CVE-2013-2035: Code Injection
Published May 2, 2013
·Updated
IssueDescription:
The HawtJNI Library class wrote native libraries to a predictable file name in /tmp when the native libraries were bundled in a JAR file, and no custom library path was specified. A local attacker could overwrite these native libraries with malicious versions during the window between when HawtJNI writes them and when they are executed.
Other sources
Race condition in hawtjni-runtime/src/main/java/org/fusesource/hawtjni/runtime/Library.java in HawtJNI before 1.8, when a custom library path is not specified, allows local users to execute arbitrary Java code by overwriting a temporary JAR file with a predictable name in /tmp.
— MITRE
Affected Software
8 affected components
redhat Hawtjni<=1.7
redhat Hawtjni=1.0
redhat Hawtjni=1.1
redhat Hawtjni=1.2
redhat Hawtjni=1.3
redhat Hawtjni=1.4
redhat Hawtjni=1.5
redhat Hawtjni=1.6
Remediation
Event History
May 2, 2013
Data Sourced
05:16 AM
DescriptionSeverityAffected Software
Aug 28, 2013
CVE Published
via MITRE·05:18 PM
Data Sourced
via MITRE·05:18 PM
Description
Frequently Asked Questions
1
Is CVE-2013-2035 a local or remote vulnerability?
CVE-2013-2035 is considered a local vulnerability, as it requires local access to exploit.