System compromise in Java
Experts of Security Explorations reported Oracle developers of two gap, allowing completely bypass sandbox restrictions Java.
According to the new notification researchers Security Explorations, the latest version of Java were discovered two new vulnerabilities that can completely bypass the restrictions built into the platform sandbox. Thus, according to the expert Adam Gowdiak, gaps affect current versions of Java 7 SE, in particular component Reflection API, which you can get around the limitations "in an interesting way."
Govdiak also said that he tested the original release of Java SE 7, Java SE 7 Update 11 and Java SE 7 Update 15. According to Security Explorations, Oracle developers have already received all the information and PoC-code, and pledged to take action.
More detailed description of vulnerabilities
Danger level: High
Number of vulnerabilities: 2
Vector of operation: Remote
Impact: System Compromise
Affected Products: Oracle Java JDK 1.7.x / 7.x
Oracle Java JRE 1.7.x / 7.x
Java SE 7 Update 11, perhaps the only one.
Java SE 7 Update 15 possibly other versions.
The vulnerability allows a remote user to execute arbitrary code on the target system.
1. The vulnerability is caused due to an unspecified error in the component Reflection API. This can be exploited to bypass sandbox restrictions and compromise a vulnerable system.
2. The vulnerability is caused due to an unspecified error in the component Reflection API. This can be exploited to bypass sandbox restrictions and compromise a vulnerable system.
Solution: The way to eliminate the vulnerability does not exist at present.
Security Explorations Link: http://www.security-explorations.com/en/SE-2012-01-status.html