Follow:

 

Exploit:Java/CVE-2013-1493


Microsoft security software detects and removes this threat.

This threat uses a Java vulnerability (CVE-2013-1493) to download and run files on your PC, including other malware.

It runs when you visit a hacked or malicious website and if you have a vulnerable version of Java.

The following versions of Java are vulnerable:

  • Oracle Java JDK and JRE 7 Update 15 and earlier
  • Oracle Java JDK and JRE 6 Update 41 and earlier
  • Oracle Java JDK and JRE 5 Update 40 and earlier

To check if you're running a vulnerable version of Java:

  1. In Control Panel, double-click Programs.
  2. If Java is installed you will see it in the list of installed programs. Click it to open the Java Control Panel.
  3. On the General tab, click About to see which version of Java you have installed.

You might get an alert about this threat even if you're not using a vulnerable version of Java. This is because we detect when a website tries to use the vulnerability, even if it isn't successful. This doesn't mean that you have been hacked; it means someone has tried to hack into your PC.

Find out ways that malware can get on your PC.



What to do now

The following free Microsoft software detects and removes this threat:

Even if we've already detected and removed this particular threat, running a full scan might find other malware that is hiding on your PC.

You can also visit the Microsoft virus and malware community or our advanced troubleshooting page for more help.

If you’re using Windows XP, see our Windows XP end of support page.

Update Java

Make sure you install all available Java updates. You can read more about this vulnerability and download software updates from these links:

You should remove older versions of Java, as keeping old and unsupported versions of Java on your PC is a serious security risk:

If you continue to get alerted about this threat, deleting your temporary Java files can help:

It's also important to keep your other software up to date:

Clear the cache

You should delete your temporary Internet files so your security software doesn't continue to detect this threat:

Threat behavior

Threat in context

Java is a general-purpose programming language, but cases of this exploit are targeted against the Java plug-in for web browsers. The intent of the Java plug-in is that Java programs (or "applets") can be offered by websites, and run in a "sandbox" where the Java plug-in enforces rules on what the Java applet can do so that it cannot escape restricted environment.

What is an exploit?

Exploits are written to take advantage of weaknesses (or vulnerabilities) in legitimate software. A project called Common Vulnerabilities and Exposures (CVE) gives each vulnerability a unique number, in this case "CVE-2013-1493". The part "2013" refers to the year the vulnerability was discovered, and "1493" is a unique ID for this specific vulnerability. You can find more information on the CVE website.

Payload

Downloads and installs files

If you visit a website containing the malicious code while using a vulnerable version of Java, Exploit:Java/CVE-2013-1493 is loaded. It then tries to download and run files from a remote host/URL, including other malware.

Additional technical details

Exploit:Java/CVE-2013-1493 first appeared in February 2013 as a 0-day which didn't have any patches available, as described in the FireEye blog YAJ0: Yet Another Java Zero-Day. Oracle later released an advisory for this vulnerability. The problem lies in memory management and involved a memory corruption vulnerability and memory contents leak issue with a color management class.

The first samples in the wild were using a memory corruption issue found in color management code and used heap-spraying techniques. They also used leaked memory information to locate the accurate memory base location for exploitation.

As the malware evolved, it used obfuscation methods to hide its intention, like obfuscated string and code structures.

This exploit might be effective on any platform the Java interpreter is on; for example Windows, MacOS, Linux, and so on. At the time of analysis, we have only observed the exploit targeting Windows.

Usually the exploits are written using a few Java classes working together. The various class files are bundled into an archive called a JAR, which uses the ZIP file format. Every JAR contains a Manifest.MF file to identify itself to the Java Runtime. Since it is found in every JAR, it won't be listed.

The following are some examples of files that exploit the vulnerability described in CVE-2013-1493:

  • In sample ad62df685c00ad42a5f731bb8206cef0b064035f
    • ImAlphaLeak.class
    • ImAlphaMyBufferedImage.class
    • ImAlphaMyColorSpace.class
    • ImAlpha.class
    • svchost.cf
  • In sample 5a02a3eb6354afc6cff661d258cdbd52ca84b805
    • Artmil.class
    • Art.class
    • br.class
    • bs.class
    • eu.class
    • fh.class
    • gt.class
    • n7.class
    • n8.class
    • n9.class
    • na.class
    • nb.class
    • nc.class
    • nd.class
    • ne.class
    • nf.class
    • ng.class
    • nl.class
    • se.class
  • In sample 00fb7a6e5f556c317561999fff52a3c2243b8b84
    • Anallenge.class
    • Base.class
    • Kaniv.class
    • Ntona.class
    • Numcr.class
    • Ocoo.class
    • Ott.class
    • Piic.class
    • Samt.class
    • Zaiia.class
    • Zavv.class
  • In sample 2f919db585ced2b348f5ce61539961531ce3942e
    • Elocct.class
    • lnKvxNcUi.class
    • vkWZUyOU.class
    • vqmmeibJ.class
    • ymaUdhzsV.class
  • In sample fbcba8a5ddc5de10ea6bb0120c5938723c4cae14
    • MyApplet.class
    • NioriutMdoritbause.class
    • normutie.class
    • QSortAlgorithm.class

Once the exploit gets full privileges on your PC, it may:

  • Run an executable file (that may be detected as malware) included in the JAR
  • Run an executable file (that may be detected as malware) from a URL hard-coded in the exploit's file
  • Take instructions from the HTML file (like a URL to the malware executable) that loaded them
Related information/references

The articles below outline some of the technical details of the weakness this vulnerability exploits:

Analysis by Jeong Wook (Matt) Oh


Symptoms

Alerts from your security software may be the only symptom.


Prevention


Alert level: Severe
First detected by definition: 1.145.1290.0
Latest detected by definition: 1.169.1527.0 and higher
First detected on: Mar 07, 2013
This entry was first published on: Mar 07, 2013
This entry was updated on: Apr 14, 2014

This threat is also detected as:
  • Exploit-FHV!CVE2013-1493 (McAfee)
  • Exp/20131493-G (Sophos)
  • Exp/20131493-A (Sophos)
  • Exploit.Java.CVE-2013-1493.gen (Kaspersky)
  • Java/CVE_2013_1493.NT!exploit (other)