CVE-2013-2460 : Unspecified vulnerability in the Java Runtime Environment (JRE) component in Ora

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Serviceability. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "insufficient access checks" in the tracing component.

Published 2013-06-18 22:55:03

Updated 2017-09-19 01:36:22

Source Oracle

View at NVD, CVE.org

Products affected by CVE-2013-2460

Oracle » JDK » Update Update21
Versions up to, including, (<=) 1.7.0
cpe:2.3:a:oracle:jdk:*:update21:*:*:*:*:*:*
Matching versions
Oracle » JDK » Version: 1.7.0
cpe:2.3:a:oracle:jdk:1.7.0:*:*:*:*:*:*:*
Matching versions
Oracle » JDK » Version: 1.7.0 Update Update1
cpe:2.3:a:oracle:jdk:1.7.0:update1:*:*:*:*:*:*
Matching versions
Oracle » JDK » Version: 1.7.0 Update Update2
cpe:2.3:a:oracle:jdk:1.7.0:update2:*:*:*:*:*:*
Matching versions
Oracle » JDK » Version: 1.7.0 Update Update5
cpe:2.3:a:oracle:jdk:1.7.0:update5:*:*:*:*:*:*
Matching versions
Oracle » JDK » Version: 1.7.0 Update Update6
cpe:2.3:a:oracle:jdk:1.7.0:update6:*:*:*:*:*:*
Matching versions
Oracle » JDK » Version: 1.7.0 Update Update3
cpe:2.3:a:oracle:jdk:1.7.0:update3:*:*:*:*:*:*
Matching versions
Oracle » JDK » Version: 1.7.0 Update Update4
cpe:2.3:a:oracle:jdk:1.7.0:update4:*:*:*:*:*:*
Matching versions
Oracle » JDK » Version: 1.7.0 Update Update10
cpe:2.3:a:oracle:jdk:1.7.0:update10:*:*:*:*:*:*
Matching versions
Oracle » JDK » Version: 1.7.0 Update Update11
cpe:2.3:a:oracle:jdk:1.7.0:update11:*:*:*:*:*:*
Matching versions
Oracle » JDK » Version: 1.7.0 Update Update7
cpe:2.3:a:oracle:jdk:1.7.0:update7:*:*:*:*:*:*
Matching versions
Oracle » JDK » Version: 1.7.0 Update Update9
cpe:2.3:a:oracle:jdk:1.7.0:update9:*:*:*:*:*:*
Matching versions
Oracle » JDK » Version: 1.7.0 Update Update17
cpe:2.3:a:oracle:jdk:1.7.0:update17:*:*:*:*:*:*
Matching versions
Oracle » JDK » Version: 1.7.0 Update Update13
cpe:2.3:a:oracle:jdk:1.7.0:update13:*:*:*:*:*:*
Matching versions
Oracle » JDK » Version: 1.7.0 Update Update15
cpe:2.3:a:oracle:jdk:1.7.0:update15:*:*:*:*:*:*
Matching versions
Oracle » JRE » Update Update21
Versions up to, including, (<=) 1.7.0
cpe:2.3:a:oracle:jre:*:update21:*:*:*:*:*:*
Matching versions
Oracle » JRE » Version: 1.7.0
cpe:2.3:a:oracle:jre:1.7.0:*:*:*:*:*:*:*
Matching versions
Oracle » JRE » Version: 1.7.0 Update Update1
cpe:2.3:a:oracle:jre:1.7.0:update1:*:*:*:*:*:*
Matching versions
Oracle » JRE » Version: 1.7.0 Update Update4
cpe:2.3:a:oracle:jre:1.7.0:update4:*:*:*:*:*:*
Matching versions
Oracle » JRE » Version: 1.7.0 Update Update5
cpe:2.3:a:oracle:jre:1.7.0:update5:*:*:*:*:*:*
Matching versions
Oracle » JRE » Version: 1.7.0 Update Update2
cpe:2.3:a:oracle:jre:1.7.0:update2:*:*:*:*:*:*
Matching versions
Oracle » JRE » Version: 1.7.0 Update Update3
cpe:2.3:a:oracle:jre:1.7.0:update3:*:*:*:*:*:*
Matching versions
Oracle » JRE » Version: 1.7.0 Update Update6
cpe:2.3:a:oracle:jre:1.7.0:update6:*:*:*:*:*:*
Matching versions
Oracle » JRE » Version: 1.7.0 Update Update7
cpe:2.3:a:oracle:jre:1.7.0:update7:*:*:*:*:*:*
Matching versions
Oracle » JRE » Version: 1.7.0 Update Update9
cpe:2.3:a:oracle:jre:1.7.0:update9:*:*:*:*:*:*
Matching versions
Oracle » JRE » Version: 1.7.0 Update Update10
cpe:2.3:a:oracle:jre:1.7.0:update10:*:*:*:*:*:*
Matching versions
Oracle » JRE » Version: 1.7.0 Update Update11
cpe:2.3:a:oracle:jre:1.7.0:update11:*:*:*:*:*:*
Matching versions
Oracle » JRE » Version: 1.7.0 Update Update17
cpe:2.3:a:oracle:jre:1.7.0:update17:*:*:*:*:*:*
Matching versions
Oracle » JRE » Version: 1.7.0 Update Update15
cpe:2.3:a:oracle:jre:1.7.0:update15:*:*:*:*:*:*
Matching versions
Oracle » JRE » Version: 1.7.0 Update Update13
cpe:2.3:a:oracle:jre:1.7.0:update13:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2013-2460

Top countries where our scanners detected CVE-2013-2460

Top open port discovered on systems with this issue 80

IPs affected by CVE-2013-2460 78

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2013-2460!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2013-2460

EPSS FAQ

97.11%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 100 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2013-2460

Java Applet ProviderSkeleton Insecure Invoke Method

Disclosure Date: 2013-06-18

First seen: 2020-04-26

exploit/multi/browser/java_jre17_provider_skeleton

This module abuses the insecure invoke() method of the ProviderSkeleton class that allows to call arbitrary static methods with user supplied arguments. The vulnerability affects Java version 7u21 and earlier. Authors: - Adam Gowdiak - Matthias Kaiser

More information

CVSS scores for CVE-2013-2460

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
9.3	HIGH	AV:N/AC:M/Au:N/C:C/I:C/A:C	8.6	10.0	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete

References for CVE-2013-2460

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17116

Repository / Oval Repository
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19129

Repository / Oval Repository
http://www.mandriva.com/security/advisories?name=MDVSA-2013:183

mandriva.com

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00028.html

[security-announce] SUSE-SU-2013:1257-1: important: Security update for

CVEs referencing this url
http://rhn.redhat.com/errata/RHSA-2013-1060.html

RHSA-2013:1060 - Security Advisory - Red Hat Customer Portal

CVEs referencing this url
http://www-01.ibm.com/support/docview.wss?uid=swg21642336

IBM Security Bulletin: Multiple vulnerabilities in IBM WebSphere Real Time

CVEs referencing this url
http://rhn.redhat.com/errata/RHSA-2013-0963.html

RHSA-2013:0963 - Security Advisory - Red Hat Customer Portal

CVEs referencing this url
http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html

Oracle Java Critical Patch Update - June 2013
Vendor Advisory

CVEs referencing this url
http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/160cde99bb1a

jdk7u/jdk7u/jdk: 160cde99bb1a
http://advisories.mageia.org/MGASA-2013-0185.html

Mageia Advisory: MGASA-2013-0185 - Updated java-1.7.0-openjdk packages fix multiple security vulnerabilities

CVEs referencing this url
http://www.us-cert.gov/ncas/alerts/TA13-169A

Oracle Releases Updates for Javadoc and Other Java SE Vulnerabilities | CISA
US Government Resource

CVEs referencing this url
https://bugzilla.redhat.com/show_bug.cgi?id=975122

975122 – (CVE-2013-2460) CVE-2013-2460 OpenJDK: tracing insufficient access checks (Serviceability, 8010209)
http://marc.info/?l=bugtraq&m=137545505800971&w=2

'[security bulletin] HPSBUX02907 rev.1 - HP-UX Running Java7, Remote Unauthorized Access, Disclosure' - MARC

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00027.html

[security-announce] SUSE-SU-2013:1256-1: important: Security update for

CVEs referencing this url
http://security.gentoo.org/glsa/glsa-201406-32.xml

IcedTea JDK: Multiple vulnerabilities (GLSA 201406-32) — Gentoo security

CVEs referencing this url

Jump to