CVE-2013-1537: Critical severity ORACLE JRE vulnerability
RMI implementation in OpenJDK uses property java.rmi.server.useCodebaseOnly, which controls whether automatic loading of classes from other sources than local CLASSPATH and location specified in the java.rmi.server.codebase property is permitted. This property previously defaulted to false, allowing dynamic class downloading. This could allow an attacker to make RMI server or registry to execute arbitrary untrusted code.
It was demonstrated that this can be used in combination with another Java sandbox bypass flaw to execute code in the remote rmiregistry or GlassFish Server:
http://seclists.org/fulldisclosure/2013/Feb/18 http://www.security-explorations.com/en/SE-2012-01-details.html http://www.security-explorations.com/materials/se-2012-01-rmi.zip
This update changes the default value of the java.rmi.server.useCodebaseOnly property to true.
More details on various RMI properties can be found in:
http://docs.oracle.com/javase/7/docs/technotes/guides/rmi/javarmiproperties.html
Other sources
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to the default java.rmi.server.useCodebaseOnly setting of false, which allows remote attackers to perform "dynamic class downloading" and execute arbitrary code.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-1537?
The severity of CVE-2013-1537 is classified as high due to the risk of unauthorized remote code execution.
How do I fix CVE-2013-1537?
To fix CVE-2013-1537, upgrade to the patched versions of OpenJDK or IcedTea listed in the vulnerability report.
What software is affected by CVE-2013-1537?
CVE-2013-1537 affects various versions of OpenJDK, Oracle JDK, and Oracle JRE, specifically those listed in the vulnerability details.
What is the impact of CVE-2013-1537?
The impact of CVE-2013-1537 includes the potential for an attacker to execute arbitrary code on the affected system.
Is there a workaround for CVE-2013-1537?
A temporary workaround for CVE-2013-1537 is to set the java.rmi.server.useCodebaseOnly property to true to limit codebase locations.