CVE-2013-4578: Medium severity oracle java se 7 vulnerability
It has been identified that it is possible to inject malicious unsigned bytecode into a signed JAR without failing jarsigner verification. This flaw could be exploited in environments where contents of a verified JAR is considered trusted and unpacked for use.
Note that if the signed JAR is used at runtime, with signature intact, a fatal runtime exception is thrown.
Other sources
jarsigner in OpenJDK and Oracle Java SE before 7u51 allows remote attackers to bypass a code-signing protection mechanism and inject unsigned bytecode into a signed JAR file by leveraging improper file validation.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4578?
CVE-2013-4578 is classified as a critical vulnerability due to the potential for arbitrary code execution through malicious bytecode injection.
How do I fix CVE-2013-4578?
To mitigate CVE-2013-4578, update to the latest version of Oracle JDK or JRE, as the vulnerability has been addressed in subsequent updates.
What versions of software are affected by CVE-2013-4578?
CVE-2013-4578 affects various versions of Oracle JDK and JRE 1.7.0 up to update 51.
Can CVE-2013-4578 be exploited remotely?
Yes, CVE-2013-4578 can be exploited remotely if the vulnerable software is deployed in an environment that treats untrusted content as trusted.
What are the potential impacts of CVE-2013-4578?
The exploitation of CVE-2013-4578 can lead to unauthorized access and control over affected systems, resulting in data breaches or service disruptions.