8000539: JMX implementation allows invocation of methods of a system class

Summary: Added extra packageAccess check call
Reviewed-by: ahgross, dfuchs
Contributed-by: jaroslav.bachorik@oracle.com

src/share/classes/com/sun/jmx/mbeanserver/Introspector.java

@@ -56,6 +56,8 @@ import java.lang.reflect.Array;
 import java.lang.reflect.InvocationTargetException;
 import javax.management.AttributeNotFoundException;
 import javax.management.openmbean.CompositeData;
+import sun.reflect.misc.MethodUtil;
+import sun.reflect.misc.ReflectUtil;
 
 /**
  * This class contains the methods for performing all the tests needed to verify
@@ -528,8 +530,10 @@ public class Introspector {
                     // to locate method
                     readMethod = SimpleIntrospector.getReadMethod(clazz, element);
                 }
-                if (readMethod != null)
-                    return readMethod.invoke(complex);
+                if (readMethod != null) {
+                    ReflectUtil.checkPackageAccess(readMethod.getDeclaringClass());
+                    return MethodUtil.invoke(readMethod, complex, new Class[0]);
+                }
 
                 throw new AttributeNotFoundException(
                     "Could not find the getter method for the property " +