Vulnerability Description
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via unknown vectors related to HotSpot. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from the original researcher that this vulnerability allows remote attackers to bypass permission checks by the MethodHandles method and modify arbitrary public final fields using reflection and type confusion, as demonstrated using integer and double fields to disable the security manager.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Oracle | Jre | 1.7.0 |
| Canonical | Ubuntu Linux | 12.10 |
| Opensuse | Opensuse | 12.3 |
Related Weaknesses (CWE)
References
- http://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdkBroken Link
- http://blog.spiderlabs.com/2013/04/java-is-so-confusing.htmlNot Applicable
- http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/b453d9be6b3fPatch
- http://lists.opensuse.org/opensuse-updates/2013-06/msg00099.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2013-0752.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2013-0757.htmlThird Party Advisory
- http://security.gentoo.org/glsa/glsa-201406-32.xmlThird Party Advisory
- http://weblog.ikvm.net/PermaLink.aspx?guid=acd2dd6d-1028-4996-95df-efa42ac237f0Broken Link
- http://www.exploit-db.com/exploits/24976Third Party AdvisoryVDB Entry
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:161Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.htmlVendor Advisory
- http://www.ubuntu.com/usn/USN-1806-1Third Party Advisory
- http://www.us-cert.gov/ncas/alerts/TA13-107AThird Party AdvisoryUS Government Resource
- https://bugzilla.redhat.com/show_bug.cgi?id=952398Issue Tracking
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Broken Link
FAQ
What is CVE-2013-2423?
CVE-2013-2423 is a vulnerability with a CVSS score of 3.7 (LOW). Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via unknown vectors rela...
How severe is CVE-2013-2423?
CVE-2013-2423 has been rated LOW with a CVSS base score of 3.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2013-2423?
Check the references section above for vendor advisories and patch information. Affected products include: Oracle Jre, Canonical Ubuntu Linux, Opensuse Opensuse.