NVD

Id
46018  
Name
CVE-2012-4681  
Description
Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses SecurityManager restrictions by (1) using com.sun.beans.finder.ClassFinder.findClass and leveraging an exception with the forName method to access restricted classes from arbitrary packages such as sun.awt.SunToolkit, then (2) using "reflection with a trusted immediate caller" to leverage the getField method to access and modify private fields, as exploited in the wild in August 2012 using Gondzz.class and Gondvv.class.  
Reject
 
CVSS Version
2  
CVSS Score
10  
Severity
High  
CVSS Base Score
10  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-19  
Published
2012-08-27  
Modified Date
2013-10-11  
Seq
2012-4681  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
231082 46018 CVE-2012-4681 http://blog.fireeye.com/research/2012/08/zero-day-season-is-not-over-yet.html  View
231083 46018 CVE-2012-4681 http://immunityproducts.blogspot.com/2012/08/java-0day-analysis-cve-2012-4681.html  View
231084 46018 CVE-2012-4681 http://labs.alienvault.com/labs/index.php/2012/new-java-0day-exploited-in-the-wild/  View
231085 46018 CVE-2012-4681 SUSE-SU-2012:1231  View
231086 46018 CVE-2012-4681 SUSE-SU-2012:1398  View
231087 46018 CVE-2012-4681 SSRT100970  View
231088 46018 CVE-2012-4681 RHSA-2012:1225  View
231089 46018 CVE-2012-4681 http://www.deependresearch.org/2012/08/java-7-vulnerability-analysis.html  View
231090 46018 CVE-2012-4681 http://www.oracle.com/technetwork/topics/security/alert-cve-2012-4681-1835715.html  View
231091 46018 CVE-2012-4681 TA12-240A  View
231092 46018 CVE-2012-4681 https://community.rapid7.com/community/metasploit/blog/2012/08/27/lets-start-the-week-with-a-new-java-0day  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
28211 JVNDB-2012-003918 Oracle Java 7 に脆弱性 Oracle が提供する Java 7 には、任意の OS コマンドが実行可能な脆弱性が存在します。 CVE-2012-4681 57919 CVE-2012-4681 46018 6.8 http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-003918.html 2012-08-28 2013-02-04 View