CVE-2012-4681: bypassing built-in java security
Summary: A Java 0-day exploit spread rapidly after a code paste on Sunday night and a Metasploit module the following morning, using Statement and Expression methods to bypass access violation checks on the restricted sun.awt.SunToolkit package and replace the AccessControlContext to gain full local execution. Oracle's next scheduled patch release was October 16, and with a policy against out-of-band updates that left nearly two months of exposure, though an editor's note says Oracle shipped a patch on August 30.
Key Takeaway: The Blackhole exploit kit was already incorporating this vulnerability while the vendor's patch policy pointed to a two-month window, leaving researchers to distribute an unofficial patch by request only.
Read the original at Cisco Talos ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2012-4681
- Related
- Internet Explorer use-after-free 0-Day vulnerability Cyber Risks ·Attackers Pounce on Zero-Day Java Exploit Cyber Risks ·CVE-2012-4681: Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability Known Exploited Vulnerabilities · Mar 03, 2022