CVE-2012
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2012-1723 | Remote Arbitrary Code Execution in Oracle Java SE (Hotspot Component) Oracle Java SE's Java Runtime Environment contains an unspecified flaw in its Hotspot component that allows remote attackers to affect confidentiality, integrity, and availability — characterized by CISA as arbitrary code execution. The available data does not document the exact trigger beyond 'unknown vectors related to Hotspot,' but flaws in the JVM's execution engine of this type are typically reached remotely by having the runtime process malicious Java content. A successful attacker gains code execution in the context of the process running the JVM, taking control of the affected host. Any deployment running affected, unpatched Oracle Java SE — particularly legacy JRE installs — is affected. The vulnerability is in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-03) with known ransomware use and a 93.7% EPSS probability of exploitation in the next 30 days, confirming active in-the-wild exploitation, though the reviewed data lists no public PoC. Do: Per CISA's required action, apply updates per vendor instructions: upgrade every Oracle Java SE installation to a currently supported patched release and inventory for legacy JRE builds that predate the 2012 Hotspot fix. Disable or restrict the Java browser plugin where it is not needed, and given known ransomware use, prioritize legacy Java systems for patching and threat-hunting. | — | 94% | KEV ransomware |
| mass≈ millions of endpoints running legacy, unpatched Java (exact count unknown) |
Full article286 words · extracted from blog.talosintelligence.com · click to collapse
Monday, July 9, 2012 14:51
Word began to emerge last week of the addition of a new vulnerability to the Blackhole Exploit Kit. The bug in question - CVE-2012-1723 - is a complex Java issue, which thankfully has patches available from Oracle already. Of course, just because a patch is available doesn't mean it's been applied - most exploit kits thrive off of reliable exploits of bugs that are often two or more years old - so adding a new, current attack to the Blackhole arsenal will only make it that much more dangerous. Since there are now public writeups, including proof-of-concept exploits, this bug is likely to be a pain in defenders' sides even outside the context of Blackhole.
Like so many other attacks we see these days, we've seen a sample that came in via a reasonably well-done LinkedIn phish:
The new exploit was actually the third attack delivered after the initial landing page was hit - malicious Flash and PDF files came first - but it was very clear based on the nature of the code that came down and the name observed in the request ("soo.jar", which lines up with what other researchers have seen) that this was the new Java exploit in the wild.
The good news is that the initial exploits that have been released make use of some very odd strings, particularly around file names encoded inside the JAR file. This means that the VRT has very reliable detection of all variants that we've observed in the wild (use SIDs 23273 - 23277). We'll be monitoring this exploit closely, as well as the Blackhole Exploit Kit itself, to watch for updated obfuscations, and will update detection as necessary.
Text extracted automatically; images, tables and formatting may be missing. Original: https://blog.talosintelligence.com/cve-2012-1723-new-java-attack-added-to/