Oracle Java Runtime Environment 'MidiDevice.Info' Class Remote Code Execution Vulnerability

Bugtraq ID:	56706
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Nov 27 2012 12:00AM
Updated:	Nov 27 2012 12:00AM
Credit:	Unknown
Vulnerable:	Oracle JRE 1.7 Update 9
Not Vulnerable:

Oracle Java Runtime Environment 'MidiDevice.Info' Class Remote Code Execution Vulnerability

Oracle Java Runtime Environment (JRE) is prone to a remote code execution vulnerability.

An attacker can exploit this issue to execute arbitrary code in the context of the application.

This vulnerability affects Oracle JRE 1.7.0 Update 9; prior versions may also be affected.

Oracle Java Runtime Environment 'MidiDevice.Info' Class Remote Code Execution Vulnerability

Reportedly, an exploit code for this vulnerability is discovered to be sold in the underground market. The exploit is otherwise not publicly available.

Oracle Java Runtime Environment 'MidiDevice.Info' Class Remote Code Execution Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Oracle Java Runtime Environment 'MidiDevice.Info' Class Remote Code Execution Vulnerability

References:

• Java Zero-Day Exploit on Sale for �??Five Digits�?? (Krebs on Security)
  
• Oracle Java Homepage (Oracle)