CVE-2012-0500
published 2012-02-15CVE-2012-0500: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and JavaFX 2.0.2…
PriorityP272critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
58.97%
99.0th percentile
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and JavaFX 2.0.2 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | javafx | <= 2.0.2 | — |
| oracle | javafx | — | — |
| oracle | javafx | — | — |
| oracle | javafx | — | — |
| oracle | javafx | — | — |
| oracle | javafx | — | — |
| oracle | javafx | — | — |
| oracle | jre | <= 1.6.0 | — |
| oracle | jre | <= 1.7.0 | — |
| oracle | jre | — | — |
| oracle | jre | — | — |
| sun | jre | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect JNLP files served over HTTP containing injected double-quote characters in java-vm-args, initial-heap-size, or max-heap-size parameters, which are used to inject -XXaltjvm pointing to a remote UNC/WebDAV path. ↗
- →Monitor for WebDAV (WebClient / MiniRedir) requests to port 80 serving .dll files with Content-Type application/octet-stream, indicative of the -XXaltjvm DLL delivery stage. ↗
- →Detect HTTP responses with Content-Type: application/x-java-jnlp-file that contain double-quote characters inside attribute values of java-vm-args or heap-size parameters. ↗
- →Flag User-Agent strings matching Windows NT 5/6 or MiniRedir patterns combined with PROPFIND and OPTIONS HTTP methods on port 80, consistent with the WebDAV mini-redirector DLL retrieval phase of this exploit. ↗
- ·The Metasploit module requires SRVPORT=80 and URIPATH=/ to function; the WebDAV delivery mechanism will not work on non-standard ports. ↗
- ·Exploitation requires the WebClient service (WebDAV Mini-Redirector) to be enabled on the target Windows host; systems without this service are not exploitable via this vector. ↗
- ·The exploit targets Windows x86 platforms running Java Runtime on Windows; non-Windows or 64-bit targets are not covered by the known public module. ↗
CVSS provenance
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vendor_redhat10.0CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-5845-68q3-8r26: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and JavaF
ghsa_unreviewed·2022-05-04
CVE-2012-0500 [HIGH] GHSA-5845-68q3-8r26: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and JavaF
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and JavaFX 2.0.2 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.
Red Hat
JDK: unspecified vulnerability fixed in 6u31 and 7u3 (Deployment)
vendor_redhat·2012-02-14·CVSS 10.0
CVE-2012-0500 [CRITICAL] JDK: unspecified vulnerability fixed in 6u31 and 7u3 (Deployment)
JDK: unspecified vulnerability fixed in 6u31 and 7u3 (Deployment)
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and JavaFX 2.0.2 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.
Package: java-1.6.0-sun (Red Hat Enterprise Linux 4) - Affected
Package: java-1.6.0-openjdk (Red Hat Enterprise Linux 5) - Not affected
Package: java-1.6.0-openjdk (Red Hat Enterprise Linux 6) - Not affected
No detection rules found.
Exploit-DB
Java - Web Start Double Quote Injection Remote Code Execution (Metasploit)
exploitdb·2013-06-11
CVE-2012-1533 Java - Web Start Double Quote Injection Remote Code Execution (Metasploit)
Java - Web Start Double Quote Injection Remote Code Execution (Metasploit)
---
##
#
# ========================================================
# Java Web Start Double Quote Inject Remote Code Execution
# ========================================================
#
# Date: Jun 12 2012 (updated: Jun 6 2013)
# Author: Rh0
# Version: At least Java 1.6.31 to 1.6.35 and 1.7.03 to 1.7.07
# Tested on: Windows XP SP3 EN and Windows 7
# CVE: 2012-1533
#
# advisory: http://pastebin.com/eUucVage
#
##
require 'msf/core'
class Metasploit3 'Sun Java Web Start Double Quote Injection',
'Description' => %q{
This module exploits a flaw in the Web Start component of the Sun Java
Runtime Environment. Parameters intial-heap-size and max-heap-size in a JNLP
file can contain a double quote which is not properly
Exploit-DB
Sun Java Web Start Plugin - Command Line Argument Injection (2012) (Metasploit)
exploitdb·2012-02-24
CVE-2012-0500 Sun Java Web Start Plugin - Command Line Argument Injection (2012) (Metasploit)
Sun Java Web Start Plugin - Command Line Argument Injection (2012) (Metasploit)
---
##
# $Id$
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'Sun Java Web Start Plugin Command Line Argument Injection (2012)',
'Description' => %q{
This module exploits a flaw in the Web Start component of the Sun Java
Runtime Environment. The arguments passed to Java Web Start are not properly
validated, allowing injection of arbitrary arguments to the JVM.
By utilizing the lesser known -J option, an attacker can take advantage of
the -XXaltjvm option, as di
Metasploit
Sun Java Web Start Plugin Command Line Argument Injection
metasploit
Sun Java Web Start Plugin Command Line Argument Injection
Sun Java Web Start Plugin Command Line Argument Injection
This module exploits a flaw in the Web Start component of the Sun Java Runtime Environment. The arguments passed to Java Web Start are not properly validated, allowing injection of arbitrary arguments to the JVM. By utilizing the lesser known -J option, an attacker can take advantage of the -XXaltjvm option, as discussed previously by Ruben Santamarta. This method allows an attacker to execute arbitrary code in the context of an unsuspecting browser user. In order for this module to work, it must be run as root on a server that does not serve SMB. Additionally, the target host must have the WebClient service (WebDAV Mini-Redirector) enabled.
Bugzilla
CVE-2012-0500 Oracle JDK: unspecified vulnerability fixed in 6u31 and 7u3 (Deployment)
bugzilla·2012-02-15·CVSS 10.0
CVE-2012-0500 [CRITICAL] CVE-2012-0500 Oracle JDK: unspecified vulnerability fixed in 6u31 and 7u3 (Deployment)
CVE-2012-0500 Oracle JDK: unspecified vulnerability fixed in 6u31 and 7u3 (Deployment)
Java SE 6 Update 31 and Java SE 7 Update 3 of Oracle/Sun Java fixes an unspecified vulnerability in the Deployment component (CVE-2012-0499). Upstream has CVSSv2 scored this issue as: 10/AV:N/AC:L/Au:N/C:C/I:C/A:C
http://www.oracle.com/technetwork/topics/security/javacpufeb2012-366318.html
Discussion:
TELUS Security Labs VR advisory for this issue:
http://seclists.org/fulldisclosure/2012/Feb/251
http://telussecuritylabs.com/threats/show/TSL20120214-01
---
This issue has been addressed in following products:
Extras for RHEL 4
Supplementary for Red Hat Enterprise Linux 5
Supplementary for Red Hat Enterprise Linux 6
Via RHSA-2012:0139 https://rhn.redhat.com/errata/RHSA-2012-0139.html
---
(In repl
Bugzilla
CVE-2011-4324 kernel: nfsv4: mknod(2) DoS
bugzilla·2011-11-21·CVSS 4.9
CVE-2011-4324 [MEDIUM] CVE-2011-4324 kernel: nfsv4: mknod(2) DoS
CVE-2011-4324 kernel: nfsv4: mknod(2) DoS
Creating a file with mknod(2) syscall on a nfsv4 mount can trigger BUG().
Discussion:
Eryu Guan 2011-11-18 02:16:30 EST
Upstream commit
commit dc0b027dfadfcb8a5504f7d8052754bf8d501ab9
Author: Trond Myklebust
Date: Tue Dec 23 15:21:56 2008 -0500
NFSv4: Convert the open and close ops to use fmode
Signed-off-by: Trond Myklebust
removed the BUGON() at fs/nfs/nfs4xdr.c:894
---
Statement:
This issue did not affect the Linux kernels as shipped with Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG as they did not have the vulnerable code as introduced in history:1a7bc914. This has been addressed in Red Hat Enterprise Linux 5 via https://rhn.redhat.com/errata/RHSA-2012-0007.html. Red Hat Enterprise Linux 4 is now in Production 3 of the maint
http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00010.htmlhttp://marc.info/?l=bugtraq&m=133364885411663&w=2http://marc.info/?l=bugtraq&m=133847939902305&w=2http://marc.info/?l=bugtraq&m=134254866602253&w=2http://marc.info/?l=bugtraq&m=134254957702612&w=2http://rhn.redhat.com/errata/RHSA-2012-0514.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1455.htmlhttp://secunia.com/advisories/48073http://secunia.com/advisories/48589http://secunia.com/advisories/48950http://www.oracle.com/technetwork/topics/security/javacpufeb2012-366318.htmlhttp://www.securityfocus.com/bid/52015https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14844http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00010.htmlhttp://marc.info/?l=bugtraq&m=133364885411663&w=2http://marc.info/?l=bugtraq&m=133847939902305&w=2http://marc.info/?l=bugtraq&m=134254866602253&w=2http://marc.info/?l=bugtraq&m=134254957702612&w=2http://rhn.redhat.com/errata/RHSA-2012-0514.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1455.htmlhttp://secunia.com/advisories/48073http://secunia.com/advisories/48589http://secunia.com/advisories/48950http://www.oracle.com/technetwork/topics/security/javacpufeb2012-366318.htmlhttp://www.securityfocus.com/bid/52015https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14844
2012-02-15
Published