Follow:

 

Exploit:Java/CVE-2011-3544


Microsoft security software detects and removes this threat.

This threat uses a software vulnerability to download and run other files on your PC, including malware.

It runs when you visit a hacked website and you have a vulnerable version of Java. Legitimate websites can also be hacked to unwillingly host this threat.

Oracle Java SE JDK and JRE 7 and 6 Update 27 and earlier are all vulnerable to this threat.

To check if you're running a vulnerable version of Java:

  1. Go to the control panel (Select Start then Control Panel)
  2. Select Programs. If Java is installed you will see it in the list of installed programs. Click it to open the Java Control Panel.
  3. On the General tab, click About to see which version of Java you have installed.

You may get a detection for this threat when you visit a website that has the malicious code, even if you're not using a vulnerable version of Java. This doesn't mean that you have been compromised, it means an try to compromise your PC has been made.

The vulnerability that this threat exploits is described in CVE-2011-3544.



What to do now

The following free Microsoft software detects and removes this threat:

Even if we've already detected and removed this particular threat, running a full scan might find other malware that is hiding on your PC.

Get more help

You can also visit our advanced troubleshooting page or search the Microsoft virus and malware community for more help.

If you’re using Windows XP, see our Windows XP end of support page.

Update Java

Make sure you install all available Java updates. You can read more about this vulnerability and download software updates from these links:

You should remove older versions of Java, as keeping old and unsupported versions of Java on your PC is a serious security risk:

If you continue to get alerted about this threat, deleting your temporary Java files can help:

It's also important to keep your other software up to date:

Threat behavior

Threat in context

Java is a general-purpose programming language, but cases of this exploit are targeted against the Java plug-in for web browsers. The intent of the Java plug-in is that Java programs (or "applets") can be offered by websites, and run in a "sandbox" where the Java plug-in enforces rules on what the Java applet can do so that it cannot escape outside the webpage it is included in.

What is an exploit?

Exploits are written to take advantage of weaknesses (or "vulnerabilities") in legitimate software. A project called "Common Vulnerabilities and Exposures" (or "CVE"), used by many vendors and organizations, gives each vulnerability a unique number, in this case "CVE-2011-3544". The portion "2011" refers to the year the vulnerability was discovered, and "3544" is a unique ID for this specific vulnerability. The official source that gives out CVE identifiers lists this at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3544.

Payload

Downloads and installs files

If you visit a website containing the malicious code while using a vulnerable version of Java, Exploit:Java/CVE-2011-3544 is loaded. It then tries to download and run files from a remote host/URL. The files that are downloaded and run could be any of the hacker's choice and could include additional malware.

Additional technical details

Exploit:Java/CVE-2011-3544 uses a bug in the JavaScript engine inside of the Java Runtime. Java applets can run JavaScript code, and normally the JavaScript code is subject to the same restrictions that the Java applet is. The JavaScript function in this exploit extends the internal function "toString" with its own code. Then it calls a built-in, privileged routine, like the Error object, that it knows will call the "toString" function that it just redefined. When it calls the "toString" function, the attacker’s code is then run with elevated privileges. The exploit takes these privileges and can then run outside of the sandbox.

In summary, Exploit:Java/CVE-2011-3544 attacks the security model instead of a buffer overflow. With a buffer overflow, the exploit is dependent on the specific CPU (Central Processing Unit), and might be affected by technology like DEP (Data Execution Prevention) or ASLR (Address Space Layout Randomization).

Attacking the security model means that the exploit might be effective on any platform the Java interpreter is on; for example Windows, MacOS, Linux, etc.

Usually the exploits are written using a few Java classes working together. The various class files are bundled into an archive called a JAR, which uses the ZIP file format. Every JAR contains a Manifest.MF file to identify itself to the Java Runtime. Since it is found in every JAR, it won't be listed.

Below are some examples of files that exploit the vulnerability described in CVE-2011-3544:

  • 00090b78cd0730dd0f4d04be9ff213b35545c1da
    • abcred.class
    • i.class
  • 00237384c62d1e260f6ed9a277f80bdd37cc3a61, 029bb2d8f3bc7cf79cd249798b69d3410efee6a0, 033d594bcaa585db419f76aeaca0edd74c8e02aa
    • Final.class
    • j.class
    • n.class
  • 002fcef6e70c9227420a2e97bafa038c9f14cc0d
  • 00c12fd7e080575de56869f66e4d8a973ca96f74, 023683cb65ff1a7779d0d66427fa8ce5f21d65c4, 026298551b026211c2533274c02f060438eb6107
    • Final.class
    • q.class
  • 019b19718b76238322efde40f198c95beab11b8d
    • Final.class
    • v.class
  • 01bd5a820497cd98b33b3548feb465be8f6c3ad1
    • ScriptEngineExp.class
  • 01e5873ebdc406428c0417f566c71b5dfe99e814
    • notana.class
  • 0203f381dda60ad68b0dd9eba9e4b83dfa88a13d
    • Applet.class
    • d.class
  • 02da44e5f7f4817697162cf7da2c7e9445ceb1d6
    • Applet.class
  • 033b8a2d9b8c6cf0acd4d9707cdc7c853e9c3e45
    • Final.class
    • m.class
    • q.class
  • 0368f2cbb64102d2923468e736f1c624abb1aa03
    • trinity.class

Some payloads are specifically targeted against MacOS X, for example:

  • 7cdc96c8705aeb324aa08b9cc3c171b9da67f576
    • Exploit.class
    • metasploit.dat (a configuration file for the payload)
    • Payload.class

Once the exploit obtains full privileges on your PC, it may:

  • Run a file (that may be detected as malware) included in the JAR
  • Run a file from (that may be detected as malware) a URL hardcoded in the exploit's file
  • Take instructions from the HTML file (like a URL to the malware file) that loaded them

In the wild, we have observed the following malware being distributed in the exploit's JAR files:

Related information / Related references

The articles referenced below outline some of the the technical details of the weakness this vulnerability exploits:

Analysis by Chris Stubbs


Symptoms

Alerts from your security software may be the only symptom.


Prevention


Alert level: Severe
First detected by definition: 1.117.1554.0
Latest detected by definition: 1.181.125.0 and higher
First detected on: Dec 22, 2011
This entry was first published on: Dec 22, 2011
This entry was updated on: May 11, 2014

This threat is also detected as:
  • Java/Agent.EM (Command)
  • Java/Exploit.NQ (AVG)
  • Java/Exploit.CVE-2011-3544.Q (ESET)
  • Exploit.Java.CVE-2011-3544.cd (Kaspersky)
  • Troj/JVExp-A (Sophos)
  • Exploit.CVE-2011-3544.H (VirusBuster)