Attacks/Breaches
1/16/2013
12:06 PM
50%
50%

Another Java Zero-Day Vulnerability Hits Black Market

Just 24 hours after Oracle patched two critical flaws in Java, online vulnerability vendor starts selling never-seen Java bug.

Call it malware cash and carry: Less than 24 hours after Oracle Sunday released a security update that addresses two critical zero-day vulnerabilities in Java that are being actively exploited by attackers, an online vulnerability seller began offering a brand-new Java bug for sale.

"On Monday, an administrator of an exclusive cybercrime forum posted a message saying he was selling a new Java 0day to a lucky two buyers. The cost: starting at $5,000 each," said security reporter Brian Krebs, who was the first to report the vulnerability sales offer.

What does a starting price of $5,000 buy? "The hacker forum admin's message ... promised weaponized and source code versions of the exploit. This seller also said his Java 0day -- in the latest version of Java (Java 7 Update 11) -- was not yet part of any exploit kits," said Krebs.

[ Does your business depend on Java? Here's how to stay secure. 10 Facts: Secure Java For Business Use. ]

But the new zero-day vulnerability was apparently already in at least one attacker's hands. "Code will be sold twice (it has been sold once already). It is not present in any known exploit pack including that very private version of [Blackhole] going for 10$k/month," read the notice, referring to the Cool Exploit Kit that was created by the developers of the Blackhole crimeware kit, which rents for $10,000 per month. "I will be accepting counter-bids if you wish to outbid the competition."

According to the sales notice, the zero-day vulnerability is ready to be used and includes support via personal message (PM) -- presumably via the hacking forum's chat system. "Simply modify the url in the php page that calls up the jar to your own executable url and you are set," read the hacker forum administrator's message. "You may pm me."

Krebs said on Wednesday that the hacking forum thread with the admin's zero-day vulnerability sales pitch has since been deleted, suggesting that the exploit has now been sold to a second buyer.

News that there's yet another zero-day Java vulnerability should lead businesses to ask whether running the Java browser plug-in, or using Java runtime environments to run enterprise applications, is worth the security risk.

Indeed, the two zero-day vulnerabilities spotted last week and patched on Sunday led the Department of Homeland security to warn that the Java browser plug-in should be avoided, if at all possible. If that's not feasible, security experts recommend locking down Java use to minimize the chance that a business will get exploited via some future zero-day vulnerability.

The slow speed with which Oracle patches Java vulnerabilities has also drawn criticism from security experts. Furthermore, some of Oracle's Java patching has been sloppy and has not fully addressed flaws being actively exploited by attackers. For example, while Oracle's Sunday patch fixed one of the two zero-day flaws being actively exploited in Java 7 by attackers, Oracle left the other flaw unpatched, though it used a change in security permissions to make the flaw more difficult for attackers to access.

The worry now is that attackers will be able to use a future zero-day vulnerability -- or perhaps the one that's now being offered for sale -- to access the vulnerability that was spotted last week and that remains unpatched. If exploited, that bug would enable an attacker to execute arbitrary code on a machine. As a result, the attacker could not only compromise the machine, but also steal any data on the device, and turn it into a node -- or zombie PC -- that's part of a larger, attacker-operated botnet.

In light of the vulnerability that wasn't fully addressed by Oracle's rush-patching job, "The message is clear: Java remains a big risk," said Trend Micro vulnerability research manager Pawan Kinger in a blog post.

Your employees are a critical part of your security program, particularly when it comes to the endpoint. Whether it's a PC, smartphone or tablet, your end users are on the front lines of phishing attempts and malware attacks. Read our Security: Get Users To Care report to find out how to keep your company safe. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
AnonDeGuerre
50%
50%
AnonDeGuerre,
User Rank: Apprentice
1/16/2013 | 8:02:47 PM
re: Another Java Zero-Day Vulnerability Hits Black Market
delete
safetysw
50%
50%
safetysw,
User Rank: Apprentice
1/16/2013 | 8:26:43 PM
re: Another Java Zero-Day Vulnerability Hits Black Market
Just another reason to never use Java for anything that needs to be safe and/or secure. Not enough thought and care is taken when designing code in any language and starting with a language that while extremely useful but is fundamentally flawed only makes matters worse!
Verdumont Monte
50%
50%
Verdumont Monte,
User Rank: Apprentice
1/16/2013 | 9:10:56 PM
re: Another Java Zero-Day Vulnerability Hits Black Market
If WebEx and GoToMeeting didn't need Java, I wouldn't have installed in the first place.. I've found that you can install their client and that lets you to do away with Java.. Good bye Java.. I have enough to worry about..
Sinn
50%
50%
Sinn,
User Rank: Apprentice
1/19/2013 | 10:18:34 AM
re: Another Java Zero-Day Vulnerability Hits Black Market
So, not only will productivity be compromised, there will be no more playing of favorite games either, eh?
KeyWestDan
50%
50%
KeyWestDan,
User Rank: Apprentice
1/19/2013 | 7:35:45 PM
re: Another Java Zero-Day Vulnerability Hits Black Market
At least the price will keep the kiddies and most hackers away. You'd have to be a serious criminal (or a foreign government) to plunk down that kind of money to exploit some hole in java that is going to be fixed fairly promptly.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6501
Published: 2015-03-30
The default soap.wsdl_cache_dir setting in (1) php.ini-production and (2) php.ini-development in PHP through 5.6.7 specifies the /tmp directory, which makes it easier for local users to conduct WSDL injection attacks by creating a file under /tmp with a predictable filename that is used by the get_s...

CVE-2014-9652
Published: 2015-03-30
The mconvert function in softmagic.c in file before 5.21, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not properly handle a certain string-length field during a copy of a truncated version of a Pascal string, which might allow remote atta...

CVE-2014-9653
Published: 2015-03-30
readelf.c in file before 5.22, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not consider that pread calls sometimes read only a subset of the available data, which allows remote attackers to cause a denial of service (uninitialized memory ...

CVE-2014-9705
Published: 2015-03-30
Heap-based buffer overflow in the enchant_broker_request_dict function in ext/enchant/enchant.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allows remote attackers to execute arbitrary code via vectors that trigger creation of multiple dictionaries.

CVE-2014-9709
Published: 2015-03-30
The GetCode_ function in gd_gif_in.c in GD 2.1.1 and earlier, as used in PHP before 5.5.21 and 5.6.x before 5.6.5, allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted GIF image that is improperly handled by the gdImageCreateFromGif function.

Dark Reading Radio
Archived Dark Reading Radio
Good hackers--aka security researchers--are worried about the possible legal and professional ramifications of President Obama's new proposed crackdown on cyber criminals.