CVE-2013-0422
Oracle JRE Remote Code Execution Vulnerability
Description
CVE-2013-0422 is a critical-severity remote code execution vulnerability in Oracle Java 7 (before Update 11) caused by improper access control in the Java applet sandbox. By chaining the public getMBeanInstantiator method in the JmxMBeanServer class with a Reflection API recursion bug, a malicious applet can bypass the sandbox's security checks and execute arbitrary code outside its intended restrictions. The flaw was exploited in the wild in January 2013 and rapidly integrated into the Blackhole and Nuclear Pack exploit kits — toolkits widely used to deliver malware and ransomware via drive-by downloads. With a CVSS score of 9.8, an EPSS score of 93.6% (99.8th percentile), confirmed use in ransomware campaigns, and a CISA KEV listing, CVE-2013-0422 is one of the most heavily weaponized Java vulnerabilities of its era.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| oracle | jdk | 1.7.0 |
| oracle | jre | 1.7.0 |
| canonical | ubuntu linux | 12.10 |
| opensuse | opensuse | 12.2 |
References
- http://blog.fireeye.com/research/2013/01/happy-new-year-from-new-java-zero-day.html(Not Applicable)
- http://blog.fuseyism.com/index.php/2013/01/15/security-icedtea-2-1-4-2-2-4-2-3-4-released/(Broken Link)
- http://immunityproducts.blogspot.ca/2013/01/confirmed-java-only-fixed-one-of-two.html(Third Party Advisory)
- http://krebsonsecurity.com/2013/01/zero-day-java-exploit-debuts-in-crimeware/(Third Party Advisory)
- http://labs.alienvault.com/labs/index.php/2013/new-year-new-java-zeroday/(Broken Link, Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00025.html(Mailing List, Third Party Advisory)
- http://malware.dontneedcoffee.com/2013/01/0-day-17u10-spotted-in-while-disable.html(Third Party Advisory)
- http://rhn.redhat.com/errata/RHSA-2013-0156.html(Third Party Advisory)
- http://rhn.redhat.com/errata/RHSA-2013-0165.html(Third Party Advisory)
- http://seclists.org/bugtraq/2013/Jan/48(Mailing List, Third Party Advisory)
- http://www.kb.cert.org/vuls/id/625617(Third Party Advisory, US Government Resource)
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:095(Not Applicable)
- http://www.oracle.com/technetwork/topics/security/alert-cve-2013-0422-1896849.html(Vendor Advisory)
- http://www.ubuntu.com/usn/USN-1693-1(Third Party Advisory)
- http://www.us-cert.gov/cas/techalerts/TA13-010A.html(Third Party Advisory, US Government Resource)
- https://partners.immunityinc.com/idocs/Java%20MBeanInstantiator.findClass%200day%20Analysis.pdf(Broken Link)
- https://threatpost.com/en_us/blogs/nasty-new-java-zero-day-found-exploit-kits-already-have-it-011013(Not Applicable)
- https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0018(Third Party Advisory)
- https://www-304.ibm.com/connections/blogs/PSIRT/entry/oracle_java_7_security_manager_bypass_vulnerability_cve_2013_04224?lang=en_us(Not Applicable)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-0422(US Government Resource)
Weakness Type
CWE-284: Improper Access Control
In Oracle Java 7, improper access control lets an untrusted applet reach functionality that should be off-limits to sandboxed code: it uses the public getMBeanInstantiator method to obtain a private MBeanInstantiator object and retrieve arbitrary Class references via findClass, and abuses Reflection API recursion to bypass the MethodHandles.Lookup security-manager check. The net effect is that access controls meant to confine applets to the sandbox are circumvented, enabling full code execution.
Learn more: CWE-284 — Improper Access Control
Impact Analysis
CVE-2013-0422 carries a CVSS 3.1 score of 9.8 (CRITICAL). It is remotely exploitable over the network with low attack complexity, requires no authentication and no user interaction beyond loading a page with a malicious applet, and fully compromises the confidentiality, integrity, and availability of the affected system because exploitation escapes the Java sandbox to run arbitrary code. The EPSS score of 93.6% (99.8th percentile) reflects near-certain exploitation activity, and CISA has flagged this vulnerability as known to be used in ransomware campaigns — consistent with its incorporation into the Blackhole and Nuclear Pack exploit kits that delivered ransomware and other malware at scale. Any system still running the vulnerable Java 7 browser plugin faces a high risk of drive-by compromise leading to ransomware deployment.
Exploit Maturity
CVE-2013-0422 has an extremely mature and heavily weaponized exploit history. It was exploited in the wild in January 2013 as a zero-day and was quickly demonstrated in the Blackhole and Nuclear Pack exploit kits, the dominant crimeware platforms of the period, as documented by KrebsOnSecurity and FireEye. CISA confirms active exploitation through its KEV listing and flags the vulnerability as known to be used in ransomware campaigns, and the EPSS score of 93.6% (99.8th percentile) indicates near-certain exploitation activity. Reliable exploits have been embedded in commodity attack toolkits for over a decade, so any exposed vulnerable Java 7 installation should be considered at immediate risk.
Remediation
- Apply updates per vendor instructions as required by the CISA KEV listing: upgrade Oracle Java to at least Java 7 Update 11 (and preferably to a current, supported Java release), as the affected JDK/JRE is 1.7.0 before Update 11.
- Disable the Java browser plugin entirely where it is not strictly required, since the attack vector is malicious applets delivered through the browser — this is the single most effective mitigation against drive-by exploitation.
- Update affected Linux distributions to patched packages — Red Hat (RHSA-2013-0156/0165), openSUSE 12.2, and Ubuntu 12.10 all shipped fixes — and remove unsupported Java versions from the estate.
- Given the documented ransomware and exploit-kit usage, deploy web filtering to block known exploit-kit infrastructure, and monitor for drive-by exploitation indicators and signs of ransomware deployment.
- As long-term hardening against improper-access-control sandbox escapes, eliminate browser-based Java applets, keep Java runtimes current, and apply application allowlisting to limit what unexpected code can execute.
Technical Details
CVE-2013-0422 is an improper access control vulnerability (CWE-284) in Oracle Java 7 before Update 11 that enables a sandbox escape. It combines two issues: using the public getMBeanInstantiator method in the JmxMBeanServer class to obtain a reference to a private MBeanInstantiator object and then retrieve arbitrary Class references via findClass; and abusing recursion in the Reflection API to bypass the security check in java.lang.invoke.MethodHandles.Lookup.checkSecurityManager, because sun.reflect.Reflection.getCallerClass fails to skip frames related to the new reflection API. Together these defeat the access controls that confine applet code, allowing arbitrary code execution. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a network-reachable, low-complexity, unauthenticated attack with full impact across confidentiality, integrity, and availability; it is distinct from CVE-2012-4681 and CVE-2012-3174.
Frequently Asked Questions
Is CVE-2013-0422 being actively exploited?
Yes. CVE-2013-0422 was exploited in the wild as a zero-day in January 2013, is on the CISA Known Exploited Vulnerabilities catalog, and is flagged by CISA as known to be used in ransomware campaigns. Its EPSS score of 93.6% (99.8th percentile) confirms near-certain exploitation activity, and it was a staple of the Blackhole and Nuclear Pack exploit kits.
What products are affected by CVE-2013-0422?
The vulnerability affects Oracle Java 7 (JDK and JRE 1.7.0) before Update 11, including the Java packages shipped with distributions such as Ubuntu 12.10 and openSUSE 12.2. Java 6 was initially reported as affected but later determined not to be exploitable.
How do I fix CVE-2013-0422?
Upgrade Oracle Java to at least Java 7 Update 11, and preferably to a current supported release. Disable the Java browser plugin where it is not required, since malicious applets are the attack vector, and apply your distribution's patched Java packages.
How severe is CVE-2013-0422?
CVE-2013-0422 is rated CRITICAL with a CVSS 3.1 score of 9.8. It allows a malicious applet to escape the Java sandbox and execute arbitrary code with no authentication, and it is confirmed to be used in ransomware campaigns, making it one of the most dangerous Java vulnerabilities of its time.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.