Bug 876386 (CVE-2012-4820) - CVE-2012-4820 IBM JDK: java.lang.reflect.Method invoke() code execution
Summary: CVE-2012-4820 IBM JDK: java.lang.reflect.Method invoke() code execution
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2012-4820
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 862579
TreeView+ depends on / blocked
 
Reported: 2012-11-14 00:41 UTC by Vincent Danen
Modified: 2021-02-17 08:24 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-11-22 19:05:22 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2012:1465 0 normal SHIPPED_LIVE Critical: java-1.5.0-ibm security update 2012-11-16 02:06:33 UTC
Red Hat Product Errata RHSA-2012:1466 0 normal SHIPPED_LIVE Critical: java-1.6.0-ibm security update 2012-11-16 02:16:50 UTC
Red Hat Product Errata RHSA-2012:1467 0 normal SHIPPED_LIVE Critical: java-1.7.0-ibm security update 2012-11-16 02:06:24 UTC
Red Hat Product Errata RHSA-2012:1485 0 normal SHIPPED_LIVE Critical: java-1.4.2-ibm security update 2012-11-22 23:14:28 UTC
Red Hat Product Errata RHSA-2013:1455 0 normal SHIPPED_LIVE Low: Red Hat Network Satellite server IBM Java Runtime security update 2013-10-23 20:30:21 UTC
Red Hat Product Errata RHSA-2013:1456 0 normal SHIPPED_LIVE Low: Red Hat Network Satellite server IBM Java Runtime security update 2013-10-23 20:29:56 UTC

Description Vincent Danen 2012-11-14 00:41:08 UTC 
IBM Java could allow a remote attacker to execute arbitrary code on the system, caused by insecure use of the java.lang.reflect.Method invoke() method. By persuading a victim to visit a malicious Web site containing a specially-crafted applet, an attacker could exploit this vulnerability to bypass sandbox restrictions and execute arbitrary Java code.


External Reference:

http://xforce.iss.net/xforce/xfdb/78764
Comment 1 Tomas Hoger 2012-11-14 08:24:20 UTC 
Other references:

http://www-01.ibm.com/support/docview.wss?uid=swg21616617
http://seclists.org/bugtraq/2012/Sep/38
http://www.security-explorations.com/en/SE-2012-01.html
Comment 2 errata-xmlrpc 2012-11-15 21:09:51 UTC 
This issue has been addressed in following products:

  Supplementary for Red Hat Enterprise Linux 6

Via RHSA-2012:1467 https://rhn.redhat.com/errata/RHSA-2012-1467.html
Comment 3 errata-xmlrpc 2012-11-15 21:10:49 UTC 
This issue has been addressed in following products:

  Supplementary for Red Hat Enterprise Linux 6
  Supplementary for Red Hat Enterprise Linux 5

Via RHSA-2012:1465 https://rhn.redhat.com/errata/RHSA-2012-1465.html
Comment 4 errata-xmlrpc 2012-11-15 21:19:41 UTC 
This issue has been addressed in following products:

  Supplementary for Red Hat Enterprise Linux 6
  Supplementary for Red Hat Enterprise Linux 5

Via RHSA-2012:1466 https://rhn.redhat.com/errata/RHSA-2012-1466.html
Comment 5 errata-xmlrpc 2012-11-22 18:15:50 UTC 
This issue has been addressed in following products:

  Supplementary for Red Hat Enterprise Linux 5

Via RHSA-2012:1485 https://rhn.redhat.com/errata/RHSA-2012-1485.html
Comment 6 Jan Lieskovsky 2013-01-11 13:23:06 UTC 
Other references:
  http://www-01.ibm.com/support/docview.wss?uid=swg21615705
  http://www-01.ibm.com/support/docview.wss?uid=swg21615800
  http://www-01.ibm.com/support/docview.wss?uid=swg21616490
  http://www-01.ibm.com/support/docview.wss?uid=swg21616594
  http://www-01.ibm.com/support/docview.wss?uid=swg21616616
  http://www-01.ibm.com/support/docview.wss?uid=swg21616617
  http://www-01.ibm.com/support/docview.wss?uid=swg21616652
  http://www-01.ibm.com/support/docview.wss?uid=swg21616708
  http://www-01.ibm.com/support/docview.wss?uid=swg21621154
  https://www-304.ibm.com/support/docview.wss?uid=swg21616546
  http://secunia.com/advisories/51634
Comment 7 errata-xmlrpc 2013-10-23 16:34:33 UTC 
This issue has been addressed in following products:

  Red Hat Network Satellite Server v 5.5

Via RHSA-2013:1456 https://rhn.redhat.com/errata/RHSA-2013-1456.html
Comment 8 errata-xmlrpc 2013-10-23 17:08:27 UTC 
This issue has been addressed in following products:

  Red Hat Network Satellite Server v 5.4

Via RHSA-2013:1455 https://rhn.redhat.com/errata/RHSA-2013-1455.html
Note You need to log in before you can comment on or make changes to this bug.