Quantum Secular Labs / Blog / Advisories

CVE-2013-1489: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 10 and…

CVE-2013-1489 has a CVSS v2 base score of 10.0 (the maximum on that scale) and affects Oracle JRE, along with 1 other product in NVD’s configuration data. Per its scoring, it can be exploited over the network, without authentication. The scored impact on confidentiality, integrity and availability is the highest available.

Vulnerability description

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 10 and Update 11, when running on Windows using Internet Explorer, Firefox, Opera, and Google Chrome, allows remote attackers to bypass the "Very High" security level of the Java Control Panel and execute unsigned Java code without prompting the user via unknown vectors, aka "Issue 53" and the "Java Security Slider" vulnerability.

Severity breakdown

CVSS v2.0 10.0: AV:N/AC:L/Au:N/C:C/I:C/A:C

  • Access vector: Network. Exploitable remotely over the network.
  • Access complexity: Low. No special conditions are required.
  • Authentication: None. No authentication is needed.
  • Confidentiality impact: Complete. Total information disclosure.
  • Integrity impact: Complete. Total loss of integrity.
  • Availability impact: Complete. Total shutdown of the component.

Affected products

  • Oracle JRE: 1.7.0 update10; 1.7.0 update11
  • Oracle JDK: 1.7.0 update10; 1.7.0 update11

References