Blackhole, CVE-2012-0507 and Carberp

[ronjor]

by David Harley Senior Research Fellow

This week Blackhole has been updated to version 1.2.3 and includes a new exploit for the Java CVE-2012-0507 vulnerability, which ESET calls Java/Exploit.CVE-2012-0507. Earlier this week information was published about the Blackhole update by French malware researcher Xylitol and last week Microsoft shared information about an interesting way of breaching the JRE (Java Runtime Environment) sandbox.

The first information about a working exploit for CVE-2012-0507 was released by the company Immunity with reference to the 7.03.2012 product update of Immunity CANVAS Modules. The first In-the-Wild detections were recognized during the week beginning on March 12, 2012. The CVE-2012-0507 vulnerability was remediated on February 15 as part of a critical patch update advisory. Today a public module for Metasploit Framework was released, working on a range of platforms: Windows, Linux, Solaris and OSX. The Metasploit module for exploitation of CVE-2012-0507 looks the same as the exploit version seen in the updated Blackhole version.

http://blog.eset.com/2012/03/30/blac...07-and-carberp

[Triple Helix]

Thanks Ron!

TH

[Hungry Man]

Multiplatform exploit - super.

I don't have Java installed actually on my Linux though. Anyone who does can just enable the apparmor profile.

[G1111]

Thanks for the article Ron.