Follow:

 

Exploit:Java/CVE-2013-0422


Microsoft security software detects and removes this threat.

This threat uses a Java vulnerability to download and run files on your PC, including other malware.

It runs when you visit a hacked or malicious website and you have a vulnerable version of Java.

The following versions of Java are vulnerable:

  • Java Development Kit and Java Runtime Environment 7 Update 10 and earlier

To check if you're running a vulnerable version of Java:

  1. In Control Panel, double-click Programs.
  2. If Java is installed you will see it in the list of installed programs. Click it to open the Java Control Panel.
  3. On the General tab, click About to see which version of Java you have installed.

You may get an alert about this threat even if you're not using a vulnerable version of Java. This is because we detect when a website tries to use the vulnerability, even if it isn't successful.

Find out ways that malware can get on your PC.  



What to do now

The following free Microsoft software detects and removes this threat:

Even if we've already detected and removed this particular threat, running a full scan might find other malware that is hiding on your PC.

Get more help

You can also see our advanced troubleshooting page for more help.

If you’re using Windows XP, see our Windows XP end of support page.

Update Java

Make sure you install all available Java updates. You can read more about this vulnerability and download software updates from these links:

You should remove older versions of Java, as keeping old and unsupported versions of Java on your PC is a serious security risk:

If you continue to get alerted about this threat, deleting your temporary Java files can help:

It's also important to keep your other software up to date:

Clear the cache

You should delete your temporary Internet files so your security software doesn't continue to detect this threat:

Threat behavior

Exploit:Java/CVE-2013-0422 is a malicious Java applet that tries to exploit a vulnerability (CVE-2013-0422) in Oracle JRE 7.

Threat in context

Java is a general-purpose programming language, but cases of this exploit are targeted against the Java plug-in for web browsers. The intent of the Java plug-in is that Java programs (or "applets") can be offered by websites, and run in a "sandbox" where the Java plug-in enforces rules on what the Java applet can do so that it cannot escape restricted environment.

The first malware to exploit this vulnerability was found in December 2012 in the wild, and publicly disclosed in January 2013. It is exploiting a package restriction issue in JRE(Java Runtime Environment). The malware uses a typical Java exploitation technique by loading its malicious payload class in a trusted code area, which makes privilege escalation possible. The payload can be embedded in the JAR (Java Archive) file, or it may be downloaded from the Internet. The payload can be any kind of malware that the attacker wants to deliver to your PC.

What is an exploit?

Exploits are written to take advantage of weaknesses (or vulnerabilities) in legitimate software. A project called Common Vulnerabilities and Exposures (or CVE) is used by many vendors and organizations and gives each vulnerability a unique number, in this case "CVE-2013-0422". The portion "2013" refers to the year the vulnerability was discovered, and "0422" is a unique identifier. There is more information on the Common Vulnerabilities and Exposures website.

Additional technical details

Exploit:Java/CVE-2013-0422 is a Java malware that uses a security vulnerability from JRE 7. The problem occurs with the java.lang.invoke.MethodHandle package in JRE 7. MethodHandle is a new feature introduced with JRE 7. It gives developers more convenience and flexibility with dynamic language use in Java. With this advantage, there is also a glitch with the security check when MethodHandle is used to resolve classes from the MethodHandle package itself. Specifically, you can create MethodHandle for the java.lang.invoke.MethodHandles.Lookup class and it will bypass security checks when you try to use findConstructor method through this handle.

With unrestricted access, the malicious code can resolve and run restricted methods from restricted classes. The actual exploitation usually involves access to sun.org.mozilla.javascript.internal.GeneratedClassLoader and the createClassLoader method from the specific class. Access to this restricted class and method will let the malicious code to create and run malicious payload class with trusted code privileges. There are several other method names that can suffer from this issue and it is fixed by applying stricter security checks upon those methods.

This vulnerability is a logic error in checking package access when the caller is coming from specific package and the method has specific names. The exploitation doesn’t rely on specific memory layout, which means the exploits are usually portable across multiple platforms, except the fact that the major portion of payload we observed are targeting Windows operating systems.

Usually exploits are written using a few Java classes working together. The various class files are bundled into an archive called a JAR, which uses the ZIP file format. Every JAR contains a Manifest.MF file to identify itself to the Java Runtime. Since it is found in every JAR, it won't be listed.

Below are some examples of files that exploit the vulnerability described in CVE-2013-0422:

  • 0fdb83268e7d710406dcfabc5a6a7eec9983d2a8
    • A2nG4N0b6lW.class
    • SDPzp
    • SDPzp\amxmiVDsg.class
    • SDPzp\EGWpQIP.class
    • SDPzp\IjeYI.class
    • SDPzp\LsGJm.class
    • SDPzp\QDccKseX.class
    • SDPzp\rNLCY.class
    • SDPzp\vmsUSHNC.class
    • SDPzp\WqLNn.class
  • 1267fe4c67f57db659a7ec39d66a5987e037389f
    • Main.class
    • WqJmjZxw
    • WqJmjZxw\CffXnm2.class
    • WqJmjZxw\DddYV.class
    • WqJmjZxw\euAsAVnxL.class
    • WqJmjZxw\gXLFoU.class
    • WqJmjZxw\hyKJyltC.class
    • WqJmjZxw\Mmm2.class
    • WqJmjZxw\VOjbPDHBz2.class
    • WqJmjZxw\YvelJM.class
  • 3e3f77364387f6a5220feea48d257d0c0fb85c0c
    • IBslMZ0JWdY06dGJ.class
    • uthlpOV
    • uthlpOV\AvpOP.class
    • uthlpOV\bdujg.class
    • uthlpOV\FYmUQmPQ.class
    • uthlpOV\GTcFymp.class
    • uthlpOV\IyTJKF.class
    • uthlpOV\OXNzLtC.class
    • uthlpOV\PTgebK.class
    • uthlpOV\wxoQd.class
  • 46a47077ac7372b148cc2c4064df844e607d6ed8
    • 4r9h6B0iPGu.class
    • cVfMc
    • cVfMc\mhgkVaY.class
    • cVfMc\MmiwFWO.class
    • cVfMc\NjYCzXrZ.class
    • cVfMc\qwILa.class
    • cVfMc\rQjIO.class
    • cVfMc\TUqUvI.class
    • cVfMc\WweRAZ.class
    • cVfMc\zsPLetEN.class
  • 4ad8cb08e858c0e5637f03b1d42af316ea0336ce
    • bjiDGbeg
    • Main.class
    • bjiDGbeg\Avs.class
    • bjiDGbeg\Bjkfdsbjg.class
    • bjiDGbeg\Bjsafkasf.class
    • bjiDGbeg\Iddsgds.class
    • bjiDGbeg\Kla.class
    • bjiDGbeg\Nbm.class
    • bjiDGbeg\Nsfklewgr.class
    • bjiDGbeg\Nwingdf.class
    • bjiDGbeg\YvelJM.class
  • 50c3b36ee2b4edd2735cbe7e4803e3ed477dbd93
    • Main.class
    • Nklasfnsakf
    • Nklasfnsakf\CffXnm2.class
    • Nklasfnsakf\DddYV.class
    • Nklasfnsakf\euAsAVnxL.class
    • Nklasfnsakf\gXLFoU.class
    • Nklasfnsakf\hyKJyltC.class
    • Nklasfnsakf\Mmm2.class
    • Nklasfnsakf\Qwe.class
    • Nklasfnsakf\VOjbPDHBz2.class
    • Nklasfnsakf\YvelJM.class
  • 8bc9f5f9c9549342629c5b309c0692cf5136e9a9
    • afg.class
    • agf.class
    • fag.class
    • fga.class
    • gaf.class
    • gfa.class
    • Pla.class
    • Pla.dat
    • ram.class
  • abd46a566f342fd942d6f4c1264ecf6ca85ad524
    • bin.class
    • bni.class
    • ibn.class
    • inb.class
    • nbb.class
    • nbi.class
    • nib.class
    • Pla.class
    • Pla.dat
  • c1b4bb4150c99537008cd2bc51d6b6ac33e9bca4
    • LX1ilU0aOrl0falm.class
    • uthlpOV
    • uthlpOV\AvpOP.class
    • uthlpOV\bdujg.class
    • uthlpOV\FYmUQmPQ.class
    • uthlpOV\GTcFymp.class
    • uthlpOV\IyTJKF.class
    • uthlpOV\OXNzLtC.class
    • uthlpOV\PTgebK.class
    • uthlpOV\wxoQd.class
  • e276963cf414df2b6e0e3cd5ef0d230706819d6f
    • Main.class
    • WqJmjZxw
    • WqJmjZxw\CffXnm2.class
    • WqJmjZxw\DddYV.class
    • WqJmjZxw\euAsAVnxL.class
    • WqJmjZxw\gXLFoU.class
    • WqJmjZxw\hyKJyltC.class
    • WqJmjZxw\Mmm2.class
    • WqJmjZxw\Qwe.class
    • WqJmjZxw\VOjbPDHBz2.class
    • WqJmjZxw\YvelJM.class
  • e6f8092a875e17f4d9e468c7a949e009d1176316
    • gM5APz0FV0s.class
    • SDPzp
    • SDPzp\amxmiVDsg.class
    • SDPzp\EGWpQIP.class
    • SDPzp\IjeYI.class
    • SDPzp\LsGJm.class
    • SDPzp\QDccKseX.class
    • SDPzp\rNLCY.class
    • SDPzp\vmsUSHNC.class
    • SDPzp\WqLNn.class

Once the exploit has full privileges on your PC, it can:

  • Run an executable file (that may be detected as malware) included in the JAR
  • Run an executable file (that may be detected as malware) from a URL hardcoded in the exploit's file
  • Take instructions from the HTML file (like a URL to the malware executable) that loaded them

Analysis by Jeong Wook (Matt) Oh


Symptoms

Alerts from your security software may be the only symptom.


Prevention


Alert level: Severe
First detected by definition: 1.141.3699.0
Latest detected by definition: 1.179.2442.0 and higher
First detected on: Jan 11, 2013
This entry was first published on: Jan 11, 2013
This entry was updated on: Apr 15, 2014

This threat is also detected as:
No known aliases