CVE-2012-4681criticalunder attackransomwareCWE-284

CVE-2012-4681

Published · Updated

Follow this CVE+ Monitor Oracle Java SE

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 99%
from disclosure to weaponsame day
Published on NVDAug 28
1st PoCAug 27
metasploitAug 26
CISA KEV+3474d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
1 product (8 components)
Red Hat Enterprise Linux 5
none_available: Affected
Fixed
11 products (135 components)
Red Hat Enterprise Linux Server Supplementary (v. 6) · Red Hat Enterprise Linux Desktop Supplementary (v. 6) · Red Hat Enterprise Linux Workstation Supplementary (v. 6) · Red Hat Enterprise Linux Desktop Optional (v. 6) · Red Hat Enterprise Linux Server Optional (v. 6) · and others 6
fix ↗
Not affected
2 products (29 components) — because the vulnerable code is not present in the product
Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 5
Action required by CISAfederal deadline: 2022-03-24

Apply updates per vendor instructions.

In short

Java SE 7 and earlier has a critical security flaw that allows attackers to run malicious code through a crafted applet by bypassing Java's security protections. This happens because the applet can access restricted system classes and modify private fields, making it a serious threat.

Technical detail

CVE-2012-4681 exploits flaws in Java's SecurityManager by using com.sun.beans.finder.ClassFinder.findClass with forName exceptions to access restricted sun.* packages, combined with reflection to invoke getField on trusted callers and modify private fields. Remote vector requires applet execution; impact is arbitrary code execution with user privileges (CVSS 9.8). This was actively exploited in August 2012.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses SecurityManager restrictions by (1) using com.sun.beans.finder.ClassFinder.findClass and leveraging an exception with the forName method to access restricted classes from arbitrary packages such as sun.awt.SunToolkit, then (2) using "reflection with a trusted immediate caller" to leverage the getField method to access and modify private fields, as exploited in the wild in August 2012 using Gondzz.class and Gondvv.class.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.