Attackers Pounce on Zero-Day Java Exploit
Summary: Attackers exploited CVE-2012-4681, a previously unknown flaw in Oracle's Java 7 affecting Updates 0 through 6 but not Java 6 and below, with FireEye first reporting it and researchers Andre M. DiMino and Mila Parkour confirming the affected versions. The exploit code is now public and being added to Metasploit and the BlackHole exploit kit, whose author said privately such an exploit would sell for about $100,000, while Oracle's next scheduled Java security update is not until October.
Key Takeaway: The BlackHole author planned to fold the public exploit into his kit as early as the day he was interviewed, meaning the window between disclosure and mass exploitation was measured in hours, not Oracle's months until the October patch.
Read the original at Krebs on Security ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2012-4681
- Related
- CVE-2012-4681: bypassing built-in java security Cyber Risks ·Internet Explorer use-after-free 0-Day vulnerability Cyber Risks ·CVE-2012-4681: Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability Known Exploited Vulnerabilities · Mar 03, 2022