## https://sploitus.com/exploit?id=SAINT:30B6CFDC962268E8CEAB02B936B3AA0D
Added: 01/14/2013
CVE: [CVE-2013-0422](<https://vulners.com/cve/CVE-2013-0422>)
BID: [57246](<http://www.securityfocus.com/bid/57246>)
OSVDB: [89059](<http://www.osvdb.org/89059>)
### Background
Java is a programming language that compiles programs to bytecode, which is then executed inside a Java Virtual Machine. This is optimal for applications that must run on various hardware platforms, such as web applets.
### Problem
Two vulnerabilities exist in Java versions prior to 7 Update 11. The first vulnerability allows the _findClass_ method of the _MBeanInstantiator_ class to return a Class reference to any package. However, the _MBeanInstantiator_ class constructor is private, so a reference to an instance object must be found. The _newMBeanServer_ static method will return a _JmxMBeanServer_ instance, which contains a reference to an instance of _MBeanInstantiator_.
The second vulnerability has to do with security checks performed when calling methods using reflection. The _Lookup_ subclass of the _MethodHandlers_ class performs security validation by calling its _checkSecurityManager_ method. The _checkSecurityManager_ method then attempts to walk the call stack by calling the _getCallerClassAtEntryPoint_ method. This method simply returns the result of the _Reflection.getCallerClass_ method. This method should skip stack frames relating to the Reflection API. However, it does not properly skip Reflection API frames, which may allow the security checks to be bypassed.
The combination of these two vulnerabilities may allow an attacker to execute arbitrary Java code with full privileges on the target system.
### Resolution
Upgrade to [Java 7 Update 11](<http://www.oracle.com/technetwork/java/javase/7u11-relnotes-1896856.html>) or later. This update does not fix the vulnerability, but it does flag all code from unknown sources. Users will be prompted to execute the Java applet, but if they choose to execute the applet, they can still be compromised. Disabling Java browser plug-ins is a more robust solution, but may impact any webapps that use Java applets.
### References
<http://www.oracle.com/technetwork/topics/security/alert-cve-2013-0422-1896849.html>
<http://www.cbsnews.com/8301-205_162-57563846/java-7-patch-released-experts-say-may-contain-flaws/>
<http://www.reuters.com/article/2013/01/13/us-java-oracle-security-idUSBRE90C0JB20130113>
<http://www.bbc.co.uk/news/technology-21011669>
### Limitations
This exploit has been tested against Oracle JRE 7 Update 10 on Windows XP SP3 English (DEP OptIn), Windows 7 SP1 (DEP OptIn), Mac OS X 10.7.5, and Ubuntu 12.04.1 LTS.
### Platforms
Windows
Mac OS X
Linux