CVE Feed

    Dashboard / CVE / CVE-2013-3009

    CVE-2013-3009

    The com.ibm.CORBA.iiop.ClientDelegate class in IBM Java 1.4.2 before 1.4.2 SR13-FP18, 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 improperly exposes the invoke method of the java.lang.reflect.Method class, which allows remote attackers to call setSecurityManager and bypass a sandbox protection mechanism via vectors related to the AccessController doPrivileged block.

    Published:Jul 12, 2013
    Last Modified:Apr 11, 2025
    EPS:Jul 23, 2013
    EPSS Score:0.03238
    CVSS Score:9.3

    Affected Products

    Vendor
    Ibm
    Product
    Java
    Vendor
    Redhat
    Product
    Rhel Extras

    Exploits

    No exploit reference

    Common Weakness Enumeration

    No CWE recorded yet

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2023-30441 (CVSS 7.5) — IBM Runtime Environment, Java Technology Edition IBMJCEPlus and JSSE 8.0.7.0 through 8.0.7.11 components could…
    CVE-2019-4473 (CVSS 7.8) — Multiple binaries in IBM SDK, Java Technology Edition 7, 7R, and 8 on the AIX platform use insecure absolute R…
    CVE-2015-1914 (CVSS 5) — IBM Java 7 R1 before SR3, 7 before SR9, 6 R1 before SR8 FP4, 6 before SR16 FP4, and 5.0 before SR16 FP10 allow…
    CVE-2015-1916 (CVSS 7.5) — Unspecified vulnerability in IBM Java 8 before SR1 allows remote attackers to cause a denial of service via un…
    CVE-2015-0192 (CVSS 9.8) — Unspecified vulnerability in IBM Java 8 before SR1, 7 R1 before SR2 FP11, 7 before SR9, 6 R1 before SR8 FP4, 6…
    CVE-2014-3068 (CVSS 6.4) — IBM Java Runtime Environment (JRE) 7 R1 before SR1 FP1 (7.1.1.1), 7 before SR7 FP1 (7.0.7.1), 6 R1 before SR8 …
    CVE-2014-3065 (CVSS 6.9) — Unspecified vulnerability in IBM Java Runtime Environment (JRE) 7 R1 before SR2 (7.1.2.0), 7 before SR8 (7.0.8…
    CVE-2013-4041 (CVSS 6.8) — Unspecified vulnerability in IBM Java SDK 5.0.0 before SR16 FP4, 7.0.0 before SR6, 6.0.1 before SR7, and 6.0.0…
    CVE-2013-5456 (CVSS 9.3) — The com.ibm.rmi.io.SunSerializableFactory class in IBM Java SDK 7.0.0 before SR6 allows remote attackers to by…
    CVE-2013-5375 (CVSS 6.8) — Unspecified vulnerability in IBM Java SDK 7.0.0 before SR6, 6.0.1 before SR7, 6.0.0 before SR15, and 5.0.0 bef…

    References

    http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00026.html
    http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00027.html
    http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00028.html
    http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00029.html
    http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00031.html
    http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00000.html
    http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00003.html
    http://rhn.redhat.com/errata/RHSA-2013-1059.html
    http://rhn.redhat.com/errata/RHSA-2013-1060.html
    http://rhn.redhat.com/errata/RHSA-2013-1081.html
    http://seclists.org/fulldisclosure/2016/Apr/20
    http://seclists.org/fulldisclosure/2016/Apr/3
    http://secunia.com/advisories/54154
    http://www-01.ibm.com/support/docview.wss?uid=swg1IV44792
    http://www-01.ibm.com/support/docview.wss?uid=swg1IX90118
    http://www-01.ibm.com/support/docview.wss?uid=swg1PM91727
    http://www-01.ibm.com/support/docview.wss?uid=swg21642336
    http://www-01.ibm.com/support/docview.wss?uid=swg21644197
    http://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_July_2013
    http://www.security-explorations.com/materials/SE-2012-01-IBM-2.pdf
    http://www.security-explorations.com/materials/SE-2012-01-IBM-4.pdf
    https://exchange.xforce.ibmcloud.com/vulnerabilities/84150
    http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00026.html
    http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00027.html
    http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00028.html
    http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00029.html
    http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00031.html
    http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00000.html
    http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00003.html
    http://rhn.redhat.com/errata/RHSA-2013-1059.html
    http://rhn.redhat.com/errata/RHSA-2013-1060.html
    http://rhn.redhat.com/errata/RHSA-2013-1081.html
    http://seclists.org/fulldisclosure/2016/Apr/20
    http://seclists.org/fulldisclosure/2016/Apr/3
    http://secunia.com/advisories/54154
    http://www-01.ibm.com/support/docview.wss?uid=swg1IV44792
    http://www-01.ibm.com/support/docview.wss?uid=swg1IX90118
    http://www-01.ibm.com/support/docview.wss?uid=swg1PM91727
    http://www-01.ibm.com/support/docview.wss?uid=swg21642336
    http://www-01.ibm.com/support/docview.wss?uid=swg21644197
    http://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_July_2013
    http://www.security-explorations.com/materials/SE-2012-01-IBM-2.pdf
    http://www.security-explorations.com/materials/SE-2012-01-IBM-4.pdf
    https://exchange.xforce.ibmcloud.com/vulnerabilities/84150

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High