VRT 391,192 CVEs tracked · 15,442 in RASP scope · data as of 20 hours ago

CVE-2012-3153

6.4 Medium Protected by RASP

Description

Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Servlet. NOTE: the previous information is from the October 2012 CPU. Oracle has not commented on claims from the original researcher that the PARSEQUERY function allows remote attackers to obtain database credentials via reports/rwservlet/parsequery, and that this issue occurs in earlier versions. NOTE: this can be leveraged with CVE-2012-3152 to execute arbitrary code by uploading a .jsp file.

Exploitation Status

Working exploit published

A reviewed exploit catalogue carries this CVE. Somebody has published code a stranger can run.

CVSS E:P

  • CISA KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC 3 indexed Published artifacts you can open, in Exploit-DB, GitHub PoC, Nuclei; first seen 2014-01-28.
  • EPSS 98% chance in 30 days A model prediction, not an observation. Higher than 99.9% of all scored CVEs.
IndexArtifactStarsFirst seen
GitHub PoC Automated exploit for CVE-2012-3153 / CVE-2012-3152 8 2014-01-28
Exploit-DB Oracle Forms and Reports 11.1 - Arbitrary Code Execution 2014-01-29
Nuclei Oracle Forms & Reports RCE (CVE-2012-3152 & CVE-2012-3153)

Waratek Defense Posture

Protected by RASP

A Waratek agent blocks this today.

Applicable rule: CVE is covered by a multi-CVE ARMR patch rule

  • Protection full a patch rule written for this CVE
  • Action available patch rule
  • Review human armr-file
  • Record active
Decided by armr-patch-file : An ARMR patch file on disk for this CVE
Finding CVE is covered by a multi-CVE ARMR patch rule

ARMR rule files

1 file

Shipped files covering this CVE. A CVE genuinely takes more than one: separate Maven artifacts hooking different parser classes, the same patch built for two ARMR versions, or a fix at both the framework and the container.
rules/middleware/oracle/CVE-2012-3152/patch/2.6/CVE-2012-3152.armr patch rule added 2020-06-25 updated 2026-03-04 
app("CVE-2012-3152, CVE-2012-3153"):
    requires(version: "ARMR/2.6")

    /***************************************************************************
        CVE-2012-3152, CVE-2012-3153

        CVSS 2.0 Summary:
            Base Score              | 6.4
            Attack Vector           | Network
            Attack Complexity       | Low
            Authentication          | None
            Confidentiality         | Partial
            Integrity               | Partial
            Availability Impact     | None

        Description:
            Unspecified vulnerability in the Oracle Reports Developer component
            in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows
            remote attackers to affect confidentiality and integrity via unknown
            vectors related to Report Server Component. NOTE: the previous
            information is from the October 2012 CPU. Oracle has not commented
            on claims from the original researcher that the URLPARAMETER
            functionality allows remote attackers to read and upload arbitrary
            files to reports/rwservlet, and that this issue occurs in earlier
            versions. NOTE: this can be leveraged with CVE-2012-3153 to execute
            arbitrary code by uploading a .jsp file.

        Resources:
            https://www.exploit-db.com/exploits/31253/
            http://www.primalsecurity.net/python-tutorials-use-case-cve-2012-3152/
            https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/oracle_reports_rce.rb

        Affected Operating System:
            Any

        Affected Versions:
            Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0

        Tested Versions:
            Oracle Application Server (OC4J) with Oracle 12c (WebLogic 12.2.1.2)

        Protection Provided:
            Virtual patch based on public exploits.

        Patch Version:
            1.2-b07
        Supported app servers:
            WebLogic, OC4J.
    ***************************************************************************/

    #
    # LFI Patch for OC4J
    #

    patch("CVE-2012-3152, CVE-2012-3153 :01"):
        function("com/evermind/server/http/EvermindHttpServletRequest.getQueryString()Ljava/lang/String;")
        exit()

        code(language: java,   import: ["java.net.URI",
                                        "javax.servlet.http.HttpServletRequest",
                                        "javax.servlet.ServletRequest",
                                        "com.evermind.net.AddressContainer",
                                        "com.evermind.server.http.EvermindHttpServletRequest"]):

            private static final String VULNERABLE_URI = "/reports/rwservlet";
            private static final String URLPARAMETER = "urlparameter";
            private static final String[] SAFE_PROTOCOLS = {
                    "http://", "https://", "\"http://", "\"https://",
                    "%22http://", "%22https://", "%27http://", "%27https://",
                    "http%3A%2F%2F", "https%3A%2F%2F", "\"http%3A%2F%2F", "\"https%3A%2F%2F",
                    "%22http%3A%2F%2F", "%22https%3A%2F%2F", "%27http%3A%2F%2F", "%27https%3A%2F%2F"
            };
            private static final String[] SAFE_HOSTS = {""};
            private static final String SAFE_QUERY_STRING = "";

            public void patch(JavaFrame frame) {

                EvermindHttpServletRequest self = (EvermindHttpServletRequest) frame.loadThisVariable();
                String uri = self.getRequestURI();
                // String.contains() does not exist in Java 1.4
                if (uri == null || uri.toLowerCase().indexOf(VULNERABLE_URI) == -1) {
                    return;
                }

                String query = frame.loadStringOperand(0);

                if (query == null) {
                    return;
                }

                try {
                    query = java.net.URLDecoder.decode(query, "UTF-8").toLowerCase();
                } catch (java.io.UnsupportedEncodingException ex) {
                    // ignore, UTF-8 is hardcoded
                }

                if (query.indexOf(URLPARAMETER) > -1) {
                    String[] keyValues = query.split(" ");
                    blockIfMalicious(keyValues, frame, uri);
                    keyValues = query.split("&");
                    blockIfMalicious(keyValues, frame, uri);
                }
            }

            private void blockIfMalicious(String[] keyValues, JavaFrame frame, String uri) {
                if (keyValues == null) {
                    return;
                }

                for (String keyVal : keyValues) {
                    String[] pair = keyVal.split("=", 2);
                    if (pair.length != 2) {
                        continue;
                    }

                    String key = pair[0];
                    String val = pair[1];

                    if (URLPARAMETER.equalsIgnoreCase(key)) {
                        for (String safeProtocol : SAFE_PROTOCOLS) {
                            if (val.startsWith(safeProtocol) && isSafeHost(val)) {
                                return;
                            }
                        }
                        logAttack(uri, keyVal);
                        frame.returnString(SAFE_QUERY_STRING);
                        return;
                    }
                }
            }

            private boolean isSafeHost(String val) {
                try {
                    val = trimCharacter(val, '"');
                    val = trimCharacter(val, '\'');
                    URI uri = new URI(val);
                    String host = uri.getHost();

                    if (host == null
                        || host.equalsIgnoreCase("localhost")
                        || host.equalsIgnoreCase("127.0.0.1")) {
                        return true;
                    }

                    host = host.toLowerCase();
                    for (String safeHost : SAFE_HOSTS) {
                        if (safeHost.toLowerCase().equals(host)) {
                            return true;
                        }
                    }
                    return false;
                } catch (Throwable t) {
                    return true;
                }
            }

            public static String trimCharacter(String string, char c) {
                if (string == null || string.length() == 0) {
                    return string;
                }
                int start = 0;
                int last = string.length();
                while (start < last) {
                    if (string.charAt(start) == c) {
                        start++;
                    } else if (string.charAt(last - 1) == c) {
                        last--;
                    } else {
                        break;
                    }
                }
                return string.substring(start, last);
            }

            private void logAttack(String uri, String query) {
                ArmrEvent event = ArmrEvent.load("Execute Rule", "high");
                event.addExtension("msg", "An attempt was made to query the file-system, related to CVE-2012-3152.");
                event.addExtension("servletUri", String.valueOf(uri));
                event.addExtension("query", String.valueOf(query));
                event.addExtension("act", "protect");
                event.commit();
            }
        endcode
    endpatch

    #
    # RCE Patch for OC4J
    #

    patch("CVE-2012-3152, CVE-2012-3153 :02"):
        function("com/evermind/server/http/EvermindHttpServletRequest.getParameter(Ljava/lang/String;)Ljava/lang/String;")
        exit()

        code(language: java,   import: ["javax.servlet.http.HttpServletRequest",
                                        "javax.servlet.ServletRequest",
                                        "com.evermind.net.AddressContainer",
                                        "com.evermind.server.http.EvermindHttpServletRequest"]):

            private static final String VULNERABLE_PARAM = "desname";
            private static final String VULNERABLE_URI = "/reports/rwservlet";
            private static final String[] MALICIOUS_FILE_EXTENSIONS = {".jsp", ".bat", ".sh", ".exe", ".class", ".java", ".so", ".dll"};
            private static final String SAFE_PARAMETER_VALUE = "";

            public void patch(JavaFrame frame) {
                EvermindHttpServletRequest self = (EvermindHttpServletRequest) frame.loadThisVariable();
                String uri = self.getRequestURI();
                // String.contains() does not exist in Java 1.4
                if (uri == null || uri.toLowerCase().indexOf(VULNERABLE_URI) == -1) {
                    return;
                }

                String param = frame.loadStringVariable(1);
                if (param == null || !param.equalsIgnoreCase(VULNERABLE_PARAM)) {
                    return;
                }

                String paramValue = frame.loadStringOperand(0);
                if (paramValue == null) {
                    return;
                }

                paramValue = paramValue.toLowerCase();
                for (String extension : MALICIOUS_FILE_EXTENSIONS) {
                    if (paramValue.endsWith(extension)) {
                        block(frame, uri, paramValue);
                        return;
                    }
                }
            }

            private void block(JavaFrame frame, String uri, String paramValue) {
                ArmrEvent event = ArmrEvent.load("Execute Rule", "high");
                event.addExtension("msg", "An attempt was made to upload a file related to CVE-2012-3152.");
                event.addExtension("servletUri", String.valueOf(uri));
                event.addExtension("paramValue", String.valueOf(paramValue));
                event.addExtension("act", "protect");
                event.commit();
                frame.returnString(SAFE_PARAMETER_VALUE);
            }
        endcode
    endpatch

    patch("CVE-2012-3152, CVE-2012-3153 :03"):
        function("com/evermind/server/http/EvermindHttpServletRequest.getParameterValues(Ljava/lang/String;)[Ljava/lang/String;")
        exit()

        code(language: java,   import: ["javax.servlet.http.HttpServletRequest",
                                        "javax.servlet.ServletRequest",
                                        "com.evermind.net.AddressContainer",
                                        "com.evermind.server.http.EvermindHttpServletRequest"]):

            private static final String VULNERABLE_PARAM = "desname";
            private static final String VULNERABLE_URI = "/reports/rwservlet";
            private static final String[] MALICIOUS_FILE_EXTENSIONS = {".jsp", ".bat", ".sh", ".exe", ".class", ".java", ".so", ".dll"};
            private static final String SAFE_PARAMETER_VALUE = "";
            private static final String[] SAFE_PARAMETER_VALUES = {""};

            public void patch(JavaFrame frame) {
                EvermindHttpServletRequest self = (EvermindHttpServletRequest) frame.loadThisVariable();
                String uri = self.getRequestURI();
                // String.contains() does not exist in Java 1.4
                if (uri == null || uri.toLowerCase().indexOf(VULNERABLE_URI) == -1) {
                    return;
                }

                String param = frame.loadStringVariable(1);
                if (param == null || !param.equalsIgnoreCase(VULNERABLE_PARAM)) {
                    return;
                }

                String[] paramValues = (String[]) frame.loadObjectOperand(0);
                if (paramValues.length == 0) {
                    return;
                }

                for (String extension : MALICIOUS_FILE_EXTENSIONS) {
                    for (String paramValue : paramValues) {
                        if (paramValue != null && paramValue.toLowerCase().endsWith(extension)) {
                            block(frame, uri, paramValue);
                            return;
                        }
                    }
                }
            }

            private void block(JavaFrame frame, String uri, String paramValue) {
                ArmrEvent event = ArmrEvent.load("Execute Rule", "high");
                event.addExtension("msg", "An attempt was made to upload a file related to CVE-2012-3152.");
                event.addExtension("servletUri", String.valueOf(uri));
                event.addExtension("paramValue", String.valueOf(paramValue));
                event.addExtension("act", "protect");
                event.commit();
                frame.returnObject(SAFE_PARAMETER_VALUES);
            }
        endcode
    endpatch

    patch("CVE-2012-3152, CVE-2012-3153 :04"):
        function("com/evermind/server/http/EvermindHttpServletRequest.getQueryString()Ljava/lang/String;")
        exit()

        code(language: java,   import: ["javax.servlet.http.HttpServletRequest",
                                        "javax.servlet.ServletRequest",
                                        "com.evermind.net.AddressContainer",
                                        "com.evermind.server.http.EvermindHttpServletRequest"]):

            private static final String VULNERABLE_PARAM = "desname";
            private static final String VULNERABLE_URI = "/reports/rwservlet";
            private static final String[] MALICIOUS_FILE_EXTENSIONS = {".jsp", ".bat", ".sh", ".exe", ".class", ".java", ".so", ".dll"};
            private static final String SAFE_PARAMETER_VALUE = "";
            private static final String SAFE_QUERY_STRING = "";

            public void patch(JavaFrame frame) {
                EvermindHttpServletRequest self = (EvermindHttpServletRequest) frame.loadThisVariable();
                String uri = self.getRequestURI();
                // String.contains() does not exist in Java 1.4
                if (uri == null || uri.toLowerCase().indexOf(VULNERABLE_URI) == -1) {
                    return;
                }

                String query = frame.loadStringOperand(0);
                if (query != null && query.toLowerCase().indexOf(VULNERABLE_PARAM) > -1) {
                    String[] keyValues = query.split("\\+");
                    blockIfMalicious(keyValues, frame, uri);
                    keyValues = query.split("&");
                    blockIfMalicious(keyValues, frame, uri);
                }
            }

            private void blockIfMalicious(String[] keyValues, JavaFrame frame, String uri) {
                if (keyValues == null) {
                    return;
                }

                for (String keyVal : keyValues) {
                    String[] pair = keyVal.split("=");
                    if (pair.length != 2) {
                        continue;
                    }

                    String key = pair[0];
                    String val = pair[1];

                    val = val.toLowerCase();
                    if (VULNERABLE_PARAM.equalsIgnoreCase(key)) {
                        for (String extension : MALICIOUS_FILE_EXTENSIONS) {
                            if (val != null && val.endsWith(extension)) {
                                block(frame, uri, val);
                                return;
                            }
                        }
                    }
                }
            }

            private void block(JavaFrame frame, String uri, String paramValue) {
                ArmrEvent event = ArmrEvent.load("Execute Rule", "high");
                event.addExtension("msg", "An attempt was made to upload a file related to CVE-2012-3152.");
                event.addExtension("servletUri", String.valueOf(uri));
                event.addExtension("paramValue", String.valueOf(paramValue));
                event.addExtension("act", "protect");
                event.commit();
                frame.returnObject(SAFE_QUERY_STRING);
            }
        endcode
    endpatch

endapp

#
# Process forking control for RCE mitigation.
#

app("PROCESS CONTROL"):
    requires(version: "ARMR/1.3")

    ############################################################################
    # Process Control
    #
    # Description:
    #   Executing commands or loading libraries from an untrusted source or in
    #   an untrusted environment can cause an application to execute malicious
    #   commands (and payloads) on behalf of an attacker.
    #       * ProcessBuilder.start() - prevent this method from forking processes.
    #       * Runtime.exec() - prevent all overloaded variants from forking processes.
    #
    # Labels:
    #   CWE-114
    #
    # Mitigation/Remediation Control:
    #   Restrict which executables are allowed to be forked by the JVM by
    #   whitelisting blacklisting the executable name or the full command
    #   line (executable + arguments). The '*' character is treated as a
    #   wildcard and can be used to blacklist/whitelist all executables.
    #   Blacklists and Whitelists can be used at the same time.
    #   Whitelists have precedence.
    ############################################################################

    patch("Process Forking :01"):
       function("java/lang/ProcessBuilder.start()Ljava/lang/Process;")
       entry()

       code(language: java,   import: ["java.io.IOException", "java.util.List"]):
          private static final String[] BLACKLIST = {"*"}; // block and log all executables (except if any have been whitelisted)
//          private static final String[] BLACKLIST = {"cmd", "cmd.exe", "C:\\Windows\\System32\\cmd",
//                 "C:\\Windows\\System32\\cmd.exe", "powershell", "ifconfig"};
          private static final String[] WHITELIST = {""};
//          private static final String[] WHITELIST = {"*"}; // allow and log all executables

          public void patch(JavaFrame frame) {
              ProcessBuilder self = (ProcessBuilder) frame.loadThisVariable();
              List<String> commands = (List<String>) self.command();

              if (commands != null && !commands.isEmpty()) {
                  String command = commands.get(0);
                  if (command == null) {
                      return;
                  }

                  String commandWithArguments = stringJoin(" ", commands);
                  securityCheck(frame, command.trim(), commandWithArguments.trim());
              }
          }

          public static String stringJoin(String separator, List<String> list) {
              if (list == null || list.size() == 0) {
                  return "";
              }
              if (list.size() == 1) {
                  return list.get(0) != null ? list.get(0) : "";
              }
              StringBuffer sb = new StringBuffer(256);
              sb.append(list.get(0));
              for (int i = 1; i < list.size(); i++) {
                  sb.append(separator).append(list.get(i));
              }
              return sb.toString();
          }

          private static void block(JavaFrame frame, String commandWithArguments) {
              ArmrEvent event = ArmrEvent.load("Execute Rule", "high");
              event.addExtension("commandLine", String.valueOf(commandWithArguments));
              event.addExtension("method", "java.lang.ProcessBuilder.start()");
              event.addExtension("msg", "forked OS process");
              event.addExtension("act", "protect");
              event.commit();
              frame.raiseException(new IOException("Operation not allowed"));
          }

          private static void allow(String commandWithArguments) {
              ArmrEvent event = ArmrEvent.load("Execute Rule", "low");
              event.addExtension("commandLine", String.valueOf(commandWithArguments));
              event.addExtension("method", "java.lang.ProcessBuilder.start()");
              event.addExtension("msg", "forked OS process");
              event.addExtension("act", "allow");
              event.commit();
          }

          private static void securityCheck(JavaFrame frame, String command, String commandWithArguments) {
              for (String exec : WHITELIST) {
                  if (exec.equals("*") || command.equalsIgnoreCase(exec)
                          || commandWithArguments.equalsIgnoreCase(exec)) {
                      allow(commandWithArguments);
                      // process is whitelisted, so it has a free pass. No need to do any more blockIfMaliciouss.
                      return;
                  }
              }
              for (String exec : BLACKLIST) {
                  if (exec.equals("*") || command.equalsIgnoreCase(exec)
                          || commandWithArguments.equalsIgnoreCase(exec)) {
                      block(frame, commandWithArguments);
                  }
              }
          }
       endcode
    endpatch

    patch("Process Forking :02"):
       function("java/lang/Runtime.exec(Ljava/lang/String;)Ljava/lang/Process;")
       entry()

       code(language: java,   import: ["java.io.IOException", "java.util.StringTokenizer"]):
          private static final String[] BLACKLIST = {"*"}; // block and log all executables (except if any have been whitelisted)
//          private static final String[] BLACKLIST = {"cmd", "cmd.exe", "C:\\Windows\\System32\\cmd",
//                 "C:\\Windows\\System32\\cmd.exe", "powershell", "ifconfig"};
          private static final String[] WHITELIST = {""};
//          private static final String[] WHITELIST = {"*"}; // allow and log all executables

          public void patch(JavaFrame frame) {
              String commandWithArguments = (String) frame.loadObjectVariable(1);
              if (commandWithArguments != null) {
                  securityCheck(frame, getExecutable(commandWithArguments), commandWithArguments.trim());
              }
          }

          private static String getExecutable(String command) {
               return command.split(" ")[0].trim();
          }

          private static void block(JavaFrame frame, String commandWithArguments) {
              ArmrEvent event = ArmrEvent.load("Execute Rule", "high");
              event.addExtension("commandLine", String.valueOf(commandWithArguments));
              event.addExtension("method", "java.lang.Runtime(java.lang.String)");
              event.addExtension("msg", "forked OS process");
              event.addExtension("act", "protect");
              event.commit();
              frame.raiseException(new IOException("Operation not allowed"));
          }

          private static void allow(String commandWithArguments) {
              ArmrEvent event = ArmrEvent.load("Execute Rule", "low");
              event.addExtension("commandLine", String.valueOf(commandWithArguments));
              event.addExtension("method", "java.lang.Runtime(java.lang.String)");
              event.addExtension("msg", "forked OS process");
              event.addExtension("act", "allow");
              event.commit();
          }

          private static void securityCheck(JavaFrame frame, String command, String commandWithArguments) {
              for (String exec : WHITELIST) {
                  if (exec.equals("*") || command.equalsIgnoreCase(exec)
                          || commandWithArguments.equalsIgnoreCase(exec)) {
                      allow(commandWithArguments);
                      // process is whitelisted, so it has a free pass. No need to do any more blockIfMaliciouss.
                      return;
                  }
              }
              for (String exec : BLACKLIST) {
                  if (exec.equals("*") || command.equalsIgnoreCase(exec)
                          || commandWithArguments.equalsIgnoreCase(exec)) {
                      block(frame, commandWithArguments);
                  }
              }
          }
       endcode
    endpatch

    patch("Process Forking :03"):
       function("java/lang/Runtime.exec([Ljava/lang/String;)Ljava/lang/Process;")
       entry()

       code(language: java,   import: ["java.io.IOException"]):
          private static final String[] BLACKLIST = {"*"}; // block and log all executables (except if any have been whitelisted)
//          private static final String[] BLACKLIST = {"cmd", "cmd.exe", "C:\\Windows\\System32\\cmd",
//                 "C:\\Windows\\System32\\cmd.exe", "powershell", "ifconfig"};
          private static final String[] WHITELIST = {""};
//           private static final String[] WHITELIST = {"*"}; // allow and log all executables

          public void patch(JavaFrame frame) {
              String[] commands = (String[]) frame.loadObjectVariable(1);

              if (commands == null || commands[0] == null) {
                  return;
              }

              String commandWithArguments = stringJoin(" ", commands);
              securityCheck(frame, commands[0].trim(), commandWithArguments.trim());
          }

          public static String stringJoin(String separator, String[] arr) {
              if (arr == null || arr.length == 0) {
                  return "";
              }
              if (arr.length == 1) {
                  return arr[0] != null ? arr[0] : "";
              }
              StringBuffer sb = new StringBuffer(256);
              sb.append(arr[0]);
              for (int i = 1; i < arr.length; i++) {
                  sb.append(separator).append(arr[i]);
              }
              return sb.toString();
          }

          private static void block(JavaFrame frame, String commandWithArguments) {
              ArmrEvent event = ArmrEvent.load("Execute Rule", "high");
              event.addExtension("commandLine", String.valueOf(commandWithArguments));
              event.addExtension("method", "java.lang.Runtime(java.lang.String[])");
              event.addExtension("msg", "forked OS process");
              event.addExtension("act", "protect");
              event.commit();
              frame.raiseException(new IOException("Operation not allowed"));
          }

          private static void allow(String commandWithArguments) {
              ArmrEvent event = ArmrEvent.load("Execute Rule", "low");
              event.addExtension("commandLine", String.valueOf(commandWithArguments));
              event.addExtension("method", "java.lang.Runtime(java.lang.String[])");
              event.addExtension("msg", "forked OS process");
              event.addExtension("act", "allow");
              event.commit();
          }

          private static void securityCheck(JavaFrame frame, String command, String commandWithArguments) {
              for (String exec : WHITELIST) {
                  if (exec.equals("*") || command.equalsIgnoreCase(exec)
                          || commandWithArguments.equalsIgnoreCase(exec)) {
                      allow(commandWithArguments);
                      // process is whitelisted, so it has a free pass. No need to do any more blockIfMaliciouss.
                      return;
                  }
              }
              for (String exec : BLACKLIST) {
                  if (exec.equals("*") || command.equalsIgnoreCase(exec)
                          || commandWithArguments.equalsIgnoreCase(exec)) {
                      block(frame, commandWithArguments);
                  }
              }
          }
       endcode
    endpatch

    patch("Process Forking :04"):
       function("java/lang/Runtime.exec([Ljava/lang/String;[Ljava/lang/String;)Ljava/lang/Process;")
       entry()

       code(language: java,   import: ["java.io.IOException"]):
          private static final String[] BLACKLIST = {"*"}; // block and log all executables (except if any have been whitelisted)
//          private static final String[] BLACKLIST = {"cmd", "cmd.exe", "C:\\Windows\\System32\\cmd",
//                 "C:\\Windows\\System32\\cmd.exe", "powershell", "ifconfig"};
          private static final String[] WHITELIST = {""};
//           private static final String[] WHITELIST = {"*"}; // allow and log all executables

          public void patch(JavaFrame frame) {
              String[] commands = (String[]) frame.loadObjectVariable(1);

              if (commands == null || commands[0] == null) {
                  return;
              }

              String commandWithArguments = stringJoin(" ", commands);
              securityCheck(frame, commands[0].trim(), commandWithArguments.trim());
          }

          public static String stringJoin(String separator, String[] arr) {
              if (arr == null || arr.length == 0) {
                  return "";
              }
              if (arr.length == 1) {
                  return arr[0] != null ? arr[0] : "";
              }
              StringBuffer sb = new StringBuffer(256);
              sb.append(arr[0]);
              for (int i = 1; i < arr.length; i++) {
                  sb.append(separator).append(arr[i]);
              }
              return sb.toString();
          }

          private static void block(JavaFrame frame, String commandWithArguments) {
              ArmrEvent event = ArmrEvent.load("Execute Rule", "high");
              event.addExtension("commandLine", String.valueOf(commandWithArguments));
              event.addExtension("method", "java.lang.Runtime(java.lang.String[], java.lang.String[])");
              event.addExtension("msg", "forked OS process");
              event.addExtension("act", "protect");
              event.commit();
              frame.raiseException(new IOException("Operation not allowed"));
          }

          private static void allow(String commandWithArguments) {
              ArmrEvent event = ArmrEvent.load("Execute Rule", "low");
              event.addExtension("commandLine", String.valueOf(commandWithArguments));
              event.addExtension("method", "java.lang.Runtime(java.lang.String[], java.lang.String[])");
              event.addExtension("msg", "forked OS process");
              event.addExtension("act", "allow");
              event.commit();
          }

          private static void securityCheck(JavaFrame frame, String command, String commandWithArguments) {
              for (String exec : WHITELIST) {
                  if (exec.equals("*") || command.equalsIgnoreCase(exec)
                          || commandWithArguments.equalsIgnoreCase(exec)) {
                      allow(commandWithArguments);
                      // process is whitelisted, so it has a free pass. No need to do any more blockIfMaliciouss.
                      return;
                  }
              }
              for (String exec : BLACKLIST) {
                  if (exec.equals("*") || command.equalsIgnoreCase(exec)
                          || commandWithArguments.equalsIgnoreCase(exec)) {
                      block(frame, commandWithArguments);
                  }
              }
          }
       endcode
    endpatch

    patch("Process Forking :05"):
       function("java/lang/Runtime.exec([Ljava/lang/String;[Ljava/lang/String;Ljava/io/File;)Ljava/lang/Process;")
       entry()

       code(language: java,   import: ["java.io.IOException"]):
          private static final String[] BLACKLIST = {"*"}; // block and log all executables (except if any have been whitelisted)
//          private static final String[] BLACKLIST = {"cmd", "cmd.exe", "C:\\Windows\\System32\\cmd",
//                 "C:\\Windows\\System32\\cmd.exe", "powershell", "ifconfig"};
          private static final String[] WHITELIST = {""};
//           private static final String[] WHITELIST = {"*"}; // allow and log all executables

          public void patch(JavaFrame frame) {
              String[] commands = (String[]) frame.loadObjectVariable(1);

              if (commands == null || commands[0] == null) {
                  return;
              }
              String commandWithArguments = stringJoin(" ", commands);
              securityCheck(frame, commands[0].trim(), commandWithArguments.trim());
          }

          public static String stringJoin(String separator, String[] arr) {
              if (arr == null || arr.length == 0) {
                  return "";
              }
              if (arr.length == 1) {
                  return arr[0] != null ? arr[0] : "";
              }
              StringBuffer sb = new StringBuffer(256);
              sb.append(arr[0]);
              for (int i = 1; i < arr.length; i++) {
                  sb.append(separator).append(arr[i]);
              }
              return sb.toString();
          }

          private static void block(JavaFrame frame, String commandWithArguments) {
              ArmrEvent event = ArmrEvent.load("Execute Rule", "high");
              event.addExtension("commandLine", String.valueOf(commandWithArguments));
              event.addExtension("method", "java.lang.Runtime(java.lang.String[], java.lang.String[], java.io.File)");
              event.addExtension("msg", "forked OS process");
              event.addExtension("act", "protect");
              event.commit();
              frame.raiseException(new IOException("Operation not allowed"));
          }

          private static void allow(String commandWithArguments) {
              ArmrEvent event = ArmrEvent.load("Execute Rule", "low");
              event.addExtension("commandLine", String.valueOf(commandWithArguments));
              event.addExtension("method", "java.lang.Runtime(java.lang.String[], java.lang.String[], java.io.File)");
              event.addExtension("msg", "forked OS process");
              event.addExtension("act", "allow");
              event.commit();
          }

          private static void securityCheck(JavaFrame frame, String command, String commandWithArguments) {
              for (String exec : WHITELIST) {
                  if (exec.equals("*") || command.equalsIgnoreCase(exec)
                          || commandWithArguments.equalsIgnoreCase(exec)) {
                      allow(commandWithArguments);
                      // process is whitelisted, so it has a free pass. No need to do any more blockIfMaliciouss.
                      return;
                  }
              }
              for (String exec : BLACKLIST) {
                  if (exec.equals("*") || command.equalsIgnoreCase(exec)
                          || commandWithArguments.equalsIgnoreCase(exec)) {
                      block(frame, commandWithArguments);
                  }
              }
          }
       endcode
    endpatch

endapp

CVSS

6.4 v2.0 AV:N/AC:L/Au:N/C:P/I:P/A:N 1 metric

VRT selects the newest version's highest entry and publishes it as cvssScore, newest rather than largest because scores are not comparable across versions, and highest rather than first because the first entry is frequently a CNA placeholder scoring 0.0 over NVD's own analysis.

VersionScoreBandVectorAssignerType
CVSS 2.0 6.4 no band published AV:N/AC:L/Au:N/C:P/I:P/A:N NVD Primary published

Affected Software & Releases

🏛️ Oracle CPU Advisories & Products

AdvisoryTypeQuarterProducts Oracle named in risk matrix
Oracle Critical Patch Update October 2012 ↗ CPU 2012-Q4 Oracle Fusion Middleware / Servlet (11.1.1.4, 11.1.1.6, 11.1.2.0)

Indexed Oracle Components & Versions

FamilyComponentOracle's version cell (verbatim)Indexed as
Oracle Fusion Middleware Servlet 11.1.1.4, 11.1.1.6, 11.1.2.0 11.1.1.4 · 11.1.1.6 · 11.1.2.0

🖥️ Product CPEs & Version Ranges

1 product(s) over 3 version claims (uncapped)
SourceVendorProductSchemeAffected Versions
nvd oracle fusion middleware generic 11.1.1.4.0 · 11.1.1.6.0 · 11.1.2.0

References

URLTags
http://blog.netinfiltration.com/2013/11/03/oracle-reports-cve-2012-3152-and-cve-2012-3153/
http://blog.netinfiltration.com/2014/01/19/upcoming-exploit-release-oracle-forms-and-reports-11g/
http://seclists.org/fulldisclosure/2014/Jan/186
http://www.exploit-db.com/exploits/31253
http://www.mandriva.com/security/advisories?name=MDVSA-2013:150
http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html Patch, Vendor Advisory
http://www.securityfocus.com/bid/55961
https://exchange.xforce.ibmcloud.com/vulnerabilities/79296

Timeline

Published 2012-10-16 Last modified 2026-06-16
Published2012-10-16By the CVE Program.
ARMR remediation created2020-06-25Earliest commit adding this CVE's ARMR patch or security rule.
ARMR remediation last updated2026-03-04Most recent commit touching this CVE's ARMR patch or security rule.
Last VRT activity2026-03-04Most recent commit touching this CVE's classification, patch or rule file.
NVD record modified2026-06-16NVD's own last-modified date for this record.