New Java Exploit to Debut in Black Hole Exploit Kits

Summary: Malicious code exploiting a newly patched Java flaw, CVE-2012-1723, was set to be added to the BlackHole exploit pack in a July 8 software update for paying and licensed users, according to the pack's author. The bug was fixed in Java 6 Update 33 and Java 7 Update 5, and more than 3 billion devices run Java, many with installations months out of date.
What's compelling: A single exploit added to a widely licensed crime kit can reach every under-patched Java install on the network, and Krebs notes the malicious .jar found at one financial firm was detected by just one antivirus product.

Read the original at Krebs on Security ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2012-1723
Related: CVE-2012-1723: Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability Known Exploited Vulnerabilities · Mar 03, 2022
Continued analysis of the Lights Out Exploit Kit Cyber Risks ·
The never ending Exploit Kit shift - Bleeding Life Cyber Risks ·