9.8 CRITICALEPSS 98.5%● KEVCWE-284

In short

Java SE 7 and earlier has a critical security flaw that allows attackers to run malicious code through a crafted applet by bypassing Java's security protections. This happens because the applet can access restricted system classes and modify private fields, making it a serious threat.

Technical detail

CVE-2012-4681 exploits flaws in Java's SecurityManager by using com.sun.beans.finder.ClassFinder.findClass with forName exceptions to access restricted sun.* packages, combined with reflection to invoke getField on trusted callers and modify private fields. Remote vector requires applet execution; impact is arbitrary code execution with user privileges (CVSS 9.8). This was actively exploited in August 2012.

Summary generated and translated by AI from the official description.

Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses SecurityManager restrictions by (1) using com.sun.beans.finder.ClassFinder.findClass and leveraging an exception with the forName method to access restricted classes from arbitrary packages such as sun.awt.SunToolkit, then (2) using "reflection with a trusted immediate caller" to leverage the getField method to access and modify private fields, as exploited in the wild in August 2012 using Gondzz.class and Gondvv.class.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

n/a · n/a

public PoCs found — 3

githubgithub.com/benjholla/CVE-2012-4681-Armoring★ 1 githubgithub.com/ZH3FENG/PoCs-CVE_2012_4681★ 0 exploitdbwww.exploit-db.com/exploits/20865unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://blog.fireeye.com/research/2012/08/zero-day-season-is-not-over-yet.html http://immunityproducts.blogspot.com/2012/08/java-0day-analysis-cve-2012-4681.html http://labs.alienvault.com/labs/index.php/2012/new-java-0day-exploited-in-the-wild/http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00032.html http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00016.html http://marc.info/?l=bugtraq&m=135109152819176&w=2 http://rhn.redhat.com/errata/RHSA-2012-1225.html https://community.rapid7.com/community/metasploit/blog/2012/08/27/lets-start-the-week-with-a-new-java-0day http://secunia.com/advisories/51044 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-4681 http://www.deependresearch.org/2012/08/java-7-vulnerability-analysis.html http://www.oracle.com/technetwork/topics/security/alert-cve-2012-4681-1835715.html