Threat in context
This exploit targets the Java plug-in for web browsers. Java programs (or applets) can be used by websites and run in a "sandbox" – where the plug-in enforces rules on what the applet can do so that it cannot escape the restricted environment.
What is an exploit?
Exploits are written to take advantage of weaknesses (or vulnerabilities) in legitimate software. A project called Common Vulnerabilities and Exposures (CVE) gives each vulnerability a unique number, in this case "CVE-2012-4681".
You can find more information on the CVE website or on our page about exploits.
Payload
Downloads and installs files
If you visit a website containing the malicious code while using a vulnerable version of Java, Exploit:Java/CVE-2012-4681 is loaded. It then attempts to download and run files from a remote host/URL. The files that are downloaded and run could be any of the hacker's choice and could include other malware.
Additional technical details
Exploit:Java/CVE-2012-4681 first appeared in late August 2012 as a 0-day which didn’t have any patches available, as described by FireEye. Oracle later released a patch for this vulnerability. The problem lies in a com.sun.beans package in JRE or JDK from Oracle. The package has an improper access check and could be abused to retrieve class and methods from trusted code. After this retrieval of privileged class and methods, they could be abused to set arbitrary security access value for a local access control context. This will enable the malicious Java code to perform malicious activities by performing elevation of privilege.
Exploit:Java/CVE-2012-4681 attacks the security model instead of memory corruption issues. With memory corruption issues, the exploit is dependent on the specific CPU (Central Processing Unit) type and operating systems, and might be affected by mitigation technology like DEP (Data Execution Prevention) or ASLR (Address Space Layout Randomization).
Attacking the security model means that the exploit might be effective on any platform the Java interpreter is on; for example Windows, MacOS, Linux, etc.
Usually the exploits are written using a few Java classes working together. The various class files are bundled into an archive called a JAR, which uses the ZIP file format. Every JAR contains a Manifest.MF file to identify itself to the Java Runtime. Since it is found in every JAR, it won't be listed.
Below are some examples of files that exploit the vulnerability described in CVE-2012-4681:
- 03c55af352edbe6963be10f2ceedc1fc88d9a729
- 060df5f731da509aa4e563974468f761f96e35f1
- aPSQeX.lpl
- FMR.class
- ghCija.class
- jWJEpKio.class
- mupVbo.class
- nJSmoKFre.class
- qseTs.class
- RqTsy.class
- rXntYgPr.class
- SsyAmsW.class
- uhuPhoA.class
- XMRuySlH.class
- yWAIumfA.class
- 0e22f0e3af074831cd7e8c4bb5e78a546bf10b9d
- Bil.class
- Fees.class
- Ini.class
- Ttiik.class
- 13a37e859b3f22e6cda1d8de29d5b5cb48882b63
- attend.class
- curioKue.class
- game.class
- holdsSwearAyins.class
- woeFeel.class
- e9eb6da4ed220687ebeb9fac6a7243d0f9f2bdc2
- aXx.class
- FMWNHS.class
- FnVdVHLO.class
- III.class
- QlbHzGLWj.class
- rQwaQzBSe.class
- sFT.class
- thI.lpl
- UdzJ.class
- Xjtoxffrx.class
- YXRB.class
- zWrDN.class
- d8f81639a35816bd713b638d8cb17338e3c5e6b6
- ulstersBoonsDaze\adoredSyn.class
- ulstersBoonsDaze\antae.class
- ulstersBoonsDaze\game.class
- ulstersBoonsDaze\muLeg.class
- ulstersBoonsDaze\pomQuaBute.class
- d69542d93effed18bf108e35f61d849178e1261b
- gdIUPZhjdQVWPNAndZlUKwQMb.class
- gdiVczjHbUlgsMaREjjtCKCqa.class
- gEsggWWdMoSrwiYpzIvevMyQz.class
- gnMeecGBrylqcYDzRngAHWPWL.class
- gofLGlPkeiJTkFIYHwbgIPbVV.class
- gTScamqeOHJqskxnPErnFMXvw.class
- gturu.class
- gTYlgEvJeemOHmdAdNRyHzqYv.class
- gwTGfiltkOfDdSqsudkOBcVfQ.class
- gWZWWaEvfyKJSLVyJLrtSypSs.class
- gziqTXlQLueoQzKUAaOGNVlfH.class
- c5852083da552b66a32d93d64fe3e06916a4bd18
- a.class
- b.class
- c.class
- d.class
- e.class
- f.class
- g.class
- h.class
- i.class
- pka.class
- 5a7a98d207b108eade765dc98aef82c752e4de01
- billTyphusMana\bravure.class
- billTyphusMana\cagesSwarmed.class
- billTyphusMana\game.class
- billTyphusMana\jakesHandselWoke.class
- billTyphusMana\oohOoze.class
Once the exploit obtains full privileges on your computer, it can:
- Run an executable file (that may be detected as malware) included in the JAR
- Run an executable file from (that may be detected as malware) a URL hard-coded in the exploit's file
- Take instructions from the HTML file (such as a URL to the malware executable) that loaded them
Related information
The articles referenced below outline some of the the technical details of the weakness this vulnerability exploits:
Analysis by Jeong Wook (Matt) Oh
