Bug 876389 (CVE-2012-4823) - CVE-2012-4823 IBM JDK: java.lang.ClassLoder defineClass() code execution
Summary: CVE-2012-4823 IBM JDK: java.lang.ClassLoder defineClass() code execution
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2012-4823
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 862579
TreeView+ depends on / blocked
 
Reported: 2012-11-14 00:46 UTC by Vincent Danen
Modified: 2021-02-17 08:24 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-11-16 07:40:13 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2012:1466 0 normal SHIPPED_LIVE Critical: java-1.6.0-ibm security update 2012-11-16 02:16:50 UTC
Red Hat Product Errata RHSA-2012:1467 0 normal SHIPPED_LIVE Critical: java-1.7.0-ibm security update 2012-11-16 02:06:24 UTC
Red Hat Product Errata RHSA-2013:1455 0 normal SHIPPED_LIVE Low: Red Hat Network Satellite server IBM Java Runtime security update 2013-10-23 20:30:21 UTC
Red Hat Product Errata RHSA-2013:1456 0 normal SHIPPED_LIVE Low: Red Hat Network Satellite server IBM Java Runtime security update 2013-10-23 20:29:56 UTC

Description Vincent Danen 2012-11-14 00:46:19 UTC 
IBM Java could allow a remote attacker to execute arbitrary code on the system, caused by insecure use of the java.lang.ClassLoder defineClass() method. By persuading a victim to visit a malicious Web site containing a specially-crafted applet, an attacker could exploit this vulnerability to bypass sandbox restrictions and execute arbitrary Java code.

External Reference:

http://xforce.iss.net/xforce/xfdb/78767
Comment 1 Tomas Hoger 2012-11-14 08:24:12 UTC 
Other references:

http://www-01.ibm.com/support/docview.wss?uid=swg21616617
http://seclists.org/bugtraq/2012/Sep/38
http://www.security-explorations.com/en/SE-2012-01.html
Comment 2 errata-xmlrpc 2012-11-15 21:10:01 UTC 
This issue has been addressed in following products:

  Supplementary for Red Hat Enterprise Linux 6

Via RHSA-2012:1467 https://rhn.redhat.com/errata/RHSA-2012-1467.html
Comment 3 errata-xmlrpc 2012-11-15 21:19:46 UTC 
This issue has been addressed in following products:

  Supplementary for Red Hat Enterprise Linux 6
  Supplementary for Red Hat Enterprise Linux 5

Via RHSA-2012:1466 https://rhn.redhat.com/errata/RHSA-2012-1466.html
Comment 4 Jan Lieskovsky 2013-01-11 13:30:32 UTC 
Other references:
  http://www-01.ibm.com/support/docview.wss?uid=swg21615705
  http://www-01.ibm.com/support/docview.wss?uid=swg21615800
  http://www-01.ibm.com/support/docview.wss?uid=swg21616490
  http://www-01.ibm.com/support/docview.wss?uid=swg21616594
  http://www-01.ibm.com/support/docview.wss?uid=swg21616616
  http://www-01.ibm.com/support/docview.wss?uid=swg21616617
  http://www-01.ibm.com/support/docview.wss?uid=swg21616652
  http://www-01.ibm.com/support/docview.wss?uid=swg21616708
  http://www-01.ibm.com/support/docview.wss?uid=swg21621154
  https://www-304.ibm.com/support/docview.wss?uid=swg21616546
  http://www-01.ibm.com/support/docview.wss?uid=swg1IV29687
  http://www.securityfocus.com/bid/55495
  http://secunia.com/advisories/51634
Comment 5 errata-xmlrpc 2013-10-23 16:34:53 UTC 
This issue has been addressed in following products:

  Red Hat Network Satellite Server v 5.5

Via RHSA-2013:1456 https://rhn.redhat.com/errata/RHSA-2013-1456.html
Comment 6 errata-xmlrpc 2013-10-23 17:08:40 UTC 
This issue has been addressed in following products:

  Red Hat Network Satellite Server v 5.4

Via RHSA-2013:1455 https://rhn.redhat.com/errata/RHSA-2013-1455.html
Note You need to log in before you can comment on or make changes to this bug.