Description
Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses SecurityManager restrictions by (1) using com.sun.beans.finder.ClassFinder.findClass and leveraging an exception with the forName method to access restricted classes from arbitrary packages such as sun.awt.SunToolkit, then (2) using "reflection with a trusted immediate caller" to leverage the getField method to access and modify private fields, as exploited in the wild in August 2012 using Gondzz.class and Gondvv.class.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | java-1.7.0-ibm +5 | 1:1.7.0.2.0-1jpp.3.el6_3 | RHSA-2012:1289 |
| RHEL 6 | java-1.7.0-openjdk +4 | 1:1.7.0.5-2.2.1.el6_3.3 | RHSA-2012:1223 |
| RHEL 6 | java-1.7.0-oracle +4 | 1:1.7.0.7-1jpp.5.el6_3 | RHSA-2012:1225 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | java-1_7_0-openjdk | 1.7.0.121-1.1 | openSUSE-SU-2024:10534-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Java 7 Applet Remote Code Execution
exploit/multi/browser/java_jre17_exec
Exploit-DB 1
- Java 7 Applet - Remote Code Execution (Metasploit) EDB-20865 · remote · Aug 27, 2012 · verified
GitHub 2 repositories
-
benjholla/CVE-2012-4681-Armoring ★ 1 · Sep 26, 2014
An A/V evasion armoring experiment for CVE-2012-4681
-
ZH3FENG/PoCs-CVE_2012_4681 ★ 0 · Jan 5, 2018
A Simple PoC for CVE-2012-4681
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 4
- RHSA-2012:1289 Red Hat Security Advisory: java-1.7.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2012:1225 Red Hat Security Advisory: java-1.7.0-oracle security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2012:1223 Red Hat Security Advisory: java-1.7.0-openjdk security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- openSUSE-SU-2024:10534-1 java-1_7_0-openjdk-1.7.0.121-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- http://blog.fireeye.com/research/2012/08/zero-day-season-is-not-over-yet.html
- SUSE-SU-2012:1398 vendor-advisory
- SUSE-SU-2012:1231 vendor-advisory
- TA12-240A third-party-advisory
- http://labs.alienvault.com/labs/index.php/2012/new-java-0day-exploited-in-the-wild/
- SSRT100970 vendor-advisory
- https://community.rapid7.com/community/metasploit/blog/2012/08/27/lets-start-the-week-with-a-new-java-0day
- http://www.deependresearch.org/2012/08/java-7-vulnerability-analysis.html
- http://www.oracle.com/technetwork/topics/security/alert-cve-2012-4681-1835715.html
- RHSA-2012:1225 vendor-advisory
- http://immunityproducts.blogspot.com/2012/08/java-0day-analysis-cve-2012-4681.html
- 51044 third-party-advisory
- 55213 vdb-entry