HTTP: Oracle Java ImageRepresentation.setPixels Integer Overflow
This signature detects attempts to exploit a known vulnerability against Oracle Java. The vulnerability is due to improper validation of image and raster dimensions in the sun.awt.image.ImageRepresentation.setPixels method. A remote attacker can exploit this vulnerability by enticing the target user to visit a specially crafted web page. Successful exploitation of this vulnerability can allow execution of arbitrary code on a target system.
Extended Description
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to insufficient "validation of images" in share/native/sun/awt/image/awt_ImageRep.c, possibly involving offsets.
Affected Products
Oracle jdk
References
CVE: CVE-2013-2420
Short Name
HTTP:STC:JAVA:IMG-SETPIXELS-OF
Severity
Major
Recommended
False
Recommended Action
Drop
Category
HTTP
Keywords
CVE-2013-2420 ImageRepresentation.setPixels Integer Java Oracle Overflow
Release Date
08/22/2013
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3735
False Positive
Unknown
Vendors
Oracle
Sun
CVSS Score
10.0