Vulnerability in IBM Java
CVE-2013-3009
The com.ibm.CORBA.iiop.ClientDelegate class in IBM Java 1.4.2 before 1.4.2 SR13-FP18, 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 improperly exposes the invoke method of the java.lang.reflect.Method class, which allows remote attackers to call setSecurityManager and bypass a sandbox protection mechanism via vectors related to the AccessController doPrivileged block.
EPSS: 0.044 (90.6th percentile) — read the EPSS interpretation.
Affected products
- Ibm Java — versions 1.4.2, 1.4.2.13, 1.4.2.13.1
- N/a — versions n/a
References
- psirt@us.ibm.com (x_refsource_REDHAT, vendor-advisory)
- psirt@us.ibm.com (x_refsource_MISC)
- psirt@us.ibm.com (vendor-advisory, x_refsource_SUSE)
- psirt@us.ibm.com (vendor-advisory, x_refsource_SUSE)
- psirt@us.ibm.com (vendor-advisory, x_refsource_SUSE)
- psirt@us.ibm.com (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
- psirt@us.ibm.com (vendor-advisory, x_refsource_AIXAPAR)
- psirt@us.ibm.com (x_refsource_MISC)
- psirt@us.ibm.com (vendor-advisory, x_refsource_SUSE)
- psirt@us.ibm.com (x_refsource_REDHAT, vendor-advisory)