CVE-2013-1493
EXPLOITED IN THE WILD RANSOMWAREOracle JRE < 1.7.0 - Remote Code Execution via Crafted Image Raster Parameters
Title source: llmExploitation Summary
CVE-2013-1493 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io), including in ransomware campaigns.
EIP tracks 2 public exploits from researchers including Metasploit, Unknown, juan vazquez, including a Metasploit module exploits/windows/browser/java_cmm.
AI-analyzed exploit summary This Metasploit module exploits CVE-2013-1493, a vulnerability in Java's Color Management Module (CMM) to achieve remote code execution. It leverages a malicious Java applet to bypass sandbox restrictions, targeting Java 7u15 and earlier, as well as 6u41 and earlier.
Description
The color management (CMM) functionality in the 2D component in Oracle Java SE 7 Update 15 and earlier, 6 Update 41 and earlier, and 5.0 Update 40 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (crash) via an image with crafted raster parameters, which triggers (1) an out-of-bounds read or (2) memory corruption in the JVM, as exploited in the wild in February 2013.
Exploits (2)
This Metasploit module exploits CVE-2013-1493, a vulnerability in Java's Color Management Module (CMM) to achieve remote code execution. It leverages a malicious Java applet to bypass sandbox restrictions, targeting Java 7u15 and earlier, as well as 6u41 and earlier.
This Metasploit module exploits CVE-2013-1493, a vulnerability in Java's Color Management Module (CMM) that allows remote code execution. It leverages malicious Java applet classes to bypass sandbox restrictions and execute arbitrary code on vulnerable Java versions (7u15 and earlier, 6u41 and earlier).