CVE-2012-0500

Oracle Java SE <7.2 - Info Disclosure

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 3 public exploits for CVE-2012-0500. PoCs published by Metasploit, including Metasploit module exploits/windows/browser/java_ws_double_quote.

AI-analyzed exploit summary This Metasploit module exploits a flaw in the Java Web Start plugin (CVE-2012-0500) by injecting arbitrary JVM arguments via the -J option, leading to remote code execution. It leverages WebDAV and SMB to deliver a malicious DLL payload.

Description

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and JavaFX 2.0.2 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

Exploits (3)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotewindows
https://www.exploit-db.com/exploits/18520

This Metasploit module exploits a flaw in the Java Web Start plugin (CVE-2012-0500) by injecting arbitrary JVM arguments via the -J option, leading to remote code execution. It leverages WebDAV and SMB to deliver a malicious DLL payload.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Sun Java Runtime Environment (JRE) with Web Start plugin
No auth needed
Prerequisites: Target must have WebClient service enabled · Attacker must run the exploit as root on a server not serving SMB · Target must visit a malicious URL or be redirected to the exploit server
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC EXCELLENT
rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/java_ws_double_quote.rb

This Metasploit module exploits a flaw in Java Web Start (CVE-2012-0500) by injecting a double quote into JNLP parameters, allowing the -XXaltjvm option to load a malicious jvm.dll from a remote UNC path, achieving arbitrary code execution.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Java Runtime Environment <= 1.6.35 and <= 1.7.07
No auth needed
Prerequisites: WebClient service enabled on target · SMB/UNC path accessibility · Metasploit host running as root on non-Windows server
devstral-2 · analyzed Mar 02, 2026 Full analysis →
metasploit WORKING POC EXCELLENT
rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/java_ws_vmargs.rb

This Metasploit module exploits CVE-2012-0500 by injecting arbitrary JVM arguments via the Java Web Start plugin, leveraging the -XXaltjvm option to execute malicious code. It acts as an HTTP server to deliver a crafted JNLP file and DLL payload to vulnerable Java Runtime Environments on Windows.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Sun Java Runtime Environment (JRE) with Web Start Plugin
No auth needed
Prerequisites: Target must have WebClient service enabled · Attacker must run the exploit as root on a server not serving SMB · Target must visit a malicious link or be redirected to the exploit server
devstral-2 · analyzed Feb 19, 2026 Full analysis →

References (13)

Core 13
Core References
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2013-1455.html
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=133847939902305&w=2
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=133364885411663&w=2
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14844
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=134254866602253&w=2
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/48589
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/52015
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/48073
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/48950
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=134254957702612&w=2
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2012-0514.html

Scores

EPSS 0.7485
EPSS Percentile 98.9%

Details

Status published
Products (12)
oracle/javafx 1.2
oracle/javafx 1.2.2
oracle/javafx 1.2.3
oracle/javafx 1.3.0
oracle/javafx 1.3.1
oracle/javafx 2.0
oracle/javafx < 2.0.2
oracle/jre 1.6.0 update22 (7 CPE variants)
oracle/jre 1.7.0 (2 CPE variants)
oracle/jre < 1.6.0
... and 2 more
Published Feb 15, 2012
Tracked Since Feb 18, 2026