CVE-2013-3009

Published: Jul 23, 2013Modified: Apr 29, 2026

9.3

Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 8.6 / Impact: 10.0

Source: NVD

Description

The com.ibm.CORBA.iiop.ClientDelegate class in IBM Java 1.4.2 before 1.4.2 SR13-FP18, 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 improperly exposes the invoke method of the java.lang.reflect.Method class, which allows remote attackers to call setSecurityManager and bypass a sandbox protection mechanism via vectors related to the AccessController doPrivileged block.

Affected (62)

Products: Ibm: Java

1 product

Configuration A

19 vulnerable

Vulnerable Software	Affected Versions
Ibm Java	Version 1.4.2.13.10
Ibm Java	Version 1.4.2.13.11
Ibm Java	Version 1.4.2.13.12
Ibm Java	Version 1.4.2.13.13
Ibm Java	Version 1.4.2.13.14
Ibm Java	Version 1.4.2.13.15
Ibm Java	Version 1.4.2.13.16
Ibm Java	Version 1.4.2.13.17
Ibm Java	Version 1.4.2.13.1
Ibm Java	Version 1.4.2.13.2
Ibm Java	Version 1.4.2.13.3
Ibm Java	Version 1.4.2.13.4
Ibm Java	Version 1.4.2.13.5
Ibm Java	Version 1.4.2.13.6
Ibm Java	Version 1.4.2.13.7
Ibm Java	Version 1.4.2.13.8
Ibm Java	Version 1.4.2.13.9
Ibm Java	Version 1.4.2.13
Ibm Java	Version 1.4.2

Configuration B

7 vulnerable

Vulnerable Software	Affected Versions
Ibm Java	Version 7.0.0.0
Ibm Java	Version 7.0.1.0
Ibm Java	Version 7.0.2.0
Ibm Java	Version 7.0.3.0
Ibm Java	Version 7.0.4.0
Ibm Java	Version 7.0.4.1
Ibm Java	Version 7.0.4.2

Configuration C

20 vulnerable

Vulnerable Software	Affected Versions
Ibm Java	Version 6.0.0.0
Ibm Java	Version 6.0.1.0
Ibm Java	Version 6.0.10.0
Ibm Java	Version 6.0.10.1
Ibm Java	Version 6.0.11.0
Ibm Java	Version 6.0.12.0
Ibm Java	Version 6.0.13.0
Ibm Java	Version 6.0.13.1
Ibm Java	Version 6.0.13.2
Ibm Java	Version 6.0.2.0
Ibm Java	Version 6.0.3.0
Ibm Java	Version 6.0.4.0
Ibm Java	Version 6.0.5.0
Ibm Java	Version 6.0.6.0
Ibm Java	Version 6.0.7.0
Ibm Java	Version 6.0.8.0
Ibm Java	Version 6.0.8.1
Ibm Java	Version 6.0.9.0
Ibm Java	Version 6.0.9.1
Ibm Java	Version 6.0.9.2

Configuration D

16 vulnerable

Vulnerable Software	Affected Versions
Ibm Java	Version 5.0.0.0
Ibm Java	Version 5.0.11.0
Ibm Java	Version 5.0.11.1
Ibm Java	Version 5.0.11.2
Ibm Java	Version 5.0.12.0
Ibm Java	Version 5.0.12.1
Ibm Java	Version 5.0.12.2
Ibm Java	Version 5.0.12.3
Ibm Java	Version 5.0.12.4
Ibm Java	Version 5.0.12.5
Ibm Java	Version 5.0.13.0
Ibm Java	Version 5.0.14.0
Ibm Java	Version 5.0.15.0
Ibm Java	Version 5.0.16.0
Ibm Java	Version 5.0.16.1
Ibm Java	Version 5.0.16.2

References (44)

http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00026.html

Source: psirt@us.ibm.com

http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00027.html

Source: psirt@us.ibm.com

http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00028.html

Source: psirt@us.ibm.com

http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00029.html

Source: psirt@us.ibm.com

http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00031.html

Source: psirt@us.ibm.com

http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00000.html

Source: psirt@us.ibm.com

http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00003.html

Source: psirt@us.ibm.com

http://rhn.redhat.com/errata/RHSA-2013-1059.html

Source: psirt@us.ibm.com

http://rhn.redhat.com/errata/RHSA-2013-1060.html

Source: psirt@us.ibm.com

http://rhn.redhat.com/errata/RHSA-2013-1081.html

Source: psirt@us.ibm.com

http://seclists.org/fulldisclosure/2016/Apr/20

Source: psirt@us.ibm.com

http://seclists.org/fulldisclosure/2016/Apr/3

Source: psirt@us.ibm.com

http://secunia.com/advisories/54154

Source: psirt@us.ibm.com

Vendor Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg1IV44792

Source: psirt@us.ibm.com

http://www-01.ibm.com/support/docview.wss?uid=swg1IX90118

Source: psirt@us.ibm.com

http://www-01.ibm.com/support/docview.wss?uid=swg1PM91727

Source: psirt@us.ibm.com

http://www-01.ibm.com/support/docview.wss?uid=swg21642336

Source: psirt@us.ibm.com

Vendor Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg21644197

Source: psirt@us.ibm.com

Vendor Advisory

http://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_July_2013

Source: psirt@us.ibm.com

Vendor Advisory

http://www.security-explorations.com/materials/SE-2012-01-IBM-2.pdf

Source: psirt@us.ibm.com

http://www.security-explorations.com/materials/SE-2012-01-IBM-4.pdf

Source: psirt@us.ibm.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/84150

Source: psirt@us.ibm.com

http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00026.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00027.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00028.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00029.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00031.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00000.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00003.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2013-1059.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2013-1060.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2013-1081.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://seclists.org/fulldisclosure/2016/Apr/20

Source: af854a3a-2127-422b-91ae-364da2661108

http://seclists.org/fulldisclosure/2016/Apr/3

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/54154

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg1IV44792

Source: af854a3a-2127-422b-91ae-364da2661108

http://www-01.ibm.com/support/docview.wss?uid=swg1IX90118

Source: af854a3a-2127-422b-91ae-364da2661108

http://www-01.ibm.com/support/docview.wss?uid=swg1PM91727

Source: af854a3a-2127-422b-91ae-364da2661108

http://www-01.ibm.com/support/docview.wss?uid=swg21642336

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg21644197

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_July_2013

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.security-explorations.com/materials/SE-2012-01-IBM-2.pdf

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.security-explorations.com/materials/SE-2012-01-IBM-4.pdf

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/84150

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.