Java/CVE-2012-5076
Exploit:Java/CVE-2012-5076 is a family of malicious Java applets that attempt to exploit a vulnerability (CVE-2012-5076) in the Java Runtime Environment (JRE) in order to download and install files of an attacker’s choice onto your computer.
If you visit a website containing the malicious code while using a vulnerable version of Java, Exploit:Java/CVE-2012-5076 is loaded. It then attempts to download and execute files from a remote host/URL; the files that are downloaded and executed could include additional malware.
The following versions of Java are vulnerable to this exploit:
JDK and JRE 7 Update 7 and earlier
Steps you can take
The nature of this threat means that you may need to take some steps to prevent being vulnerable from this, and similar exploits. We suggest you:
For detailed information about these steps, please see the Additional removal instructions below.
Java/CVE-2012-0507
Exploit:Java/CVE-2012-0507 is a malicious Java applet that attempts to exploit a vulnerability (CVE-2012-0507) in the Java Runtime Environment (JRE) in order to download and install files of an attacker’s choice onto your computer.
If you visit a website containing the malicious code while using a vulnerable version of Java, the exploit is loaded. It then attempts to download and execute files from a remote host/URL; the files that are downloaded and executed could include additional malware.
The following versions of Java are vulnerable to this exploit:
- JDK and JRE 7 Update 2 and earlier Java SE
- JDK and JRE 6 Update 30 and earlier Java SE
- JDK and JRE 5.0 Update 33 and earlier Java SE
- SDK and JRE 1.4.2_35 and earlier Java SE
- JavaFX 2.0.2 and earlier JavaFX
Java/CVE-2012-1723
Microsoft security software detects and removes this threat.
This threat uses a Java vulnerability to download and run files on your PC, including other malware.
It runs when you visit a hacked or malicious website and you have a vulnerable version of Java.
The following versions of Java are vulnerable:
-
JDK and JRE 7 Update 4 and earlier Java SE
-
JDK and JRE 6 Update 32 and earlier Java SE
-
JDK and JRE 5.0 Update 35 and earlier Java SE
- SDK and JRE 1.4.2_37 and earlier Java SE
To check if you're running a vulnerable version of Java:
- In Control Panel, double-click Programs.
- If Java is installed you will see it in the list of installed programs. Click it to open the Java Control Panel.
- On the General tab, click About to see which version of Java you have installed.
You might get an alert about this threat even if you're not using a vulnerable version of Java. This is because we detect when a website tries to use the vulnerability, even if it isn't successful.
Java/CVE-2012-4681
Exploit:Java/CVE-2012-4681 is a family of malicious Java applets that attempt to exploit a vulnerability (CVE-2012-4681) in the Java Runtime Environment (JRE), in order to download and install files of an attacker’s choice onto your computer.
If you visit a website containing the malicious code while using a vulnerable version of Java, Exploit:Java/CVE-2012-4681 is loaded. It then attempts to download and execute files from a remote host/URL; the files that are downloaded and executed could include additional malware.
Oracle Java JDK and JRE 7 Update 5 and earlier, JRE 6 Update 34 and earlier are all vulnerable to this exploit.
Win32/CVE-2012-0158
Windows Defender detects and removes this threat.
This threat uses a vulnerability to download and run files on your PC, including other malware. It is also called the "MSCOMCTL.OCX RCE Vulnerability".
It runs if you visit a web site, use a Microsoft Office document or .rtf file (Word document), and have a vulnerable version of the following applications on your PC:
- BizTalk Server 2002 SP1
- Commerce Server 2002 SP4, 2007 SP2, and 2009 Gold, and R2
- Microsoft Office 2003 SP3
- Microsoft Office 2003 Web Components SP3
- Microsoft Office 2007 SP2 and SP3
- Microsoft Office 2010 Gold and SP1
- SQL Server 2000 SP4, 2005 SP4, and 2008 SP2, SP3, and R2
- Visual Basic 6.0 Runtime
- Visual FoxPro 8.0 SP1 and 9.0 SP2
It is most often distributed through emails.
You may get an alert about this threat even if you're not using a vulnerable version of the application. This is because we detect when a website or file tries to use the vulnerability, even if it isn't successful.
Exploit:Java/CVE-2012-5076
Exploit:Java/CVE-2012-5076is a family of malicious Java applets that attempt to exploit a vulnerability (CVE-2012-5076) in the Java Runtime Environment (JRE) in order to download and install files of an attacker’s choice onto your computer.
If you visit a website containing the malicious code while using a vulnerable version of Java, Exploit:Java/CVE-2012-5076 is loaded. It then attempts to download and execute files from a remote host/URL; the files that are downloaded and executed could include additional malware.
The following versions of Java are vulnerable to this exploit:
JDK and JRE 7 Update 7 and earlier
VirTool:JS/DonxRef.A
VirTool:JS/DonxRef.A is a generic detection for obfuscated JavaScript often found distributed through compromised websites. It contains malicious code designed to exploit vulnerabilities in Java and Adobe Flash Player. If your computer has vulnerable versions of these programs, VirTool:JS/DonxRef.A may download and run other malware.
Exploit:Java/CVE-2012-5076.GAA
Exploit:Java/CVE-2012-5076.GAA is a malicious Java applet that attempt to exploit a vulnerability (CVE-2012-5076) in the Java Runtime Environment (JRE) in order to download and install files of an attacker’s choice onto your computer.
If you visit a website containing the malicious code while using a vulnerable version of Java, Exploit:Java/CVE-2012-5076.GAA is loaded. It then attempts to download and execute files from a remote host/URL; the files that are downloaded and executed could include additional malware.
The following versions of Java are vulnerable to this exploit:
JDK and JRE 7 Update 7 and earlier
Steps you can take
The nature of this threat means that you may need to take some steps to prevent being vulnerable from this, and similar exploits. We suggest you:
For detailed information about these steps, please see the Additional removal instructions below.
Exploit:Win32/CVE-2012-0158.CJ
Windows Defender detects and removes this threat.
This threat uses a Microsoft vulnerability to download and run files on your PC, including other malware. It is also called the "MSCOMCTL.OCX RCE Vulnerability".
It runs if you visit a website, use an Office document or .rtf file (Word document), and have a vulnerable version of the following applications on your PC:
- Microsoft Office 2003 SP3
- Microsoft Office 2003 Web Components SP3
- Microsoft Office 2007 SP2 and SP3
- Microsoft Office 2010 Gold and SP1
It is most often distributed through emails.
You might get an alert about this threat even if you're not using a vulnerable version of the application. This is because we detect when a website or file tries to use the vulnerability, even if it isn't successful.
Exploit:Java/CVE-2012-1723.YD
Exploit:Java/CVE-2012-1723.YD is a malicious Java applet that attempts to exploit a vulnerability (CVE-2012-1723) in the Java Runtime Environment (JRE) in order to download and install files of an attacker’s choice onto your computer.
If you visit a website containing the malicious code while using a vulnerable version of Java, the exploit is loaded. It then attempts to download and execute files from a remote host/URL; the files that are downloaded and executed could include additional malware.
The following versions of Java are vulnerable to this exploit:
- JDK and JRE 7 Update 4 and earlier Java SE
- JDK and JRE 6 Update 32 and earlier Java SE
- JDK and JRE 5.0 Update 35 and earlier Java SE
- SDK and JRE 1.4.2_37 and earlier Java SE
Exploit:Java/CVE-2012-4681.SU
Exploit:Java/CVE-2012-4681.SU is a malicious Java applet that attempts to exploit a vulnerability (CVE-2012-4681) in the Java Runtime Environment (JRE), in order to download and install files of an attacker’s choice onto your computer.
If you visit a website containing the malicious code while using a vulnerable version of Java, Exploit:Java/CVE-2012-4681.SU is loaded. It then attempts to download and execute files from a remote host/URL; the files that are downloaded and executed could include additional malware.
Oracle Java JDK and JRE 7 Update 5 and earlier, JRE 6 Update 34 and earlier are all vulnerable to this exploit.
Exploit:Java/CVE-2012-0507.Q!ldr
Exploit:Java/CVE-2012-1723!jar
Windows Defender detects and removes this threat.
This threat uses a Java vulnerability to download and run files on your PC, including other malware.
It runs when you visit a hacked or malicious website and you have a vulnerable version of Java.
The following versions of Java are vulnerable to this exploit:
- JDK and JRE 7 Update 4 and earlier Java SE
- JDK and JRE 6 Update 32 and earlier Java SE
- JDK and JRE 5.0 Update 35 and earlier Java SE
- SDK and JRE 1.4.2_37 and earlier Java SE
To check if you're running a vulnerable version of Java:
- In Control Panel, double-click Programs.
- If Java is installed you will see it in the list of installed programs. Click it to open the Java Control Panel.
- On the General tab, click About to see which version of Java you have installed.
You may get an alert about this threat even if you're not using a vulnerable version of Java. This is because we detect when a website tries to use the vulnerability, even if it isn't successful.
Exploit:Java/CVE-2012-0507.D!ldr
Windows Defender Antivirus detects and removes this threat.
This threat uses a Java vulnerability to download and run files on your PC, including other malware.
It runs when you visit a hacked or malicious website and you have a vulnerable version of Java.
The following versions of Java are vulnerable:
- JDK and JRE 7 Update 2 and earlier Java SE
- JDK and JRE 6 Update 30 and earlier Java SE
- JDK and JRE 5.0 Update 33 and earlier Java SE
- SDK and JRE 1.4.2_35 and earlier Java SE
- JavaFX 2.0.2 and earlier JavaFX
To check if you're running a vulnerable version of Java:
- In Control Panel, double-click Programs.
- If Java is installed you will see it in the list of installed programs. Click it to open the Java Control Panel.
- On the General tab, click About to see which version of Java you have installed.
You may get an alert about this threat even if you're not using a vulnerable version of Java. This is because we detect when a website tries to use the vulnerability, even if it isn't successful.
Find out ways that malware can get on your PC.
Exploit:Win32/CVE-2012-0002.A
Exploit:Win32/CVE-2012-0002.A is the detection for Proof-of-Concept code that exploits a vulnerability in the Remote Desktop Protocol (RDP). The vulnerability, discussed in CVE-2012-0002, could allow remote code execution and was resolved with the release of Microsoft Security Bulletin MS12-002.
Exploit:Win32/CVE-2012-0002.B
Exploit:Win32/CVE-2012-0002.A is the detection for a utility that exploits a vulnerability in the Remote Desktop Protocol (RDP). The vulnerability, discussed in CVE-2012-0002, could allow remote code execution and was resolved with the release of Microsoft Security Bulletin MS12-002.