CVE-2012-5076: Oracle Java SE Sandbox Bypass Vulnerability
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to JAX-WS.
Other sources
The default Java security properties configuration did not restrict access to the com.sun.org.glassfish.external and com.sun.org.glassfish.gmbal packages. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify the JRE lib/security/java.security file to add the package names com.sun.org.glassfish.external and com.sun.org.glassfish.gmbal to the package.access and package.definition entries, preventing untrusted Java applications/applets from accessing those packages.
Java security properties (java.security) in Oracle JRE / Java SE 7 package.access, package.definition = com.sun.org.glassfish.external, com.sun.org.glassfish.gmbal
Event History
Frequently Asked Questions
What is the severity of CVE-2012-5076?
CVE-2012-5076 is considered a critical vulnerability affecting confidentiality, integrity, and availability in the Java Runtime Environment.
How do I fix CVE-2012-5076?
To fix CVE-2012-5076, update your Java Runtime Environment to a version that is later than Java SE 7 Update 7.
Which versions of Java are affected by CVE-2012-5076?
CVE-2012-5076 affects Oracle Java SE 7 Update 7 and earlier versions.
Can CVE-2012-5076 be exploited remotely?
Yes, CVE-2012-5076 can be exploited by remote attackers without requiring local access.
What components are involved in CVE-2012-5076?
CVE-2012-5076 is related to the JAX-WS component in the Java Runtime Environment.