Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

Java Zero Day Attack: Second Bug Found

Were security researchers irresponsible to detail the zero-day vulnerabilities without first working with Oracle to craft a patch?

Oracle Brings High-Tech To The High Seas
Oracle Brings High-Tech To The High Seas
(click image for larger view and for slideshow)
The zero-day Java attack recently discovered by security researchers, which appears to have been launched from China, is more complex than previously thought.

While researchers had identified a Java 7 security-settings bug exploited in the attack, they've since found that it's chained together with a second vulnerability. "Most of the online analysis talks about one vulnerability, where we saw two vulnerabilities being exploited to achieve full execution on a target," according to a blog post from Esteban Guillardoy, who's a Python developer and security researcher working for information security firm Immunity.

"The first bug was used to get a reference to sun.awt.SunToolkit class that is restricted to applets, while the second bug invokes the getField public static method on SunToolkit using reflection, with a trusted immediate caller bypassing a security check." He said the two bugs had to be chained together to create a working exploit. He also noted that the "getField" Java bug was introduced with Java 7.0-- which debuted on July 28, 2011--and suggested that a foreign nation state, or states, may have been "enjoying it non-stop for quite some time now."

"The beauty of this bug class is that it provides 100% reliability and is multiplatform," he said. "Hence this will shortly become the penetration test Swiss knife for the next couple of years."

[ Could an international 'cyber arms' agreement forestall U.S. cyber warfare with China and other countries? See The Case For A Cyber Arms Treaty. ]

Researchers said the related zero-day attack appears to have been launched from servers in China, and that it's being used to deliver the Poison Ivy remote-access toolkit (RAT) onto infected systems. According to a heatmap of related Poison Ivy infections released by Kaspersky Lab, the greatest number of related infections have been seen in China, followed by Russia.

The discovery of the Java 7 vulnerabilities has led numerous security experts to recommend that enterprises disable Java in browsers. US-CERT Tuesday released a security alert noting that "disabling the Java browser plug-in may prevent a malicious webpage from exploiting this vulnerability." In addition, for Firefox users, it said that "using the ... NoScript extension to whitelist websites that can run scripts and access installed plug-ins will mitigate this vulnerability."

Users of systems targeted by the exploit likely wouldn't notice the attack. "It does not crash browsers, the landing page looks like a blank page, sometimes one may see a flash of a rotating Java logo and the word 'Loading,'" according to an analysis published by Andre' M. DiMino and Mila Parkour at DeepEnd Research.

To help identify vulnerable systems, both Rapid7 and Zscaler are offering free online tools which will review a user's system for the presence of vulnerable Java code. Zscaler also offers a guide to disabling Java in Chrome, Firefox, and Internet Explorer. While the vulnerability affects Windows, Apple OS X, and Linux systems, most Mac users will be protected, since Java 6--not Java 7--is installed on OS X by default, although Java 7 can be added manually.

Oracle releases patches on a quarterly cycle, and its next bug fix isn't due until October. But DeepEnd Research Tuesday began offering its own patch for the vulnerability, though it must be requested directly from the company, which said it's restricting distribution "not to preserve the code but limit it to IT administrators and developers who can test and decide if they want to deploy." In other words, it's a temporary fix, and may break existing systems. "We do not want to push/offer it to 3 billion end Java users, it wasn't tested in all the possible scenarios and systems," said DiMino and Parkour in a blog post.

In addition, DeepEnd said it will share a "commented and stripped-down version of the exploit source, to be run from the command line with a security manager enabled," as well as a copy of the original zero-day attack HTML page--including JavaScript, the Java applet, a copy of the Poison Ivy RAT, and pcap--upon request, provided requesters offer a valid reason for seeing the proof-of-concept (PoC) code.

Whoever built this zero-day attack was extremely skilled in Java programming. "At this moment exploiting [these] vulnerabilities is not hard, in fact the PoC that was released is almost a fully working exploit and with a just few changes, setting a different payload instead of popping up a calculator, you have everything you need," Guillardoy told Threatpost. "However finding these vulnerabilities and [using] them in a useful way is a much harder task that requires a wide knowledge of the Java JDK/JRE codebase and deep understanding of the Java security architecture."

But FireEye's initial disclosure of the zero-day attack, followed by detailed analyses from other researchers, has led to criticism that the exploit was irresponsibly disclosed. "The Java 0day activity that we have been monitoring and preventing for almost the past week has been irresponsibly reported on other blogs, with early posts publicly linking to known sites serving the 0day," said Kurt Baumgartner, a security researcher at Kaspersky Lab, in a blog post.

"Would you encourage folks to walk down a mugger's dark alley with no protection or would you work to communicate the muggers' whereabouts to the right folks and work on lighting the alley or giving better directions? Would you provide muggers with some new weapons that they haven't considered? The efforts this time around seem misplaced," he said.

On the other hand, the bug was already being actively exploited by attackers, and researchers reported that numerous antivirus tools--including from McAfee and Symantec--weren't spotting or stopping the threat. Accordingly, did Kaspersky err by spotting the vulnerability, but failing to disclose it publicly?

Cybercriminals are taking aim at your website. Is your security strategy up to the challenge? Also in the new, all-digital 10 Steps To E-Commerce Security special issue of Dark Reading: About half of the traffic to e-commerce sites is machine generated--and much of it is malicious. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Mathew
50%
50%
Mathew,
User Rank: Apprentice
8/31/2012 | 11:05:23 AM
re: Java Zero Day Attack: Second Bug Found
Yes, if there's an in-the-wild attack already exploiting the vulnerability, it seems like the cat's already out of the bag. Interesting that after knowing about the vulnerability for four months, it took Oracle just four days to release an emergency patch after FireEye publicized the related attack.
--MJS
MLIBEN076
50%
50%
MLIBEN076,
User Rank: Apprentice
8/30/2012 | 8:44:42 PM
re: Java Zero Day Attack: Second Bug Found
Since this was known to be an actively exploited vulnerability, there was no harm in disclosure. We all learned long ago that security by obscurity is no security at all. I'd be inclined to believe Kaspersky was keeping quiet in the hopes of gaining a competitive advantage and putting their own interests above their customers and the community at large.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/23/2020
Russian Military Officers Unmasked, Indicted for High-Profile Cyberattack Campaigns
Kelly Jackson Higgins, Executive Editor at Dark Reading,  10/19/2020
Modern Day Insider Threat: Network Bugs That Are Stealing Your Data
David Pearson, Principal Threat Researcher,  10/21/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-27187
PUBLISHED: 2020-10-26
An issue was discovered in KDE Partition Manager 4.1.0 before 4.2.0. The kpmcore_externalcommand helper contains a logic flaw in which the service invoking D-Bus is not properly checked. An attacker on the local machine can replace /etc/fstab, and execute mount and other partitioning related command...
CVE-2020-7752
PUBLISHED: 2020-10-26
This affects the package systeminformation before 4.27.11. This package is vulnerable to Command Injection. The attacker can concatenate curl's parameters to overwrite Javascript files and then execute any OS commands.
CVE-2020-7127
PUBLISHED: 2020-10-26
A remote unauthenticated arbitrary code execution vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.
CVE-2020-7196
PUBLISHED: 2020-10-26
The HPE BlueData EPIC Software Platform version 4.0 and HPE Ezmeral Container Platform 5.0 use an insecure method of handling sensitive Kerberos passwords that is susceptible to unauthorized interception and/or retrieval. Specifically, they display the kdc_admin_password in the source file of the ur...
CVE-2020-7197
PUBLISHED: 2020-10-26
SSMC3.7.0.0 is vulnerable to remote authentication bypass. HPE StoreServ Management Console (SSMC) 3.7.0.0 is an off node multiarray manager web application and remains isolated from data on the managed arrays. HPE has provided an update to HPE StoreServ Management Console (SSMC) software 3.7.0.0* U...