Oracle Java SE Rhino Script Engine Sandbox Escape (CVE-2011-3544)

# Check-CVE-2011-3544.ps1
# Detects Oracle JRE/JDK <= 6u27 or 7 GA (CVE-2011-3544 / Rhino sandbox escape)
# Output: VULNERABLE | PATCHED | UNKNOWN

$ErrorActionPreference = 'SilentlyContinue'
$found = @()

$uninstallKeys = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
)

foreach ($k in $uninstallKeys) {
    Get-ItemProperty $k | Where-Object {
        $_.DisplayName -match 'Java(\(TM\))?\s*(SE\s*)?(Runtime Environment|Development Kit)' -or
        $_.Publisher -match 'Oracle|Sun Microsystems'
    } | ForEach-Object {
        $found += [PSCustomObject]@{
            Name    = $_.DisplayName
            Version = $_.DisplayVersion
            Path    = $_.InstallLocation
        }
    }
}

if (-not $found) {
    Write-Output 'UNKNOWN: no Oracle Java install detected'
    exit 2
}

$vulnerable = $false
foreach ($j in $found) {
    $v = $j.Version
    # Match patterns like 6.0.270, 1.6.0_27, 7.0.0
    if ($v -match '^(1\.)?6.*?(_| )(\d{1,2})$') {
        $upd = [int]$Matches[3]
        if ($upd -le 27) { $vulnerable = $true; Write-Output ("VULNERABLE: {0} {1}" -f $j.Name,$v) }
    }
    elseif ($v -match '^(1\.)?7\.0[\._ ]0?$' -or $v -eq '7.0.0' -or $v -match '^7\s*$') {
        $vulnerable = $true
        Write-Output ("VULNERABLE: {0} {1}" -f $j.Name,$v)
    }
    else {
        Write-Output ("PATCHED-or-newer: {0} {1}" -f $j.Name,$v)
    }
}

if ($vulnerable) { exit 1 } else { exit 0 }