CVE-2013-0422
CRITICALMultiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public getMBeanInstantiator method in the JmxMBeanServer…
EPSS Exploitation Probability
EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.
Description
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public getMBeanInstantiator method in the JmxMBeanServer class to obtain a reference to a private MBeanInstantiator object, then retrieving arbitrary Class references using the findClass method, and (2) using the Reflection API with recursion in a way that bypasses a security check by the java.lang.invoke.MethodHandles.Lookup.checkSecurityManager method due to the inability of the sun.reflect.Reflection.getCallerClass method to skip frames related to the new reflection API, as exploited in the wild in January 2013, as demonstrated by Blackhole and Nuclear Pack, and a different vulnerability than CVE-2012-4681 and CVE-2012-3174. NOTE: some parties have mapped the recursive Reflection API issue to CVE-2012-3174, but CVE-2012-3174 is for a different vulnerability whose details are not public as of 20130114. CVE-2013-0422 covers both the JMX/MBean and Reflection API issues. NOTE: it was originally reported that Java 6 was also vulnerable, but the reporter has retracted this claim, stating that Java 6 is not exploitable because the relevant code is called in a way that does not bypass security checks. NOTE: as of 20130114, a reliable third party has claimed that the findClass/MBeanInstantiator vector was not fixed in Oracle Java 7 Update 11. If there is still a vulnerable condition, then a separate CVE identifier might be created for the unfixed issue.
Affected Products
ubuntu linuxcanonicalopensuseopensusejdkoraclejreoracleResearch use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.
Java Applet JMX - Remote Code Execution (Metasploit) (1)
by Metasploit · Jan 11, 2013
Detection & mitigation playbook
Vendor / applianceDetect
Inventory every canonical ubuntu linux deployment and check each version against the affected-products list above. Because the exploit targets the running system rather than your application code, also watch for remote code execution at the network and runtime layer — O3 flags the exploit behaviour from runtime telemetry and egress traffic even before a vulnerable build is confirmed.
Remediation status
No patch has shipped for CVE-2013-0422 yet — track the canonical ubuntu linux advisory for a fixed release and apply the workarounds below in the meantime.
Mitigate without a patch
Cut exposure now: restrict the management/admin interface to trusted networks, segment the device, and apply the vendor's recommended configuration mitigations and any WAF/IPS signature. O3's runtime protection blocks the exploit chain at execution, holding the line on unpatched or end-of-life systems until you can patch.
How O3 protects you
O3 detects and blocks CVE-2013-0422 exploitation at runtime: eBPF exploit-chain detection, plus L7 egress monitoring that catches the post-exploitation callback and severs the attacker's outbound channel.
Tailored to CVE-2013-0422. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is CVE-2013-0422 being exploited in your environment?
O3's eBPF runtime sensors and L7 egress monitoring detect and block the CVE-2013-0422 exploit chain at execution — protecting unpatched and end-of-life systems until the vendor patch is applied.