Java JAX-WS gmbal package sandbox breach

Added: 11/23/2012
CVE: CVE-2012-5076
BID: 56054
OSVDB: 86350

Background

Java API for XML Web Services (JAX-WS) is a technology for developing web services in Java. It is included in the Java EE 5 platform.

Problem

A vulnerability in JAX-WS when handling the gmbal package allows code execution outside the sandbox, allowing arbitrary code execution when a user loads a malicious applet.

Resolution

Upgrade to JDK or JRE 7 Update 8 or higher.

References

http://www.oracle.com/technetwork/topics/security/javacpuoct2012-1515924.html

Limitations

Exploit works on Oracle JRE 7 Update 7 on Windows XP SP3 (DEP OptIn) and Windows 7 SP1 (DEP OptIn) with Internet Explorer 8 or 9, Apple Mac OS X 10.7.5 with Safari, or Ubuntu 12.04.1 with Firefox.

The netcat utility (nc) must be installed on Mac OS X and Linux targets.

Platforms

Windows
Mac OS X
Linux

Back to exploit index