CVE-2012-4681: Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability

Vulnerability summary

CVE-2012-4681 is a high (CVSS 10.0) Improper Access Control vulnerability in Oracle Java SE. It is known to be exploited: CISA lists it, first on 03-03-2022. It has been used in ransomware campaigns. EPSS estimates a 98.54% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 4 public exploits are recorded.

Timeline

1. 28-08-2012
   PublishedVulnerability first disclosed.
2. 03-03-2022
   Added to CISA KEVExploitedOracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
3. 24-03-2022
   CISA remediation dueDeadline passedApply updates per vendor instructions.
4. 06-08-2026
   Last modifiedVulnerability information updated.

Description

Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses SecurityManager restrictions by (1) using com.sun.beans.finder.ClassFinder.findClass and leveraging an exception with the forName method to access restricted classes from arbitrary packages such as sun.awt.SunToolkit, then (2) using "reflection with a trusted immediate caller" to leverage the getField method to access and modify private fields, as exploited in the wild in August 2012 using Gondzz.class and Gondvv.class.

• CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.