Exploit for Java JAX-WS statistics.impl package sandbox breach

saint · 2013-02-07

Description

Java JAX-WS statistics.impl package sandbox breach. Upgrade to JDK or JRE 7 Update 8 or higher

Affected Oracle Jre versions

Oracle Jre= 1.7.0

All known vulnerabilities by product

Centos Jax-Ws Jre Java Platform Java Se Red Hat Suse

CVSS 10.0 for CVE-2012-5076

10.0

HIGH SEVERITY

Version 2.0

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

EPSS Score

91.0%higher than 99.8% of all CVEs

Updated 2026-06-16

Exploit Details

Modified:2013-02-07 00:00

Last Seen:2026-03-11 04:24

Reporter:SAINT Corporation

Tags

java api for xml web servicesjax-wsCVE-2012-5076bid 56054osvdb 86350code executionsandboxjava ee 5jdkjreoracleupgradeweb serviceswindowslinuxexploit.

Other exploits for CVE-2012-5076

Java Applet JAX-WS Remote Code Execution

2014-07-01 RootSEEBUGRuby

Java Applet AverageRangeStatisticImpl Remote Code Execution

2014-07-01 RootSEEBUGRuby

Java JAX-WS statistics.impl package sandbox breach

2013-02-07 SAINT CorporationSAINT

Java JAX-WS statistics.impl package sandbox breach

2013-02-07 SAINT CorporationSAINT

Java JAX-WS statistics.impl package sandbox breach

2013-02-07 SAINT CorporationSAINT

Java Applet - AverageRangeStatisticImpl Remote Code Execution (Metasploit)

2013-01-24 MetasploitEXPLOITDBRuby

Java Applet AverageRangeStatisticImpl Remote Code Execution

2013-01-23 metasploitZDTRuby

Java Applet AverageRangeStatisticImpl Remote Code Execution

2013-01-23 juan vazquezPACKETSTORMRuby

Exploit Code

MARKDOWN32 lines

## https://sploitus.com/exploit?id=SAINT:D727568CE7D0055B14ECCA639DFB195F
Added: 02/07/2013  
CVE: CVE-2012-5076  
BID: 56054  
OSVDB: 86350  


### Background

Java API for XML Web Services (JAX-WS) is a technology for developing web services in Java. It is included in the Java EE 5 platform. 

### Problem

A vulnerability in JAX-WS when handling the com.sun.org.glassfish.external.statistics.impl package allows code execution outside the sandbox, allowing arbitrary code execution when a user loads a malicious applet. 

### Resolution

Upgrade to JDK or JRE 7 Update 8 or higher. 

### References

http://www.oracle.com/technetwork/topics/security/javacpuoct2012-1515924.html   


### Limitations

Exploit works on Oracle JRE 7 Update 7 on Windows XP SP3 (DEP OptIn), Windows 7 SP1 (DEP OptIn), and Ubuntu 12.04.1 LTS, and requires a user to open the exploit page in a web browser. 

### Platforms

Windows  
Linux