National Cyber Awareness System

Vulnerability Summary for CVE-2012-0507

Overview

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Concurrency. NOTE: the previous information was obtained from the February 2012 Oracle CPU. Oracle has not commented on claims from a downstream vendor and third party researchers that this issue occurs because the AtomicReferenceArray class implementation does not ensure that the array is of the Object[] type, which allows attackers to cause a denial of service (JVM crash) or bypass Java sandbox restrictions. NOTE: this issue was originally mapped to CVE-2011-3571, but that identifier was already assigned to a different issue.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: https://bugzilla.redhat.com/show_bug.cgi?id=788994

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=788994

External Source: BID

Name: 52161

Hyperlink:http://www.securityfocus.com/bid/52161

External Source: CONFIRM

Name: http://www.oracle.com/technetwork/topics/security/javacpufeb2012-366318.html

Type: Advisory

Hyperlink:http://www.oracle.com/technetwork/topics/security/javacpufeb2012-366318.html

External Source: MISC

Name: http://weblog.ikvm.net/PermaLink.aspx?guid=cd48169a-9405-4f63-9087-798c4a1866d3

Hyperlink:http://weblog.ikvm.net/PermaLink.aspx?guid=cd48169a-9405-4f63-9087-798c4a1866d3

External Source: SECUNIA

Name: 48950

Hyperlink:http://secunia.com/advisories/48950

External Source: SECUNIA

Name: 48948

Hyperlink:http://secunia.com/advisories/48948

External Source: SECUNIA

Name: 48915

Hyperlink:http://secunia.com/advisories/48915

External Source: SECUNIA

Name: 48692

Hyperlink:http://secunia.com/advisories/48692

External Source: SECUNIA

Name: 48589

Hyperlink:http://secunia.com/advisories/48589

External Source: MISC

Name: http://krebsonsecurity.com/2012/03/new-java-attack-rolled-into-exploit-packs/

Hyperlink:http://krebsonsecurity.com/2012/03/new-java-attack-rolled-into-exploit-packs/

External Source: MISC

Name: http://blogs.technet.com/b/mmpc/archive/2012/03/20/an-interesting-case-of-jre-sandbox-breach-cve-2012-0507.aspx

Hyperlink:http://blogs.technet.com/b/mmpc/archive/2012/03/20/an-interesting-case-of-jre-sandbox-breach-cve-2012-0507.aspx