Description
Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5.0 Update 31 and earlier, 1.4.2_33 and earlier, and JRockit R28.1.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to RMI, a different vulnerability than CVE-2011-3557.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | openjdk-6 | 6b18-1.8.10-0+squeeze2 | DSA-2356-1 |
| Debian 5.0 | openjdk-6 | 6b18-1.8.10-0~lenny2 | DSA-2358-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | java-1.5.0-ibm +6 | 1:1.5.0.13.0-1jpp.1.el6 | RHSA-2011:1478 |
| RHEL 6 | java-1.6.0-ibm +6 | 1:1.6.0.10.0-1jpp.2.el6 | RHSA-2012:0034 |
| RHEL 6 | java-1.6.0-openjdk +4 | 1:1.6.0.0-1.40.1.9.10.el6_1 | RHSA-2011:1380 |
| RHEL 6 | java-1.6.0-sun +5 | 1:1.6.0.29-1jpp.1.el6 | RHSA-2011:1384 |
| RHEL 5 | java-1.4.2-ibm +6 | 1.4.2.13.11-1jpp.1.el5 | RHSA-2012:0006 |
| RHEL 5 | java-1.4.2-ibm-sap +4 | 1.4.2.13.11.sap-1jpp.1.el5 | RHSA-2012:0343 |
| RHEL 5 | java-1.5.0-ibm +7 | 1:1.5.0.13.0-1jpp.1.el5 | RHSA-2011:1478 |
| RHEL 5 | java-1.6.0-ibm +7 | 1:1.6.0.10.0-1jpp.2.el5 | RHSA-2012:0034 |
| RHEL 5 | java-1.6.0-openjdk +4 | 1:1.6.0.0-1.23.1.9.10.el5_7 | RHSA-2011:1380 |
| RHEL 5 | java-1.6.0-sun +5 | 1:1.6.0.29-1jpp.1.el5 | RHSA-2011:1384 |
| RHEL 4 | java-1.4.2-ibm +6 | 1.4.2.13.11-1jpp.1.el4 | RHSA-2012:0006 |
| RHEL 4 | java-1.4.2-ibm-sap +4 | 1.4.2.13.11.sap-1jpp.1.el4 | RHSA-2012:0343 |
| RHEL 4 | java-1.5.0-ibm +6 | 1:1.5.0.13.0-1jpp.1.el4 | RHSA-2011:1478 |
| RHEL 4 | java-1.6.0-ibm +6 | 1:1.6.0.10.0-1jpp.2.el4 | RHSA-2012:0034 |
| RHEL 4 | java-1.6.0-sun +5 | 1:1.6.0.29-1jpp.1.el4 | RHSA-2011:1384 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Network Satellite 5 | java-1.6.0-ibm +1 | 1:1.6.0.14.0-1jpp.1.el5_9 | RHSA-2013:1455 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 2 modules
-
Java RMI Server Insecure Default Configuration Java Code Execution
exploit/multi/misc/java_rmi_server
-
Java RMI Server Insecure Endpoint Code Execution Scanner
auxiliary/scanner/misc/java_rmi_server
Exploit-DB 1
- Java RMI - Server Insecure Default Configuration Java Code Execution (Metasploit) EDB-17535 · remote · Jul 15, 2011 · verified
GitHub 1 repository
-
sk4la/cve_2011_3556 ★ 1 · Jan 29, 2019
Python 3 implementation of an existing CVE-2011-3556 proof of concept (PoC).
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 9
- RHSA-2013:1455 Red Hat Security Advisory: Red Hat Network Satellite server IBM Java Runtime security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2012:0343 Red Hat Security Advisory: java-1.4.2-ibm-sap security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2012:0034 Red Hat Security Advisory: java-1.6.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2012:0006 Red Hat Security Advisory: java-1.4.2-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2011:1478 Red Hat Security Advisory: java-1.5.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2011:1380 Red Hat Security Advisory: java-1.6.0-openjdk security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2011:1384 Red Hat Security Advisory: java-1.6.0-sun security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- DSA-2358-1 openjdk-6 - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-2356-1 openjdk-6 - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- 76505 vdb-entry
- 50231 vdb-entry
- GLSA-201406-32 vendor-advisory
- 48692 third-party-advisory
- HPSBMU02799 vendor-advisory
- SSRT100805 vendor-advisory
- 48308 third-party-advisory
- HPSBUX02730 vendor-advisory
- jre-rmi-unspecified(70837) vdb-entry
- SUSE-SU-2012:0114 vendor-advisory
- RHSA-2013:1455 vendor-advisory
- oval:org.mitre.oval:def:14316 vdb-entry signature
- RHSA-2011:1478 vendor-advisory
- RHSA-2011:1384 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html
- SSRT100867 vendor-advisory
- 49198 third-party-advisory
- RHSA-2012:0006 vendor-advisory
- SUSE-SU-2012:0122 vendor-advisory
- HPSBUX02777 vendor-advisory
- 1026215 vdb-entry
- USN-1263-1 vendor-advisory
- http://www.ibm.com/developerworks/java/jdk/alerts/
- VU#597809 third-party-advisory