Detecting And Removing Vulnerable Java Versions

snoopy · Aug 30, 2012

Took the test ... I am not vulnerable. yeaaaaay!!

Tuesday, August 28, 2012
Detecting and Removing Vulnerable Java Versions

As attacks on the new Java zero-day vulnerability continue and researchers look for ways to mitigate the flaw, they are encouraging users to disable Java in their browsers. There is now a site that users can visit that will detect whether their browser is running a vulnerable version of Java.

Security vendor Rapid 7 has set up a site that will detect the version of Java that is running in the user's browser and tell her whether it contains the newly discovered Java vulnerability. The flaw is in Java 7 and researchers have found ongoing attacks in the wild targeting the vulnerability. The attacks are in the form of drive-by downloads right now, with successful exploitation leading to the installation of the Poison Ivy remote-access tool on compromised machines. Poison Ivy is a well-known RAT and has been used in a number of attacks in recent years.

Java has become a major target for attackers in the last few years, as it offers a number of things that appeal to them: wide deployment, a long update cycle and lots of readily available bugs. Java vulnerabilities often are included in exploit packs and tend to be used in the kind of drive-by download attacks that often ensnare unsuspecting users.
Click to expand...

More here - https://threatpost.c...versions-082812

snoopy · Aug 30, 2012

Java Runtime Environment 1.7 Zero-Day Exploit Delivers Backdoor
Aug. 28 - 10:02 am (UTC-7) | by Manuel Gatbunton (Threat Response Engineer)

An unpatched JRE 1.7/Java 7 zero-day vulnerability (CVE-2012-4681) was recently found to be exploited by a malicious .JAR file hosted on a specific site. Successful exploit leads to the download of a backdoor, in effect allowing remote malicious users to execute their desired commands on the vulnerable system.

The zero-day exploit successfully runs in all versions of Internet Explorer, Firefox and Opera. According to a testing done by Metasploit, the vulnerability also runs on Google Chrome and Safari.

Technical Analysis of the Exploit and Payload

The affected vulnerability is related to the new Java 7 classcom.sun.beans.finder.ClassFinder that allows the sun.awt.SunToolkit class to load, modify and execute the malicious code. This threat is composed of an HTML page with malicious Javascript (index.html detected as JS_FIEROPS.A), a Java applet (applet.java detected as JAVA_GONDY.A), and the malicious binary (FLASH_UPDATE.exe detected as BKDR_POISON.BLW).

Users may encounter this threat by visiting a site, one of which is http://www.{BLOCKED}s.com/public/meeting/index.html, which results to the downloading and loading of the malicious Java applet (JAVA_GONDY.A). It then passes some parameters, which is then used to download BKDR_POISON.BLW.
Click to expand...

Read more here plus screenshot: http://blog.trendmicro.com/

snoopy · Aug 30, 2012

Wednesday, August 29, 2012 Around the Web
Chorus Grows Louder to Disable Java 7 After Exploit Hits Mainstream

More security researchers are recommending users disable the current version of Java after zero-day exploits gained traction in the Web world.

Patrick Runald, director of security research for Websense, told PC World today that his team had uncovered more than 100 infected domains - a figure expected to rise sharply after the exploit code for the Java vulnerabilities was added in recent days to the popular hacker tool Blackhole.

The original attack, believed to be based in China, is based on two vulnerabilities in one .jar file in Java 7. Because of Java's ubiquitousness within Web sites, and Oracle's failure to date to release a patch out of its normal quarterly rotation, companies this week began recommending users disable Java browser plugins to help prevent the malicious code from entering machines through compromised Web sites.

"The beauty of this bug class is that it provides 100 percent reliability and is multiplatform. Hence this will shortly become the penetration test Swiss knife for the next couple of years (as did its older brother CVE-2008-5353)," wrote an Immunity developer Esteban Guillardoy earlier this week.

Click to expand...

story - https://threatpost.com/en_us/blogs/chorus-grows-louder-disable-java-7-after-exploit-hits-mainstream-082912

Log in or Sign up

Detecting And Removing Vulnerable Java Versions

snoopy Registered Members

snoopy Registered Members

snoopy Registered Members

Share This Page

Log in or Sign up

Detecting And Removing Vulnerable Java Versions

snoopy Registered Members

snoopy Registered Members

snoopy Registered Members

Share This Page

Useful Searches