Forest Global Training Partners

Cyber Risks · Krebs on Security

Zero-Day Java Exploit Debuts in Crimeware

Summary: The authors of the Blackhole and Nuclear Pack crimeware kits announced on Underweb forums that they had added an exploit for a previously unknown, unpatched Java vulnerability, with Blackhole's curator 'Paunch' calling it a 'New Year's Gift' to customers. Both authors said the flaw exists in all versions of Java 7, including Java 7 Update 10, and Alienvault Labs later reported reproducing the exploit, tracked as CVE-2013-0422, in fully patched Java 7.

Bottom line: A working zero-day was being sold through commodity exploit kits before Oracle had a patch, and DHS's U.S.-CERT was recommending users unplug Java from the browser - a step some organizations, such as Denmark's NemID single sign-on used by 95% of its banks, said they could not take.

Read the original at Krebs on Security ↗

Topics
Vulnerabilities & Patching
Mentions
CVE-2013-0422
Related
CVE-2013-0422: Oracle JRE Remote Code Execution Vulnerability Known Exploited Vulnerabilities · May 25, 2022