Vulnerability Details : CVE-2013-0401
The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to execute arbitrary code via vectors related to AWT, as demonstrated by Ben Murphy during a Pwn2Own competition at CanSecWest 2013. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to invocation of the system class loader by the sun.awt.datatransfer.ClassLoaderObjectInputStream class, which allows remote attackers to bypass Java sandbox restrictions.
Vulnerability category: Execute code
Threat overview for CVE-2013-0401
Top countries where our scanners detected CVE-2013-0401
Top open port discovered on systems with this issue
80
IPs affected by CVE-2013-0401 47
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2013-0401!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2013-0401
Probability of exploitation activity in the next 30 days: 23.54%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 96 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2013-0401
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
10.0
|
HIGH | AV:N/AC:L/Au:N/C:C/I:C/A:C |
10.0
|
10.0
|
NIST |
CWE ids for CVE-2013-0401
-
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.Assigned by: nvd@nist.gov (Primary)
References for CVE-2013-0401
-
http://lists.opensuse.org/opensuse-updates/2013-06/msg00099.html
openSUSE-SU-2013:0964-1: moderate: update for java-1_7_0-openjdk
-
http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00007.html
[security-announce] SUSE-SU-2013:0814-1: important: Security update for
-
http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00001.html
[security-announce] SUSE-SU-2013:0871-1: important: Security update for
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03898880
-
http://www.zdnet.com/pwn2own-down-go-all-the-browsers-7000012283/
Pwn2Own: Down go all the browsers | ZDNet
-
http://lists.opensuse.org/opensuse-updates/2013-05/msg00017.html
openSUSE-SU-2013:0777-1: moderate: java-1_6_0-openjdk to Icedtea6-1.12.5
-
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0124
Support/Advisories/MGASA-2013-0124 - Mageia wiki
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19641
Repository / Oval Repository
- http://blog.fuseyism.com/index.php/2013/04/25/security-icedtea-1-11-11-1-12-5-for-openjdk-6-released/
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19463
Repository / Oval Repository
-
http://www.us-cert.gov/ncas/alerts/TA13-107A
Oracle Has Released Multiple Updates for Java SE | CISAUS Government Resource
-
http://www.mandriva.com/security/advisories?name=MDVSA-2013:145
mandriva.com
-
http://www.ubuntu.com/usn/USN-1806-1
USN-1806-1: OpenJDK 7 vulnerabilities | Ubuntu security notices
-
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0130
Support/Advisories/MGASA-2013-0130 - Mageia wiki
-
http://rhn.redhat.com/errata/RHSA-2013-1455.html
RHSA-2013:1455 - Security Advisory - Red Hat Customer Portal
-
http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00013.html
[security-announce] SUSE-SU-2013:0835-1: important: Security update for
-
http://rhn.redhat.com/errata/RHSA-2013-1456.html
RHSA-2013:1456 - Security Advisory - Red Hat Customer Portal
-
http://rhn.redhat.com/errata/RHSA-2013-0757.html
RHSA-2013:0757 - Security Advisory - Red Hat Customer Portal
-
http://www.mandriva.com/security/advisories?name=MDVSA-2013:161
mandriva.com
-
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/31c782610044
jdk7u/jdk7u-dev/jdk: 31c782610044
-
http://marc.info/?l=bugtraq&m=137283787217316&w=2
'[security bulletin] HPSBUX02889 SSRT101252 rev.1 - HP-UX Running Java, Remote Unauthorized Access, D' - MARC
- http://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released/
-
http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html
Oracle Java SE Critical Patch Update - April 2013
-
http://rhn.redhat.com/errata/RHSA-2013-0758.html
RHSA-2013:0758 - Security Advisory - Red Hat Customer Portal
-
http://rhn.redhat.com/errata/RHSA-2013-0752.html
RHSA-2013:0752 - Security Advisory - Red Hat Customer Portal
-
https://twitter.com/thezdi/status/309784608508100608
Zero Day Initiative on Twitter: "And Java falls yet again to @benmmurphy. Congratulations! #pwn2own"
-
http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-April/022796.html
[SECURITY] IcedTea 1.11.10 for OpenJDK 6 Released!
-
http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157
HPPSocialUserSignonPage - Hewlett Packard Enterprise Community
-
https://bugzilla.redhat.com/show_bug.cgi?id=920245
920245 – (CVE-2013-0401) CVE-2013-0401 OpenJDK: sun.awt.datatransfer.ClassLoaderObjectInputStream class may incorrectly invoke the system class loader (CanSecWest 2013, AWT, 8009305)
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16297
Repository / Oval Repository
-
http://security.gentoo.org/glsa/glsa-201406-32.xml
IcedTea JDK: Multiple vulnerabilities (GLSA 201406-32) — Gentoo security
Products affected by CVE-2013-0401
- cpe:2.3:a:oracle:jdk:1.7.0:update17:*:*:*:*:*:*
- cpe:2.3:a:oracle:jre:1.7.0:update17:*:*:*:*:*:*