# MA-341.012013: MyCERT Alert - Oracle Java Runtime Environment JRE 1.7.x Remote Code Execution Vulnerability (CVE-2013-0422 )

**Date:** 13 Jan 2013  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-341.012013  
**Advisory ID:** MA-341.012013

---

**1.0 Introduction**
This security alert addresses the vulnerability in Oracle JRE 1.7.0 Update 9, JRE 1.7.0 Update 10 and earlier versions may also be vulnerable.  JRE 6, 5.0 and 1.4.2, and Java SE Embedded JRE releases are not affected.
The vulnerability allows a remote attacker to execute arbitrary code on a vulnerable version of JRE 7 Update 10. User interaction is required where a user must visit a malicious web page that leverages the vulnerability. The vulnerability would cause the browser crash and potentially allow attacker to take control of the affected system. [1]
The vulnerability would cause the browser crash and potentially allow attacker to take control of the affected system remotely.
**2.0 Impact**
By exploiting this vulnerability, an attacker could execute arbitrary code on vulnerable installations of JRE 7 Update 10 and gain the same privilege as the user. This vulnerability could be exploited to install malware on the user's computer.
**3.0 Affected Products**
Products listed below are vulnerable to these vulnerabilities:
- JRE 7 Update 10 and earlier
**4.0 Recommendation**
- MyCERT recommends users of Oracle JRE 7 on Windows, Linux and Macintosh to upgrade to the newest version by downloading it from the following
[URL:http://www.oracle.com/technetwork/java/javase/7u11-relnotes-1896856.html](http://www.oracle.com/technetwork/java/javase/7u11-relnotes-1896856.html)
- MyCERT recommends users of Oracle Java change to the default Java Security Level setting from “Medium” to “High”. This setting will allow the user always prompted before any unsigned Java applet or Java Web Start Application is running.
[URL:http://docs.oracle.com/javase/7/docs/technotes/guides/jweb/client-security.html](http://docs.oracle.com/javase/7/docs/technotes/guides/jweb/client-security.html)
- Users running Java SE with a browser can download the latest JRE 7 release from URL: <http://java.com/>
- Users on the Windows platform can use the automatic updates feature to get the latest JRE 7 release.
URL: <http://www.java.com/en/download/help/java_update.xml>
MyCERT generally advise users to keep themselves updated with the latest security announcements by the vendor. In case the public receives any suspicious URL or file, and requires our further analysis, please reach us through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#d2b1abb0b7a0ebebeb92b1abb0b7a0a1b7b1a7a0bba6abfcbfab) or [[email protected]](/cdn-cgi/l/email-protection#eb8692888e999fab8692888e999fc584998cc58692)
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 08:30 -17:30 MYT
Web: [https://www.mycert.org.my](https://www.mycert.org.my/)
**5.0 References**
i. <http://www.oracle.com/technetwork/topics/security/alert-cve-2013-0422-1896849.html>
ii. <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0422>
iii. <http://blog.fireeye.com/research/2013/01/happy-new-year-from-new-java-zero-day.html>
iv. <https://threatpost.com/en_us/blogs/nasty-new-java-zero-day-found-exploit-kits-already-have-it-011013>
v. <http://labs.alienvault.com/labs/index.php/2013/new-year-new-java-zeroday/>