CVE-2013-4578 : jarsigner in OpenJDK and Oracle Java SE before 7u51 allows remote attackers to b

jarsigner in OpenJDK and Oracle Java SE before 7u51 allows remote attackers to bypass a code-signing protection mechanism and inject unsigned bytecode into a signed JAR file by leveraging improper file validation.

Published 2017-12-29 22:29:00

Updated 2018-01-17 17:59:30

Source Red Hat, Inc.

View at NVD, CVE.org

Products affected by CVE-2013-4578

Oracle » JDK
Versions up to, including, (<=) 1.7.0
cpe:2.3:a:oracle:jdk:*:*:*:*:*:*:*:*
Matching versions
Oracle » JDK » Version: 1.7.0 Update Update1
cpe:2.3:a:oracle:jdk:1.7.0:update1:*:*:*:*:*:*
Matching versions
Oracle » JDK » Version: 1.7.0 Update Update2
cpe:2.3:a:oracle:jdk:1.7.0:update2:*:*:*:*:*:*
Matching versions
Oracle » JDK » Version: 1.7.0 Update Update5
cpe:2.3:a:oracle:jdk:1.7.0:update5:*:*:*:*:*:*
Matching versions
Oracle » JDK » Version: 1.7.0 Update Update6
cpe:2.3:a:oracle:jdk:1.7.0:update6:*:*:*:*:*:*
Matching versions
Oracle » JDK » Version: 1.7.0 Update Update3
cpe:2.3:a:oracle:jdk:1.7.0:update3:*:*:*:*:*:*
Matching versions
Oracle » JDK » Version: 1.7.0 Update Update4
cpe:2.3:a:oracle:jdk:1.7.0:update4:*:*:*:*:*:*
Matching versions
Oracle » JDK » Version: 1.7.0 Update Update10
cpe:2.3:a:oracle:jdk:1.7.0:update10:*:*:*:*:*:*
Matching versions
Oracle » JDK » Version: 1.7.0 Update Update11
cpe:2.3:a:oracle:jdk:1.7.0:update11:*:*:*:*:*:*
Matching versions
Oracle » JDK » Version: 1.7.0 Update Update7
cpe:2.3:a:oracle:jdk:1.7.0:update7:*:*:*:*:*:*
Matching versions
Oracle » JDK » Version: 1.7.0 Update Update9
cpe:2.3:a:oracle:jdk:1.7.0:update9:*:*:*:*:*:*
Matching versions
Oracle » JDK » Version: 1.7.0 Update Update17
cpe:2.3:a:oracle:jdk:1.7.0:update17:*:*:*:*:*:*
Matching versions
Oracle » JDK » Version: 1.7.0 Update Update13
cpe:2.3:a:oracle:jdk:1.7.0:update13:*:*:*:*:*:*
Matching versions
Oracle » JDK » Version: 1.7.0 Update Update15
cpe:2.3:a:oracle:jdk:1.7.0:update15:*:*:*:*:*:*
Matching versions
Oracle » JDK » Version: 1.7.0 Update Update25
cpe:2.3:a:oracle:jdk:1.7.0:update25:*:*:*:*:*:*
Matching versions
Oracle » JDK » Version: 1.7.0 Update Update21
cpe:2.3:a:oracle:jdk:1.7.0:update21:*:*:*:*:*:*
Matching versions
Oracle » JDK » Version: 1.7.0 Update Update45 B33
cpe:2.3:a:oracle:jdk:1.7.0:update45_b33:*:*:*:*:*:*
Matching versions
Oracle » JDK » Version: 1.7.0 Update Update45 B32
cpe:2.3:a:oracle:jdk:1.7.0:update45_b32:*:*:*:*:*:*
Matching versions
Oracle » JDK » Version: 1.7.0 Update Update45 B31
cpe:2.3:a:oracle:jdk:1.7.0:update45_b31:*:*:*:*:*:*
Matching versions
Oracle » JDK » Version: 1.7.0 Update Update45
cpe:2.3:a:oracle:jdk:1.7.0:update45:*:*:*:*:*:*
Matching versions
Oracle » JDK » Version: 1.7.0 Update Update11 B32
cpe:2.3:a:oracle:jdk:1.7.0:update11_b32:*:*:*:*:*:*
Matching versions
Oracle » JDK » Version: 1.7.0 Update Update10 B31
cpe:2.3:a:oracle:jdk:1.7.0:update10_b31:*:*:*:*:*:*
Matching versions
Oracle » JDK » Version: 1.7.0 Update Update9 B32
cpe:2.3:a:oracle:jdk:1.7.0:update9_b32:*:*:*:*:*:*
Matching versions
Oracle » JDK » Version: 1.7.0 Update Update51
cpe:2.3:a:oracle:jdk:1.7.0:update51:*:*:*:*:*:*
Matching versions
Oracle » JDK » Version: 1.7.0 Update Update25 B35
cpe:2.3:a:oracle:jdk:1.7.0:update25_b35:*:*:*:*:*:*
Matching versions
Oracle » JDK » Version: 1.7.0 Update Update25 B33
cpe:2.3:a:oracle:jdk:1.7.0:update25_b33:*:*:*:*:*:*
Matching versions
Oracle » JDK » Version: 1.7.0 Update Update17 B31
cpe:2.3:a:oracle:jdk:1.7.0:update17_b31:*:*:*:*:*:*
Matching versions
Oracle » JDK » Version: 1.7.0 Update Update9 B31
cpe:2.3:a:oracle:jdk:1.7.0:update9_b31:*:*:*:*:*:*
Matching versions
Oracle » JDK » Version: 1.7.0 Update Update7 B32
cpe:2.3:a:oracle:jdk:1.7.0:update7_b32:*:*:*:*:*:*
Matching versions
Oracle » JDK » Version: 1.7.0 Update Update21 B31
cpe:2.3:a:oracle:jdk:1.7.0:update21_b31:*:*:*:*:*:*
Matching versions
Oracle » JDK » Version: 1.7.0 Update Update17 B32
cpe:2.3:a:oracle:jdk:1.7.0:update17_b32:*:*:*:*:*:*
Matching versions
Oracle » JDK » Version: 1.7.0 Update Update45 B34
cpe:2.3:a:oracle:jdk:1.7.0:update45_b34:*:*:*:*:*:*
Matching versions
Oracle » JDK » Version: 1.7.0 Update Update40
cpe:2.3:a:oracle:jdk:1.7.0:update40:*:*:*:*:*:*
Matching versions
Oracle » JDK » Version: 1.7.0 Update Update25 B34
cpe:2.3:a:oracle:jdk:1.7.0:update25_b34:*:*:*:*:*:*
Matching versions
Oracle » JRE
Versions up to, including, (<=) 1.7.0
cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*
Matching versions
Oracle » JRE » Version: 1.7.0 Update Update1
cpe:2.3:a:oracle:jre:1.7.0:update1:*:*:*:*:*:*
Matching versions
Oracle » JRE » Version: 1.7.0 Update Update4
cpe:2.3:a:oracle:jre:1.7.0:update4:*:*:*:*:*:*
Matching versions
Oracle » JRE » Version: 1.7.0 Update Update5
cpe:2.3:a:oracle:jre:1.7.0:update5:*:*:*:*:*:*
Matching versions
Oracle » JRE » Version: 1.7.0 Update Update2
cpe:2.3:a:oracle:jre:1.7.0:update2:*:*:*:*:*:*
Matching versions
Oracle » JRE » Version: 1.7.0 Update Update3
cpe:2.3:a:oracle:jre:1.7.0:update3:*:*:*:*:*:*
Matching versions
Oracle » JRE » Version: 1.7.0 Update Update6
cpe:2.3:a:oracle:jre:1.7.0:update6:*:*:*:*:*:*
Matching versions
Oracle » JRE » Version: 1.7.0 Update Update7
cpe:2.3:a:oracle:jre:1.7.0:update7:*:*:*:*:*:*
Matching versions
Oracle » JRE » Version: 1.7.0 Update Update9
cpe:2.3:a:oracle:jre:1.7.0:update9:*:*:*:*:*:*
Matching versions
Oracle » JRE » Version: 1.7.0 Update Update10
cpe:2.3:a:oracle:jre:1.7.0:update10:*:*:*:*:*:*
Matching versions
Oracle » JRE » Version: 1.7.0 Update Update11
cpe:2.3:a:oracle:jre:1.7.0:update11:*:*:*:*:*:*
Matching versions
Oracle » JRE » Version: 1.7.0 Update Update17
cpe:2.3:a:oracle:jre:1.7.0:update17:*:*:*:*:*:*
Matching versions
Oracle » JRE » Version: 1.7.0 Update Update15
cpe:2.3:a:oracle:jre:1.7.0:update15:*:*:*:*:*:*
Matching versions
Oracle » JRE » Version: 1.7.0 Update Update13
cpe:2.3:a:oracle:jre:1.7.0:update13:*:*:*:*:*:*
Matching versions
Oracle » JRE » Version: 1.7.0 Update Update25
cpe:2.3:a:oracle:jre:1.7.0:update25:*:*:*:*:*:*
Matching versions
Oracle » JRE » Version: 1.7.0 Update Update21
cpe:2.3:a:oracle:jre:1.7.0:update21:*:*:*:*:*:*
Matching versions
Oracle » JRE » Version: 1.7.0 Update Update45 B34
cpe:2.3:a:oracle:jre:1.7.0:update45_b34:*:*:*:*:*:*
Matching versions
Oracle » JRE » Version: 1.7.0 Update Update45 B33
cpe:2.3:a:oracle:jre:1.7.0:update45_b33:*:*:*:*:*:*
Matching versions
Oracle » JRE » Version: 1.7.0 Update Update45 B32
cpe:2.3:a:oracle:jre:1.7.0:update45_b32:*:*:*:*:*:*
Matching versions
Oracle » JRE » Version: 1.7.0 Update Update45 B31
cpe:2.3:a:oracle:jre:1.7.0:update45_b31:*:*:*:*:*:*
Matching versions
Oracle » JRE » Version: 1.7.0 Update Update45
cpe:2.3:a:oracle:jre:1.7.0:update45:*:*:*:*:*:*
Matching versions
Oracle » JRE » Version: 1.7.0 Update Update11 B32
cpe:2.3:a:oracle:jre:1.7.0:update11_b32:*:*:*:*:*:*
Matching versions
Oracle » JRE » Version: 1.7.0 Update Update10 B31
cpe:2.3:a:oracle:jre:1.7.0:update10_b31:*:*:*:*:*:*
Matching versions
Oracle » JRE » Version: 1.7.0 Update Update40
cpe:2.3:a:oracle:jre:1.7.0:update40:*:*:*:*:*:*
Matching versions
Oracle » JRE » Version: 1.7.0 Update Update25 B34
cpe:2.3:a:oracle:jre:1.7.0:update25_b34:*:*:*:*:*:*
Matching versions
Oracle » JRE » Version: 1.7.0 Update Update9 B32
cpe:2.3:a:oracle:jre:1.7.0:update9_b32:*:*:*:*:*:*
Matching versions
Oracle » JRE » Version: 1.7.0 Update Update21 B31
cpe:2.3:a:oracle:jre:1.7.0:update21_b31:*:*:*:*:*:*
Matching versions
Oracle » JRE » Version: 1.7.0 Update Update17 B32
cpe:2.3:a:oracle:jre:1.7.0:update17_b32:*:*:*:*:*:*
Matching versions
Oracle » JRE » Version: 1.7.0 Update Update51
cpe:2.3:a:oracle:jre:1.7.0:update51:*:*:*:*:*:*
Matching versions
Oracle » JRE » Version: 1.7.0 Update Update25 B35
cpe:2.3:a:oracle:jre:1.7.0:update25_b35:*:*:*:*:*:*
Matching versions
Oracle » JRE » Version: 1.7.0 Update Update25 B33
cpe:2.3:a:oracle:jre:1.7.0:update25_b33:*:*:*:*:*:*
Matching versions
Oracle » JRE » Version: 1.7.0 Update Update17 B31
cpe:2.3:a:oracle:jre:1.7.0:update17_b31:*:*:*:*:*:*
Matching versions
Oracle » JRE » Version: 1.7.0 Update Update9 B31
cpe:2.3:a:oracle:jre:1.7.0:update9_b31:*:*:*:*:*:*
Matching versions
Oracle » JRE » Version: 1.7.0 Update Update7 B32
cpe:2.3:a:oracle:jre:1.7.0:update7_b32:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2013-4578

Top countries where our scanners detected CVE-2013-4578

Top open port discovered on systems with this issue 80

IPs affected by CVE-2013-4578 70

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2013-4578!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2013-4578

EPSS FAQ

0.97%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 75 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2013-4578

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:P/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
5.3	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	3.9	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: Low Availability: None

CWE ids for CVE-2013-4578

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2013-4578

https://access.redhat.com/errata/RHSA-2014:0414

RHSA-2014:0414 - Security Advisory - Red Hat Customer Portal
Patch;Third Party Advisory;VDB Entry

CVEs referencing this url
https://bugzilla.redhat.com/show_bug.cgi?id=1031471

1031471 – (CVE-2013-4578) CVE-2013-4578 OpenJDK: jarsigner does not detect unsigned bytecode injected into signed jars
Issue Tracking;Patch;Third Party Advisory;VDB Entry
http://www.openwall.com/lists/oss-security/2015/02/08/6

oss-security - CVE-2013-4578 OpenJDK: jarsigner does not detect unsigned bytecode injected into signed jars
Mailing List;Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/02/09/9

oss-security - Re: CVE-2013-4578 OpenJDK: jarsigner does not detect unsigned bytecode injected into signed jars
Mailing List;Third Party Advisory
http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/d5f36e1c927e

jdk7u/jdk7u/jdk: d5f36e1c927e
Patch;Vendor Advisory