Oracle Java Runtime Environment CVE-2012-3174 Remote Code Execution Vulnerability

Bugtraq ID:	57312
Class:	Unknown
CVE:	CVE-2012-3174
Remote:	Yes
Local:	No
Published:	Jan 13 2013 12:00AM
Updated:	Apr 16 2015 05:42PM
Credit:	Ben Murphy
Vulnerable:	SuSE SUSE Linux Enterprise Server for VMware 11 SP2 + Linux kernel 2.6.5 SuSE SUSE Linux Enterprise Server 11 SP2 + Linux kernel 2.6.5 Sun JRE (Windows Production Release) 1.7.0_4 Sun JRE (Windows Production Release) 1.7.0_2 Sun JRE (Solaris Production Release) 1.7.0_4 Sun JRE (Solaris Production Release) 1.7.0_2 Sun JRE (Linux Production Release) 1.7.0_4 Sun JRE (Linux Production Release) 1.7.0_2 Red Hat Enterprise Linux Workstation Supplementary 6 Red Hat Enterprise Linux Workstation Optional 6 Red Hat Enterprise Linux Workstation 6 Red Hat Enterprise Linux Supplementary 5 server Red Hat Enterprise Linux Server Supplementary 6 Red Hat Enterprise Linux Server Optional 6 Red Hat Enterprise Linux Server 6 Red Hat Enterprise Linux HPC Node Supplementary 6 Red Hat Enterprise Linux HPC Node Optional 6 Red Hat Enterprise Linux HPC Node 6 Red Hat Enterprise Linux Desktop Supplementary 6 Red Hat Enterprise Linux Desktop Supplementary 5 client Red Hat Enterprise Linux Desktop Optional 6 Red Hat Enterprise Linux Desktop 6 Red Hat Enterprise Linux Desktop 5 client Red Hat Enterprise Linux 5 Server Oracle Enterprise Linux 6.2 Oracle Enterprise Linux 6 IBM Maximo Asset Management Essentials 7.5 IBM Maximo Asset Management Essentials 7.1 IBM Maximo Asset Management 7.5 IBM Maximo Asset Management 7.1 IBM Maximo Asset Management 6.2 IBM Java SE 7 SR1 Gentoo Linux CentOS CentOS 5
Not Vulnerable:

Oracle Java Runtime Environment CVE-2012-3174 Remote Code Execution Vulnerability

Oracle Java Runtime Environment (JRE) is prone to a remote code execution vulnerability.

An attacker can exploit this issue to execute arbitrary code in the context of the application.

Oracle Java Runtime Environment CVE-2012-3174 Remote Code Execution Vulnerability

The vulnerability is being exploited in-the-wild.

Oracle Java Runtime Environment CVE-2012-3174 Remote Code Execution Vulnerability

Solution:
Updates are available. Please see the references for more information.

Oracle Java Runtime Environment CVE-2012-3174 Remote Code Execution Vulnerability

References:

• Bug 894934 - (CVE-2012-3174) CVE-2012-3174 java7: unspecified vulnerability lead (David Jorm)
  
• IBM Security alerts (IBM)
  
• Oracle Java Homepage (Oracle)
  
• Oracle Java Runtime Environment MethodHandle Security Manager Bypass Remote Code (HP)
  
• Oracle Security Alert for CVE-2013-0422 (Oracle)
  
• Security Alert for CVE-2013-0422 Released (Oracle)
  
• ASA-2013-026 java-1.7.0-oracle security update (RHSA-2013-0156) (Avaya)
  
• IBM Endpoint Manager for Remote Control is affected by multiple Java vulnerabili (IBM)
  
• Potential security vulnerabilities with JavaTM SDKs (IBM)
  
• Security Bulletin: IBM Tivoli System Automation for Integrated Operations Manage (IBM)