CVE-2012-4681: Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability

Published Aug 28, 2012

Updated

Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses SecurityManager restrictions by (1) using com.sun.beans.finder.ClassFinder.findClass and leveraging an exception with the forName method to access restricted classes from arbitrary packages such as sun.awt.SunToolkit, then (2) using "reflection with a trusted immediate caller" to leverage the getField method to access and modify private fields, as exploited in the wild in August 2012 using Gondzz.class and Gondvv.class.

Other sources

The Java Runtime Environment (JRE) component in Oracle Java SE allow for remote code execution.

— CISA

Affected Software

86 affected components

Oracle JDK=1.6.0

Oracle JDK=1.6.0-update1

Oracle JDK=1.6.0-update10

Oracle JDK=1.6.0-update11

Oracle JDK=1.6.0-update12

Oracle JDK=1.6.0-update13

Oracle JDK=1.6.0-update14

Oracle JDK=1.6.0-update15

Oracle JDK=1.6.0-update16

Oracle JDK=1.6.0-update17

Oracle JDK=1.6.0-update18

Oracle JDK=1.6.0-update19

Oracle JDK=1.6.0-update2

Oracle JDK=1.6.0-update20

Oracle JDK=1.6.0-update21

Oracle JDK=1.6.0-update22

Oracle JDK=1.6.0-update23

Oracle JDK=1.6.0-update24

Oracle JDK=1.6.0-update25

Oracle JDK=1.6.0-update26

Oracle JDK=1.6.0-update27

Oracle JDK=1.6.0-update29

Oracle JDK=1.6.0-update3

Oracle JDK=1.6.0-update30

Oracle JDK=1.6.0-update31

Oracle JDK=1.6.0-update32

Oracle JDK=1.6.0-update33

Oracle JDK=1.6.0-update34

Oracle JDK=1.6.0-update4

Oracle JDK=1.6.0-update5

Oracle JDK=1.6.0-update6

Oracle JDK=1.6.0-update7

Oracle JDK=1.6.0-update8

Oracle JDK=1.6.0-update9

Oracle JDK=1.7.0

Oracle JDK=1.7.0-update1

Oracle JDK=1.7.0-update2

Oracle JDK=1.7.0-update3

Oracle JDK=1.7.0-update4

Oracle JDK=1.7.0-update5

Oracle JDK=1.7.0-update6

Oracle JRE=1.6.0

Oracle JRE=1.6.0-update1

Oracle JRE=1.6.0-update10

Oracle JRE=1.6.0-update11

Oracle JRE=1.6.0-update12

Oracle JRE=1.6.0-update13

Oracle JRE=1.6.0-update14

Oracle JRE=1.6.0-update15

Oracle JRE=1.6.0-update16

Oracle JRE=1.6.0-update17

Oracle JRE=1.6.0-update18

Oracle JRE=1.6.0-update19

Oracle JRE=1.6.0-update2

Oracle JRE=1.6.0-update20

Oracle JRE=1.6.0-update21

Oracle JRE=1.6.0-update22

Oracle JRE=1.6.0-update23

Oracle JRE=1.6.0-update24

Oracle JRE=1.6.0-update25

Oracle JRE=1.6.0-update26

Oracle JRE=1.6.0-update27

Oracle JRE=1.6.0-update29

Oracle JRE=1.6.0-update3

Oracle JRE=1.6.0-update30

Oracle JRE=1.6.0-update31

Oracle JRE=1.6.0-update32

Oracle JRE=1.6.0-update33

Oracle JRE=1.6.0-update34

Oracle JRE=1.6.0-update4

Oracle JRE=1.6.0-update5

Oracle JRE=1.6.0-update6

Oracle JRE=1.6.0-update7

Oracle JRE=1.6.0-update9

Oracle JRE=1.7.0

Oracle JRE=1.7.0-update1

Oracle JRE=1.7.0-update2

Oracle JRE=1.7.0-update3

Oracle JRE=1.7.0-update4

Oracle JRE=1.7.0-update5

Oracle JRE=1.7.0-update6

redhat Enterprise Linux Desktop=6.0

redhat Enterprise Linux Eus=6.3

redhat Enterprise Linux Server=6.0

redhat Enterprise Linux Workstation=6.0

Oracle Java SE

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Oracle Java SE 7 JRE to a version that resolves this vulnerability.
Fixed in Oracle Java SE 7 Update 6 and earlier
Compensating control
For Java applets/applet-derived content, block or restrict remote applets so remote attackers cannot use a crafted applet to bypass SecurityManager restrictions and execute arbitrary code.

Event History

Aug 28, 2012

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·12:55 AM

DescriptionSeverityWeaknessAffected Software

Mar 3, 2022

Known Exploited

via CISA·12:00 AM

Known Ransomware

via CISA·12:00 AM

Feb 28, 58274

Event

via NVD·11:08 PM

Frequently Asked Questions

What is the severity of CVE-2012-4681?

CVE-2012-4681 has a critical severity rating due to its potential to allow remote execution of arbitrary code.

How do I fix CVE-2012-4681?

To fix CVE-2012-4681, update your Java Runtime Environment to the latest version provided by Oracle.

Which Oracle products are affected by CVE-2012-4681?

CVE-2012-4681 affects Oracle Java SE 7 Update 6 and earlier, as well as various versions of Oracle JDK 6 and JRE 6 and 7.

Can CVE-2012-4681 be exploited remotely?

Yes, CVE-2012-4681 allows remote attackers to exploit the vulnerability through a malicious crafted applet.

What type of vulnerability is CVE-2012-4681?

CVE-2012-4681 is classified as a remote code execution vulnerability in the Java Runtime Environment.