CVE-2013-2415

OpenJDK: temporary files created with insecure permissions (JAX-WS, 8003542)

Severity Score

7.5

*CVSS v3

Exploit Likelihood

< 1%

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, allows local users to affect confidentiality via vectors related to JAX-WS. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "processing of MTOM attachments" and the creation of temporary files with weak permissions.

La vulnerabilidad no especificada en el componente Java Runtime Environment (JRE) en Java SE versión 7 Update 17 y anteriores, y OpenJDK versiones 6 y 7 de Oracle, permite a los usuarios locales afectar a la confidencialidad por medio de vectores relacionados con JAX-WS. NOTA: la información anterior procede de la CPU de abril de 2013. Oracle no ha comentado sobre las afirmaciones de otro proveedor de que este problema está relacionado con el "processing of MTOM attachments" y la creación de archivos temporales con permisos débiles.

Multiple vulnerabilities have been found in the Oracle JRE/JDK, allowing attackers to cause unspecified impact. Versions less than or equal to 1.6.0.45 are affected.

*Credits: N/A

CVSS Scores

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Attack Vector

Local

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

None

Availability

None

Attack Vector

Local

Attack Complexity

Medium

Authentication

None

Confidentiality

Partial

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2013-03-05 CVE Reserved
2013-04-17 CVE Published
2024-08-06 CVE Updated
2025-03-30 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-732: Incorrect Permission Assignment for Critical Resource

CAPEC

References (21)

URL	Tag	Source
http://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openj...	X_refsource_confirm
http://blog.fuseyism.com/index.php/2013/04/25/security-icedtea-1-11-11-1-12-5-...	X_refsource_confirm
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jaxws/rev/e07c518282ba	X_refsource_misc
http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-April/022796.html	Mailing List
http://www.us-cert.gov/ncas/alerts/TA13-107A	Third Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval...	Signature
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0124	X_refsource_confirm
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0130	X_refsource_confirm

1 - 8 of 8

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
http://lists.opensuse.org/opensuse-security-announce/2013-05/...	2017-09-19
http://lists.opensuse.org/opensuse-updates/2013-05/msg00017.html	2017-09-19
http://lists.opensuse.org/opensuse-updates/2013-06/msg00099.html	2017-09-19
http://rhn.redhat.com/errata/RHSA-2013-0752.html	2017-09-19
http://rhn.redhat.com/errata/RHSA-2013-0757.html	2017-09-19
http://security.gentoo.org/glsa/glsa-201406-32.xml	2017-09-19
http://www.mandriva.com/security/advisories?name=MDVSA-2013:145	2017-09-19
http://www.mandriva.com/security/advisories?name=MDVSA-2013:150	2017-09-19
http://www.mandriva.com/security/advisories?name=MDVSA-2013:161	2017-09-19
http://www.oracle.com/technetwork/topics/security/javacpuapr2...	2017-09-19

1 - 10 of 13

Affected Vendors, Products, and Versions (28)

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Oracle Search vendor "Oracle"		Jre Search vendor "Oracle" for product "Jre"				<= 1.7.0 Search vendor "Oracle" for product "Jre" and version " <= 1.7.0"		update17		Affected
Oracle Search vendor "Oracle"		Jre Search vendor "Oracle" for product "Jre"				1.7.0 Search vendor "Oracle" for product "Jre" and version "1.7.0"		-		Affected
Oracle Search vendor "Oracle"		Jre Search vendor "Oracle" for product "Jre"				1.7.0 Search vendor "Oracle" for product "Jre" and version "1.7.0"		update1		Affected
Oracle Search vendor "Oracle"		Jre Search vendor "Oracle" for product "Jre"				1.7.0 Search vendor "Oracle" for product "Jre" and version "1.7.0"		update10		Affected
Oracle Search vendor "Oracle"		Jre Search vendor "Oracle" for product "Jre"				1.7.0 Search vendor "Oracle" for product "Jre" and version "1.7.0"		update11		Affected
Oracle Search vendor "Oracle"		Jre Search vendor "Oracle" for product "Jre"				1.7.0 Search vendor "Oracle" for product "Jre" and version "1.7.0"		update13		Affected
Oracle Search vendor "Oracle"		Jre Search vendor "Oracle" for product "Jre"				1.7.0 Search vendor "Oracle" for product "Jre" and version "1.7.0"		update15		Affected
Oracle Search vendor "Oracle"		Jre Search vendor "Oracle" for product "Jre"				1.7.0 Search vendor "Oracle" for product "Jre" and version "1.7.0"		update2		Affected
Oracle Search vendor "Oracle"		Jre Search vendor "Oracle" for product "Jre"				1.7.0 Search vendor "Oracle" for product "Jre" and version "1.7.0"		update3		Affected
Oracle Search vendor "Oracle"		Jre Search vendor "Oracle" for product "Jre"				1.7.0 Search vendor "Oracle" for product "Jre" and version "1.7.0"		update4		Affected

1 - 10 of 28