Zero-day Vulnerability Database
Zero-day vulnerabilities discovered: 4
Remote code execution in Oracle Java SE
CVE-2012-4681
Error Handling
The vulnerability allows a remote attacker to execute arbitrary code on the target system.The weakness exists due to improper handling of Rhino Javascript errors. A remote attacker can create a specially crafted Web site, trick the victim into visiting it and bypass sandbox restrictions to download and execute arbitrary code with privileges of the current user.
Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.
Note: the vulnerability was being actively exploited.
The researchers of FireEye began investigation of the vulnerability after Twitter post made by Joshua J. Drake on August, 26.
Software: Oracle Java SE
Links:
http://www.oracle.com/technetwork/topics/security/alert-cve-2012-4681-1835715.html
http://rhn.redhat.com/errata/RHSA-2012-1225.html
https://www.fireeye.com/blog/threat-research/2012/08/java-zero-day-first-outbreak.html
https://www.fireeye.com/blog/threat-research/2012/08/zero-day-season-is-not-over-yet.html
https://www.alienvault.com/blogs/labs-research/new-year-new-java-zeroday
https://community.rapid7.com/community/metasploit/blog/2012/08/27/lets-start-the-week-with-a-new-jav...
https://immunityproducts.blogspot.com/2012/08/java-0day-analysis-cve-2012-4681.html
Remote code execution in Oracle Java SE
CVE-2012-1723
Improper Input Validation
The vulnerability allows a remote attacker to execute arbitrary code on the target system.The weakness exists due to an error in the HotSpot bytecode verifier. By using untrusted Java Web Start applications and untrusted Java applets in a client deployment, a remote attacker can execute arbitrary code with privileges of the current user.
Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.
Note: the vulnerability was being actively exploited.
The vulnerability was exploited by BlackHole Exploit Toolkit after official patch.
The vulnerability was made public by Michael тАШmihiтАЩ Schierl.
According to Brian Krebs, the exploit was used in targeted attacks before official patch from Oracle.
Software: Oracle Java SE
Known/fameous malware:
Trojan.Maljava.
The vulnerability was made public by Michael тАШmihiтАЩ Schierl.
According to Brian Krebs, the exploit was used in targeted attacks before official patch from Oracle.
Links:
http://www.oracle.com/technetwork/topics/security/javacpujun2012-1515912.html
http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2012-June/019076.html
https://www.symantec.com/connect/blogs/examination-java-vulnerability-cve-2012-1723
http://www.welivesecurity.com/2012/07/10/java-the-hutt-meets-cve-2012-1723-the-evil-empire-strikes-b...
https://threatpost.com/volume-malware-targeting-java-cve-2012-1723-flaw-spikes-080312/76878/
http://blog.crysys.hu/2012/07/on-the-cve-2012-1723-based-java-exploit-and-malware-sample/
http://krebsonsecurity.com/2012/07/new-java-exploit-to-debut-in-blackhole-exploit-kits/
https://wraithhacker.com/last-years-java-exploit-cve-2012-1723/
TNS Listener Poisoning Attack in Oracle Database
CVE-2012-1675
Spoofing attack
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to an error in the TNS listener service. A remote attacker can register an existing instance or service name, use man-in-the-middle techniques and read, inject or modify transmitted data.
Successful exploitation of this vulnerability may result in unauthorized access to entire database.
Note: the vulnerability was being actively exploited.
Joxean Koret discovered this vulnerability in 2008 and publicly disclosed in 2012.
The vulnerability was used in "TNS Listener Poison Attack"
Software: Oracle Database Server
The vulnerability was used in "TNS Listener Poison Attack"
Links:
http://seclists.org/fulldisclosure/2012/Apr/343
http://thetechnologygeek.org/oracle-zero-day-vulnerability-still-not-patched/
https://blogs.oracle.com/security/entry/security_alert_for_cve_2012
http://www.oracle.com/technetwork/topics/security/alert-cve-2012-1675-1608180.html
https://lists.opensuse.org/opensuse-security-announce/2012-06/msg00018.html
http://www.informationsecuritybuzz.com/articles/oracle-tns-listener-poison-attack/
http://www.teamshatter.com/topics/general/team-shatter-exclusive/oracle-0-day-tns-listener-poison-at...
https://support.symantec.com/en_US/article.TECH219444.html
https://blog.qualys.com/laws-of-vulnerabilities/2012/05/01/oracle-adresses-0-day-tns-poison
http://pfierens.blogspot.com/2014/10/cve-2012-1675-listener-poisoning.html
http://searchsecurity.techtarget.com/tip/Using-the-network-to-prevent-an-Oracle-TNS-Listener-poison-...
Remote code execution in Oracle Java SE
CVE-2012-3213
Error Handling
The vulnerability allows a remote attacker to execute arbitrary code on the target system.The weakness exists due to improper handling of Rhino Javascript errors. A remote attacker can create a specially crafted Web site, trick the victim into visiting it and execute arbitrary code with privileges of the current user via untrusted Java Web Start applications and untrusted Java applets.
Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.
Note: the vulnerability was being actively exploited.
The vulnerability was disclosed by James Forsha.
Exploited by Wild Neutron.
Software: Oracle Java SE
Known/fameous malware:
Exploit.Java.CVE-2012-3213.b.
Exploited by Wild Neutron.