Researchers: Java Zero-Day Leveraged Two Flaws
Summary: Analysis of a Java zero-day exploit that surfaced in August 2012 found it used two previously unknown vulnerabilities, with the underlying flaw present since July 28, 2011. Secunia's sampling of 10,000 users found 34.2 percent had a vulnerable Java 7 version installed, suggesting more than a billion devices could be exposed, and the exploit worked against browsers on Windows, Safari on OS X 10.7.4, and Firefox on Ubuntu Linux 10.04.
What's compelling: The BlackHole exploit kit author said the leaked exploit would fetch at least $100,000 in the criminal underground, and AlienVault found strings and a control server (domain.rm6.org) tying the initial attacks to Chinese espionage campaigns like the 2011 Nitro attacks against at least 48 chemical and defense companies.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2008-5353CVE-2012-4681
- Related
- CVE-2012-4681: Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability Known Exploited Vulnerabilities · Mar 03, 2022Apple Releases Fix for Critical Java Flaw Cyber Risks ·CVE-2012-4681: bypassing built-in java security Cyber Risks ·