CVE-2012-4681
Published: 28 August 2012
Summary
CVE-2012-4681 is a critical-severity Improper Access Control (CWE-284) vulnerability in Oracle Jdk. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.1% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SC-18 (Mobile Code).
Deeper analysis
The vulnerability consists of multiple flaws in the Java Runtime Environment component of Oracle Java SE 7 Update 6 and earlier releases. These issues permit a crafted applet to bypass SecurityManager checks by invoking com.sun.beans.finder.ClassFinder.findClass, triggering an exception in the forName method to reach restricted classes such as sun.awt.SunToolkit, and then employing reflection with a trusted immediate caller to call getField and alter private fields.
Remote attackers can deliver the applet over the network to any system running an affected JRE. Successful exploitation grants the ability to execute arbitrary code with the privileges of the user running the Java process, without requiring authentication or user interaction beyond visiting a malicious page.
Public analyses published shortly after disclosure, including detailed write-ups from FireEye, Immunity, and AlienVault, confirm active exploitation in August 2012 through class files named Gondzz.class and Gondvv.class. Corresponding security advisories from distributions such as openSUSE document the availability of updated Java packages to address the issue.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2012-4606
Vulnerability details
Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses SecurityManager restrictions by (1) using com.sun.beans.finder.ClassFinder.findClass and leveraging an…
more
exception with the forName method to access restricted classes from arbitrary packages such as sun.awt.SunToolkit, then (2) using "reflection with a trusted immediate caller" to leverage the getField method to access and modify private fields, as exploited in the wild in August 2012 using Gondzz.class and Gondvv.class.
- CWE(s)
- KEV Date Added
- 03 March 2022
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly restricts execution of untrusted mobile code such as Java applets that bypass SecurityManager checks via ClassFinder and reflection.
Enforces SecurityManager access restrictions that the applet circumvents using findClass, forName exceptions, and trusted-caller reflection to reach private fields.
Provides malicious-code detection and blocking mechanisms that can identify or stop crafted applets such as Gondzz.class before they achieve arbitrary code execution.