CVE-2013-0433: Medium severity oracle jre vulnerability
It was discovered that InetSocketAddress class did not properly implement serialization. An untrusted Java application or applet could use this flaw to for example deserialize invalid InetSockAddress data without throwing expected exception when encountering invalid data.
External Reference:
http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html
Other sources
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect integrity via unknown vectors related to Networking. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to avoid triggering an exception during the deserialization of invalid InetSocketAddress data.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-0433?
CVE-2013-0433 has been rated as critical due to its potential to allow unauthorized deserialization of data.
How do I fix CVE-2013-0433?
To fix CVE-2013-0433, upgrade to the vulnerable package versions 1.11.6, 1.12.1, 2.1.5, or 2.2.5 for IcedTea, or ensure you are using updated versions of Oracle JRE or JDK as specified in the advisories.
What software is affected by CVE-2013-0433?
CVE-2013-0433 affects Oracle JDK and JRE versions 1.5.0, 1.6.0, and 1.7.0, as well as specific versions of IcedTea.
Is there a known exploit for CVE-2013-0433?
Yes, there have been reports of exploits leveraging CVE-2013-0433 for deserialization attacks in untrusted Java environments.
What is the impact of CVE-2013-0433?
The impact of CVE-2013-0433 includes the potential for remote code execution and denial of service in vulnerable applications.