from disclosure to weapon1 day
What the vendors declare (VEX)
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Fixed14 products (202 components)
Red Hat Enterprise Linux Server Supplementary (v. 5) · Red Hat Enterprise Linux Server Supplementary (v. 6) · Red Hat Enterprise Linux Desktop Supplementary (v. 6) · Red Hat Enterprise Linux Workstation Supplementary (v. 6) · Red Hat Enterprise Linux (v. 5 server) · and others 9
Not affected2 products (17 components) — because the vulnerable code is not present in the product
Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 5
Action required by CISAfederal deadline: 2022-06-15
Apply updates per vendor instructions.
In short
Java 7 before Update 11 contains critical flaws that allow attackers to run malicious code remotely by exploiting unsafe access to internal Java components (JMX/MBean and Reflection API). This vulnerability was actively exploited by malware in January 2013.
Technical detail
CVE-2013-0422 comprises two distinct remote code execution vectors in Java 7 < Update 11: (1) abuse of the public getMBeanInstantiator method in JmxMBeanServer to obtain arbitrary Class references via findClass, and (2) bypass of security checks in java.lang.invoke.MethodHandles.Lookup through recursive Reflection API calls that evade the sun.reflect.Reflection.getCallerClass frame-skipping mechanism. No authentication required; exploitation was weaponized in-the-wild by Blackhole and Nuclear Pack malware.
Summary generated and translated by AI from the official description.
The full analysis of this CVE is available in Portuguese →
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public getMBeanInstantiator method in the JmxMBeanServer class to obtain a reference to a private MBeanInstantiator object, then retrieving arbitrary Class references using the findClass method, and (2) using the Reflection API with recursion in a way that bypasses a security check by the java.lang.invoke.MethodHandles.Lookup.checkSecurityManager method due to the inability of the sun.reflect.Reflection.getCallerClass method to skip frames related to the new reflection API, as exploited in the wild in January 2013, as demonstrated by Blackhole and Nuclear Pack, and a different vulnerability than CVE-2012-4681 and CVE-2012-3174. NOTE: some parties have mapped the recursive Reflection API issue to CVE-2012-3174, but CVE-2012-3174 is for a different vulnerability whose details are not public as of 20130114. CVE-2013-0422 covers both the JMX/MBean and Reflection API issues. NOTE: it was originally reported that Java 6 was also vulnerable, but the reporter has retracted this claim, stating that Java 6 is not exploitable because the relevant code is called in a way that does not bypass security checks. NOTE: as of 20130114, a reliable third party has claimed that the findClass/MBeanInstantiator vector was not fixed in Oracle Java 7 Update 11. If there is still a vulnerable condition, then a separate CVE identifier might be created for the unfixed issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.