Oracle JRE Sandbox Bypass
CVE-2013-0431 is a medium-severity protection mechanism failure vulnerability in JRE from Oracle, with a CVSS 2.0 base score of 5.0 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. Affected JRE versions: 1.7.0. The record does not name a fixed version, so check the vendor advisory. CISA added it to the Known Exploited Vulnerabilities catalogue on May 25, 2022, which means attacks have been observed in the wild, including in ransomware campaigns.
Attackers are already exploiting this vulnerability, according to CISA.
What to do
- Check which version of JRE you run against the affected versions below, and install the vendor's latest release.
- CISA's required action: Apply updates per vendor instructions.
- Read the advisory on oracle.com for workarounds and exact fixed builds.
- Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.
Affected products and versions
Version data comes from NVD's product matching. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Access vector
- NetworkCan be exploited remotely over a network.
- Access complexity
- LowNo special conditions are needed.
- Authentication
- NoneNo login is needed.
- Confidentiality
- NoneNo data is disclosed.
- Integrity
- PartialSome data can be modified.
- Availability
- NoneAvailability is not affected.
Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 3.7 | Low | CISA (ADP) |
| CVSS 2.0 | 5.0 | Medium | NVD |
Official description
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-assisted remote attackers to bypass the Java security sandbox via unspecified vectors related to JMX, aka "Issue 52," a different vulnerability than CVE-2013-1490.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Protection Mechanism Failure
The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
Timeline
- CVE record published.
- Added to CISA's Known Exploited Vulnerabilities catalogue.
- Deadline for US federal agencies to remediate, set by CISA.
- CISA published its SSVC assessment (exploitation: active, automatable: no, technical impact: partial).
- Record last changed materially (score, affected products, status or references).
References
Third-party and government advisories
- arstechnica.com/security/2013/01/critical-java-vulnerabilies-confirmed-in-latest-version/Third Party Advisory
- lists.opensuse.org/opensuse-security-announce/2013-03/msg00001.htmlThird Party Advisory
- marc.info/?l=bugtraq&m=136439120408139&w=2Mailing List, Third Party Advisory
- marc.info/?l=bugtraq&m=136733161405818&w=2Mailing List, Third Party Advisory
- rhn.redhat.com/errata/RHSA-2013-0237.htmlThird Party Advisory
- rhn.redhat.com/errata/RHSA-2013-0247.htmlThird Party Advisory
- seclists.org/fulldisclosure/2013/Jan/142Mailing List, Third Party Advisory
- seclists.org/fulldisclosure/2013/Jan/195Mailing List, Third Party Advisory
- security.gentoo.org/glsa/glsa-201406-32.xmlThird Party Advisory
- kb.cert.org/vuls/id/858729Third Party Advisory, US Government Resource
- securityfocus.com/archive/1/525387/30/0/threadedThird Party Advisory, VDB Entry
- us-cert.gov/cas/techalerts/TA13-032A.htmlThird Party Advisory, US Government Resource
- wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056Third Party Advisory
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-0431US Government Resource
Other references
Other vulnerabilities in JRE
- 7.8 High severity
- 7.5 High severity
- 7.4 High severity
- 7.5 High severity
- 7.5 High severity
- 7.5 High severity
Spotted an error? Tell us.