CVE-2012-5076
Oracle Java SE Sandbox Bypass Vulnerability
Description
CVE-2012-5076 is a critical sandbox bypass vulnerability in Oracle Java SE 7 Update 7 and earlier that allows an unauthenticated remote attacker to execute arbitrary code outside the Java security sandbox. The flaw exists in the Java Runtime Environment component and enables complete compromise of the affected system through a malicious Java applet. With an EPSS score of 97.5% (99.9th percentile), this is one of the most exploited Java vulnerabilities ever documented. CISA has added CVE-2012-5076 to the Known Exploited Vulnerabilities catalog, confirming active exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| oracle | jre | 1.7.0 |
| suse | linux enterprise desktop | 11 |
References
- http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00016.html(Mailing List, Third Party Advisory)
- http://rhn.redhat.com/errata/RHSA-2012-1386.html(Third Party Advisory)
- http://rhn.redhat.com/errata/RHSA-2012-1391.html(Third Party Advisory)
- http://rhn.redhat.com/errata/RHSA-2012-1467.html(Third Party Advisory)
- http://secunia.com/advisories/51029(Not Applicable)
- http://secunia.com/advisories/51326(Not Applicable)
- http://secunia.com/advisories/51390(Not Applicable)
- http://security.gentoo.org/glsa/glsa-201406-32.xml(Third Party Advisory)
- http://www.oracle.com/technetwork/topics/security/javacpuoct2012-1515924.html(Patch, Vendor Advisory)
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16641(Broken Link)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-5076(US Government Resource)
Weakness Type
CWE-284: Improper Access Control
CVE-2012-5076 exploits an improper access control weakness in Oracle Java SE's security sandbox mechanism. The vulnerability allows a malicious Java applet to bypass the sandbox restrictions that normally prevent untrusted code from accessing system resources, enabling full system access without authorization.
Learn more: CWE-284 — Improper Access Control
Impact Analysis
CVE-2012-5076 has a CVSS v2 base score of 10.0 (Critical), the maximum possible severity. The vulnerability is exploitable remotely with no authentication, and successful exploitation grants the attacker complete control over the affected system, bypassing all Java sandbox restrictions. The EPSS score of 97.5% (99.9th percentile) places it among the most exploited vulnerabilities globally. The attack vector through web browsers with Java plugins enabled means any user visiting a compromised website is at risk, making this a highly effective vector for drive-by download campaigns and exploit kits.
Exploit Maturity
CVE-2012-5076 has been extensively weaponized since its disclosure in late 2012. Multiple exploit kits including Blackhole, Cool, and Sweet Orange incorporated this vulnerability to deliver malware payloads at scale. CISA confirmed active exploitation by adding it to the KEV catalog. The EPSS score of 97.5% (99.9th percentile) reflects the pervasive exploitation of this Java sandbox bypass across the threat landscape.
Remediation
- Update Oracle Java SE to a version released after October 2012 that addresses CVE-2012-5076. Apply the patches from Oracle's October 2012 Critical Patch Update immediately.
- Disable Java browser plugins across all organizational browsers. The primary exploitation vector is through malicious applets loaded in web browsers.
- Remove Java from endpoints where it is not required for business operations. Reducing the Java installation footprint significantly decreases the attack surface.
- Implement application whitelisting to prevent unauthorized Java applets from executing, even if users encounter compromised websites.
- Monitor for indicators of compromise including unexpected Java process behavior, suspicious outbound connections from Java processes, and signs of exploit kit activity on the network.
Technical Details
CVE-2012-5076 is a sandbox bypass vulnerability (CWE-284) in the Java Runtime Environment of Oracle Java SE 7 Update 7 and earlier. The flaw allows a malicious Java applet to escape the security sandbox that normally restricts untrusted code from performing privileged operations. By exploiting weaknesses in the Java security manager and reflection APIs, the attacker can gain access to restricted classes and methods that are normally blocked for unsigned applets. Once the sandbox is bypassed, the applet can execute arbitrary system commands, read and write files, and establish network connections without any restrictions. The vulnerability is particularly impactful because Java applets could be loaded automatically by browsers with Java plugins enabled.
Frequently Asked Questions
Is CVE-2012-5076 being actively exploited?
Yes, CVE-2012-5076 has been one of the most actively exploited Java vulnerabilities since its disclosure in 2012. CISA confirmed this by adding it to the KEV catalog. Major exploit kits incorporated this vulnerability, and the EPSS score of 97.5% reflects near-universal exploitation activity.
What products are affected by CVE-2012-5076?
Oracle Java SE 7 Update 7 and earlier versions are affected. The vulnerability is in the Java Runtime Environment component that handles security sandbox enforcement for untrusted applets and applications.
How do I fix CVE-2012-5076?
Apply Oracle's October 2012 Critical Patch Update or upgrade to a current supported Java version. Disable Java browser plugins immediately and remove Java from systems where it is not needed.
How severe is CVE-2012-5076?
CVE-2012-5076 has the maximum CVSS v2 score of 10.0 (Critical). It allows complete sandbox bypass leading to arbitrary code execution with no authentication required. The EPSS score of 97.5% confirms it is among the most exploited Java vulnerabilities in history.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.