Oracle Java SE 7 Update 15 Security Check privileges management

Summaryinfo

A vulnerability has been found in Oracle Java SE 7 Update 15 and classified as problematic. The affected element is an unknown function of the component Security Check. The manipulation leads to privileges management. Additionally, an exploit exists. It is recommended to replace the affected component with an alternative.

Detailsinfo

A vulnerability was found in Oracle Java SE 7 Update 15 (Programming Language Software) and classified as critical. This issue affects an unknown part of the component Security Check. The manipulation with an unknown input leads to a privileges management vulnerability. Using CWE to declare the problem leads to CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. Impacted is confidentiality, integrity, and availability.

The issue has been introduced in 02/19/2013. The weakness was released 03/04/2013 by Adam Gowdiak with Security Explorations as SE-2012-01 / Issue 57 as not defined advisory (Website). It is possible to read the advisory at security-explorations.com. The vendor was not involved in the public release. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are unknown but a private exploit is available. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 04/13/2019). It is expected to see the exploit prices for this product decreasing in the near future.The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

A private exploit has been developed by Adam Gowdiak. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 13 days. During that time the estimated underground price was around $25k-$100k.

The problem might be mitigated by replacing the product with Microsoft Silverlight, Adobe Flash or Javascript as an alternative.

The vulnerability is also documented in the vulnerability database at OSVDB (90854†). packetstormsecurity.com is providing further details. Entries connected to this vulnerability are available at VDB-7870, VDB-7872, VDB-7873 and VDB-7874. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Programming Language Software

Vendor

• Oracle

Name

• Java SE

Version

• 7 Update 15

License

• open-source

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion