// For flags

CVE-2013-0401

Oracle Java DragAndDrop Sandbox Bypass Remote Code Execution Vulnerability

Severity Score

10.0
*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to execute arbitrary code via vectors related to AWT, as demonstrated by Ben Murphy during a Pwn2Own competition at CanSecWest 2013. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to invocation of the system class loader by the sun.awt.datatransfer.ClassLoaderObjectInputStream class, which allows remote attackers to bypass Java sandbox restrictions.

El componente Java Runtime Environment (JRE) en Java SE versión 7 Update 17 y anteriores, versión 6 Update 43 y anteriores, y versión 5.0 Update 41 y anteriores; y OpenJDK versiones 6 y 7 de Oracle; permite a los atacantes remotos ejecutar código arbitrario por medio de vectores relacionados a AWT, como fue demostrado por Ben Murphy durante una competencia Pwn2Own en CanSecWest 2013. NOTA: la información anterior es de la CPU de abril de 2013. Oracle no ha comentado sobre las afirmaciones de otro proveedor de que este problema está relacionado a la invocación del cargador de clases del sistema por la clase sun.awt.datatransfer.ClassLoaderObjectInputStream, que permite a los atacantes remotos omitirlas restricciones del sandbox de Java.

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Java. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within sun.awt.datatransfer.TransferableProxy. The issue lies in the ability to bypass checks in the Proxy class. An attacker can leverage this vulnerability to execute code under the context of the current process.

*Credits: Ben Murphy
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2012-12-07 CVE Reserved
  • 2013-03-08 CVE Published
  • 2023-03-07 EPSS Updated
  • 2024-08-06 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-94: Improper Control of Generation of Code ('Code Injection')
CAPEC
References (32)
URL Tag Source
http://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released X_refsource_confirm
http://blog.fuseyism.com/index.php/2013/04/25/security-icedtea-1-11-11-1-12-5-for-openjdk-6-released X_refsource_confirm
http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157 X_refsource_misc
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/31c782610044 X_refsource_misc
http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-April/022796.html Mailing List
http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html X_refsource_confirm
http://www.us-cert.gov/ncas/alerts/TA13-107A Third Party Advisory
http://www.zdnet.com/pwn2own-down-go-all-the-browsers-7000012283 X_refsource_misc
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16297 Signature
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19463 Signature
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19641 Signature
https://twitter.com/thezdi/status/309784608508100608 X_refsource_misc
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0124 X_refsource_confirm
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0130 X_refsource_confirm
URL Date SRC
URL Date SRC
URL Date SRC
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03898880 2017-09-19
http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00007.html 2017-09-19
http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00013.html 2017-09-19
http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00001.html 2017-09-19
http://lists.opensuse.org/opensuse-updates/2013-05/msg00017.html 2017-09-19
http://lists.opensuse.org/opensuse-updates/2013-06/msg00099.html 2017-09-19
http://marc.info/?l=bugtraq&m=137283787217316&w=2 2017-09-19
http://rhn.redhat.com/errata/RHSA-2013-0752.html 2017-09-19
http://rhn.redhat.com/errata/RHSA-2013-0757.html 2017-09-19
http://rhn.redhat.com/errata/RHSA-2013-0758.html 2017-09-19
http://rhn.redhat.com/errata/RHSA-2013-1455.html 2017-09-19
http://rhn.redhat.com/errata/RHSA-2013-1456.html 2017-09-19
http://security.gentoo.org/glsa/glsa-201406-32.xml 2017-09-19
http://www.mandriva.com/security/advisories?name=MDVSA-2013:145 2017-09-19
http://www.mandriva.com/security/advisories?name=MDVSA-2013:161 2017-09-19
http://www.ubuntu.com/usn/USN-1806-1 2017-09-19
https://bugzilla.redhat.com/show_bug.cgi?id=920245 2013-10-23
https://access.redhat.com/security/cve/CVE-2013-0401 2013-10-23
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Oracle
Search vendor "Oracle"
 Jdk
Search vendor "Oracle" for product "Jdk"
 1.7.0
Search vendor "Oracle" for product "Jdk" and version "1.7.0"
update17
Affected
Oracle
Search vendor "Oracle"
 Jre
Search vendor "Oracle" for product "Jre"
 1.7.0
Search vendor "Oracle" for product "Jre" and version "1.7.0"
update17
Affected