exploit the possibilities

Technical Cyber Security Alert 2012-240A

Technical Cyber Security Alert 2012-240A
Posted Aug 29, 2012
Authored by US-CERT | Site us-cert.gov

Technical Cyber Security Alert 2012-240A - A vulnerability in the way Java 7 restricts the permissions of Java applets could allow an attacker to execute arbitrary commands on a vulnerable system.

tags | advisory, java, arbitrary
MD5 | e5e5cd52692029936f512b51ebde7cb5

Technical Cyber Security Alert 2012-240A

Change Mirror Download

Hash: SHA1

National Cyber Awareness System

US-CERT Alert TA12-240A
Oracle Java 7 Security Manager Bypass Vulnerability

Original release date: August 27, 2012
Last revised: --

Systems Affected

Any system using Oracle Java 7 (1.7, 1.7.0) including:

* Java Platform Standard Edition 7 (Java SE 7)
* Java SE Development Kit (JDK 7)
* Java SE Runtime Environment (JRE 7)

Web browsers using the Java 7 Plug-in are at high risk.


A vulnerability in the way Java 7 restricts the permissions of Java
applets could allow an attacker to execute arbitrary commands on a
vulnerable system.


A vulnerability in the Java Security Manager allows a Java applet
to grant itself permission to execute arbitrary operating system
commands. An attacker could use social engineering techniques to
entice a user to visit a link to a web site hosting a malicious

Any web browser using the Java 7 Plug-in is affected.

Reports indicate this vulnerability is being actively exploited,
and exploit code is publicly available.


By convincing a user to load a malicious Java applet, an attacker
could execute arbitrary operating system commands on a vulnerable
system with the privileges of the Java Plug-in process.


Disable the Java Plug-in

Disabling the Java web browser plug-in will prevent Java applets
from from running. Here are instructions for several common web

* Apple Safari: How to disable the Java web plug-in in Safari

* Mozilla Firefox: How to turn off Java applets

* Google Chrome: See the "Disable specific plug-ins" section of the
Chrome Plug-ins documentation.

* Microsoft Internet Explorer: Change the value of the
UseJava2IExplorer registry key to 0. Depending on the versions of
Windows and the Java plug-in, the key can be found in these

HKLM\Software\JavaSoft\Java Plug-in\{version}\UseJava2IExplorer

HKLM\Software\Wow6432Node\JavaSoft\Java Plug-in\{version}\UseJava2IExplorer

* The Java Control Panel (javacpl.exe) does not reliably configure
the Java plug-in for Internet Explorer. Instead of editing the
registry, it is possible to run javacpl.exe as Administrator,
navigate to the Advanced tab, Default Java for browsers, and use
the space bar to de-select the Microsoft Internet Explorer option.

Use NoScript

NoScript is a browser extension for Mozilla Firefox browsers that
provides options to block Java applets.


* Vulnerability Note VU#636312

* Zero-Day Season is Not Over Yet

* Let's start the week with a new Java 0-day in Metasploit

* http://pastie.org/4594319

* The Security Manager

* Java 7 0-Day vulnerability information and mitigation.

* How to disable the Java web plug-in in Safari

* How to turn off Java applets

* NoScript

Revision History

August 27, 2012: Initial release


Feedback can be directed to US-CERT Technical Staff. Please send
email to <cert@cert.org> with "TA12-240A Feedback VU#636312" in
the subject.

Produced by US-CERT, a government organization.

This product is provided subject to this Notification:

Privacy & Use policy:

This document can also be found at

For instructions on subscribing to or unsubscribing from this
mailing list, visit http://www.us-cert.gov/cas/signup.html

Version: GnuPG v1.4.5 (GNU/Linux)



RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

October 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    24 Files
  • 2
    Oct 2nd
    15 Files
  • 3
    Oct 3rd
    7 Files
  • 4
    Oct 4th
    4 Files
  • 5
    Oct 5th
    10 Files
  • 6
    Oct 6th
    1 Files
  • 7
    Oct 7th
    21 Files
  • 8
    Oct 8th
    19 Files
  • 9
    Oct 9th
    5 Files
  • 10
    Oct 10th
    20 Files
  • 11
    Oct 11th
    17 Files
  • 12
    Oct 12th
    4 Files
  • 13
    Oct 13th
    4 Files
  • 14
    Oct 14th
    15 Files
  • 15
    Oct 15th
    19 Files
  • 16
    Oct 16th
    25 Files
  • 17
    Oct 17th
    17 Files
  • 18
    Oct 18th
    7 Files
  • 19
    Oct 19th
    1 Files
  • 20
    Oct 20th
    0 Files
  • 21
    Oct 21st
    0 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags


packet storm

© 2019 Packet Storm. All rights reserved.

Security Services
Hosting By