Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2013-1557: Java JRE allows remote access over RMI

CVE-2013-1557 · published 13 years ago

Summary

Older versions of Oracle Java SE (updates before 7u17, 6u43, 5.0u41) and OpenJDK 6 and 7 contain a weakness that lets an attacker connect remotely via Java's RMI feature and potentially read, change, or stop your applications. This can compromise data and service availability. Upgrade to the latest Java releases or apply the vendor's security patches to close the gap.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
oracle	jre	<= 1.7.0 1.7.0 <= 1.6.0 1.6.0 <= 1.5.0 1.5.0 `cpe:2.3:a:oracle:jre::update17::::::*`
oracle	jdk	<= 1.7.0 1.7.0 <= 1.6.0 1.6.0 <= 1.5.0 1.5.0 `cpe:2.3:a:oracle:jdk::update17::::::*`
sun	jre	1.6.0 1.5.0 `cpe:2.3:a:sun:jre:1.6.0:::::::*`
sun	jdk	1.6.0 1.5.0 `cpe:2.3:a:sun:jdk:1.6.0:::::::*`

Original advisory text

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "missing security restrictions" in the LogStream.setDefaultStream method.

References

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

10.0 Critical

Exploitation

7% chance of attack within 30 days

Timeline

Published17 Apr 2013

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2013-1557 · NVD

Track software like this

Free during beta