Overview
Oracle Java Runtime Environment (JRE) 1.7 contains a vulnerability that may allow an applet to call setSecurityManager in a way that allows setting of arbitrary permissions.
Description
The Oracle Java Runtime Environment (JRE) 1.7 allows users to run Java applications in a browser or as standalone programs. Oracle has made the JRE available for multiple operating systems. The Java JRE plug-in provides its own Security Manager. Typically, a web applet runs with a security manager provided by the browser or Java Web Start plugin. Oracle's document states, "If there is a security manager already installed, this method first calls the security manager's checkPermission method with a RuntimePermission("setSecurityManager") permission to ensure it's safe to replace the existing security manager. This may result in throwing a SecurityException". This vulnerability is being actively exploited in the wild, and exploit code is publicly available. |
Impact
By convincing a user to visit a specially crafted HTML document, a remote attacker may be able to execute arbitrary code on a vulnerable system. |
Solution
Apply an update |
Disable Java in web browsers
Disable the Java plug-in and Java Deployment Toolkit for Internet Explorer Disabling the Java plug-in for Internet Explorer is significantly more complicated than with other browsers. There are multiple ways for a web page to invoke a Java applet, and multiple ways to configure Java Plug-in support. Microsoft has released KB article 2751647, which describes how to disable the Java plug-in for Internet Explorer. However, we have found that due to the multitude of ways that Java can be invoked in Internet Explorer, their guidance (as well as our prior guidance) does not completely disable Java. However, we have provided a registry file that disables all of the CLSIDs provided by Java versions up through Java 7 Update 6, as well as blocks invocation of java through the <applet> element in the IE by setting the URLACTION_JAVA_PERMISSIONS flag for the "Internet Zone." If you wish to disable the <applet> element in other zones, you can modify the registry file to suit your needs. See Microsoft KB article 182569 for more details. In our testing, importing this registry file appears to prevent invocation of Java applets in Internet Explorer.
@="JNLP File" "EditFlags"=hex:00,00,00,00 A registry file that Disables the <applet> element in the IE "Internet Zone", sets the kill bit for all of the Java CLSIDs through Java 7 update 6, the Java Web Start ActiveX control, the Java Deployment Toolkit ActiveX controls, as well as prevents IE from automatically opening JNLP files, as described above, is available for download here:  Disable_JRE7u6_plugin_webstart_toolkit_and_JNLP_IE.regIf you wish to re-enable Java that has been disabled using the above registry file, you can import the following registry file:  Enable_JRE7u6_plugin_webstart_and_toolkit_IE.regAdditionally, if you wish to disable the Java Plug-in for Internet Explorer at the plug-in file level, you may also consider the following steps:
Disable "Open 'safe' files after downloading" in Safari By default, Safari on Mac OS X is configured to automatically open "safe" files after downloading, which also happens automatically. Java JLNP files are considered to be "safe." Disable the option "Open 'safe' files after downloading," as specified in the Securing Your Web Browser document. This will help prevent automatic exploitation of this and other vulnerabilities. Note that Java 7 is not provided with OS X by default, however it is provided by Oracle as an optional download. Uninstall Java Due to the impracticality of disabling Java in Internet Explorer with Java versions prior to 7 Update 10, you may wish to uninstall Java to protect against this vulnerability. Use different browsers for different activities An effective way of mitigating risk of web browsing is to use separate browsers for different activities online. For example, if you do online banking, choose a browser to use for banking and nothing else. This can help minimize the risk of a malicious web page being able to interfere with the banking activity. The same concept applies to Java. If you use a web site that requires Java, then choose and configure a browser to have Java enabled, and only access that resource with that browser. Other browsers should have Java disabled, as described above. This helps minimize the exposure of Java to untrusted web sites. Do not access Java Applets from untrusted sources Attackers must deliver a malicious Java applet to a vulnerable system in order to take advantage of this vulnerability. This includes opening JNLP files, as Java Web Start can be used to execute a Java applet. By only accessing Java applets from known and trusted sources the chances of exploitation are reduced. Use NoScript Using the Mozilla Firefox NoScript extension to whitelist web sites that can run scripts and access installed plugins will mitigate this vulnerability. See the NoScript FAQ for more information. |
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | 10 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
| Temporal | 9.5 | E:H/RL:W/RC:C |
| Environmental | 9.5 | CDP:MH/TD:H/CR:ND/IR:ND/AR:ND |
References
- http://www.oracle.com/technetwork/topics/security/alert-cve-2012-4681-1835715.html
- http://www.security-explorations.com/en/SE-2012-01-faq.html
- https://community.rapid7.com/community/metasploit/blog/2012/08/27/lets-start-the-week-with-a-new-java-0day
- http://docs.oracle.com/javase/tutorial/essential/environment/security.html
- http://docs.oracle.com/javase/7/docs/api/java/lang/System.html#setSecurityManager%28java.lang.SecurityManager%29
- http://docs.oracle.com/javase/7/docs/technotes/guides/security/smPortGuide.html
- https://support.apple.com/kb/HT5241
- https://support.mozilla.org/en-US/kb/How%20to%20turn%20off%20Java%20applets
- https://www.java.com/en/download/help/enable_browser.xml
- http://blog.fireeye.com/research/2012/08/zero-day-season-is-not-over-yet.html
- http://www.deependresearch.org/2012/08/java-7-0-day-vulnerability-information.html
- http://docs.oracle.com/javase/7/docs/technotes/guides/deployment/deployment-guide/jcp.html#java
- http://www.oracle.com/technetwork/java/javase/downloads/index.html
- http://docs.oracle.com/javase/7/docs/technotes/guides/javaws/developersguide/syntax.html
- http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2012-August/020065.html
- http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2012-August/020083.html
- http://support.microsoft.com/kb/2751647
- http://support.microsoft.com/kb/182569
- http://blog.eset.ie/2012/08/30/java-zero-day-vulnerability-time-to-disable-java-in-your-browser-at-least/
Acknowledgements
This vulnerability was publicly reported by FireEye.
This document was written by Will Dormann, Fred Long, Michael Orlando, and David Svoboda.
Other Information
| CVE IDs: | CVE-2012-4681 |
| Date Public: | 2012-08-26 |
| Date First Published: | 2012-08-27 |
| Date Last Updated: | 2013-01-16 14:17 UTC |
| Document Revision: | 248 |