Oracle Java Critical Patch Update February 2013 Review
Oracle has provide his Java Critical Patch Update (CPU) for February 2013 how has been released on Friday, February 1. Initial release date was planned for 19 February but Oracle has push this update earlier due to the active exploitation of one of the critical vulnerabilities in the wild. On the 50 security vulnerabilities, fixed in this CPU, 49 of them may be remotely exploitable. The highest CVSS Base Score for vulnerabilities in this CPU is 10.0. 34 vulnerabilities have a CVSS base score upper or equal to 7.0.
It is actually not clear which of these vulnerability is exploited in the wild, but it could be related to CVE-2013-1489, an issue publicly reported and regarding Java SE7 security features introduced in Java SE7 Update 10.
As you may know Oracle is using CVSS 2.0 (Common Vulnerability Scoring System) in order to score the reported vulnerabilities. But as you also may know security researchers disagree with the usage of CVSS by Oracle. Oracle play with CVSS score by creating a “Partial+” impact rating how don’t exist in CVSS 2.0, and by interpreting the “Complete” rating in a different way than defined in CVSS 2.0.
Affected products are:
- JDK and JRE 7 Update 11 and earlier
- JDK and JRE 6 Update 38 and earlier
- JDK and JRE 5.0 Update 38 and earlier
- SDK and JRE 1.4.2_40 and earlier
- JavaFX 2.2.4 and earlier
CVE-2012-1541, CVE-2012-3213, CVE-2012-3342, CVE-2012-4301, CVE-2013-0425, CVE-2013-0426, CVE-2013-0428, CVE-2013-0436, CVE-2013-0437, CVE-2013-0439, CVE-2013-0441, CVE-2013-0442, CVE-2013-0445, CVE-2013-0446, CVE-2013-0447, CVE-2013-0450, CVE-2013-1472, CVE-2013-1475, CVE-2013-1476, CVE-2013-1477, CVE-2013-1478, CVE-2013-1479, CVE-2013-1480, CVE-2013-1481, CVE-2013-1482 and CVE-2013-1483 have a CVSS base score of 10.0.
CVE-2013-0351 has a CVSS base score of 7.5.
CVE-2013-0430 has a CVSS base score of 6.9.
CVE-2013-0432 has a CVSS base score of 6.4.
CVE-2013-0438 has a CVSS base score of 4.3.
CVE-2013-0443 has a CVSS base score of 4.0.
CVE-2013-1489 has a CVSS base score of 0.0.
I recommend you to read these related posts
- Bye Bye Java SE 6, Security Enhancements in Java SE 7U10
- Oracle Java Critical Patch Update April 2013 Review
- Oracle Java Critical Patch Update February 2013 – Special Update Review
- Oracle Java Critical Patch Update June 2013 Review
- CVE-2012-5076 Java Applet AverageRangeStatisticImpl RCE Metasploit Demo
- CVE-2012-5088 Java Applet Method Handle RCE Metasploit Demo
- CVE-2013-0431 Java Applet JMX Remote Code Execution Metasploit Demo
- CVE-2013-2423 – Java 7u17 Applet Reflection Type Confusion RCE Metasploit Demo
- CVE-2013-2460 Java Applet ProviderSkeleton Vulnerability Metasploit Demo
- Oracle Java Critical Patch Update October 2012 Review