Home / malware Exploit:Java/CVE-2012-5076
First posted on 15 February 2019.
Source: MicrosoftAliases :
There are no other names known for Exploit:Java/CVE-2012-5076.
Explanation :
Exploit:Java/CVE-2012-5076 is a family of malicious Java applets that attempt to exploit a vulnerability (CVE-2012-5076) in the Java Runtime Environment (JRE) in order to download and install files of an attacker's choice onto your computer.
The following versions of Java are vulnerable to this exploit:
JDK and JRE 7 Update 7 and earlier
To check if you're running a vulnerable version of Java:
Go to the control panel (Select Start|Control Panel) Select Programs. If Java is installed you will see it in the list of installed programs. Click it to open the JavaControl Panel. On the General tab, click About to see which version of Java you have installed.
Make sure that you install all available updates from the vendor in order to avoid this exploit. You can read more about this vulnerability and download software updates from these links:
CVE-2012-5076 Oracle advisory Java Download
Note: This detection may be triggered when you visit a website that contains the malicious code. Even if you are not using a vulnerable version of the JRE this detection may be reported when you visit a website that contains the malicious code. This does not mean that you have been compromised, rather that an attempt to compromise your computer has been made.
Threat in context
Java is a general-purpose programming language, but cases of this exploit are targeted against the Java plug-in for web browsers. The intent of the Java plug-in is that Java programs (or "applets") can be offered by websites, and run in a "sandbox" where the Java plug-in enforces rules on what the Java applet can do so that it cannot escape restricted environment.
What is an exploit?
Exploits are written to take advantage of weaknesses (or "vulnerabilities") in legitimate software. A project called "Common Vulnerability Enumeration" (or "CVE"), used by many vendors and organizations, gives each vulnerability a unique number, in this case "CVE-2012-5076". The portion "2012" refers to the year the vulnerability was discovered, and "5076" is a unique ID for this specific vulnerability. The official source that gives out CVE identifiers lists this at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5076.
Payload
Downloads and installs arbitrary files
If you visit a website containing the malicious code while using a vulnerable version of Java, Exploit:Java/CVE-2012-5076 is loaded. It then attempts to download and execute files from a remote host/URL. The files that are downloaded and executed could be any of the attacker's choice and could include additional malware.
Additional technical details
Exploit:Java/CVE-2012-5076 uses a vulnerability that was first disclosed when Oracle released a patch in mid-October 2012. The problem lies in the default Java security properties configuration as it did not restrict access to the com.sun.org.glassfish.gmbal package. This package contains critical operations that should not be called from untrusted code like unsigned Java applets. An attacker can exploit this issue to bypass sandbox restrictions and execute arbitrary code with elevated privileges.
Exploit:Java/CVE-2012-5076 attacks the security model instead of memory corruption issues. With memory corruption issues, the exploit is dependent on the specific CPU (Central Processing Unit) type and operating systems, and might be affected by mitigation technology like DEP (Data Execution Prevention) or ASLR (Address Space Layout Randomization).
Attacking the security model means that the exploit might be effective on any platform the Java interpreter is on; for example Windows, MacOS, Linux, etc.
Usually the exploits are written using a few Java classes working together. The various class files are bundled into an archive called a JAR, which uses the ZIP file format. Every JAR contains a Manifest.MF file to identify itself to the Java Runtime Environment. Since it is usually found in every JAR, it won't be listed.
Below are some examples of files that exploit the vulnerability described in CVE-2012-5076:
439b338989f3e732e8f48615dd73c3aca4900537 testesta.class testestb.class 48c228c01426679098517ed6b41c5d4472503fb9-> impossibla.class impossiblb.class d055c28ec2ef9aa5f9811c10ab1722e982b665ba Czktn.class gpbbFt.class hPfdgFs.class qrWWmME.class yFPmuUK.class 90bb1cc48505e4ea47806e00a9ea1e4f48ecbd2e kalibton.class Q4324ERW.class sdvfs342343Q.class z34654534XSS.class b64bab0f24890a45a3a879a7b464c6de9c16656b aadgrwa.class actrdbxphl.class acwdaxswad.class acxyiqgkg.class aeebjmywxdj.class afvvxgd.class aiowhlgolhxjt.class ajdvwzfnnptbz.class altycdjpmdpirl.class amaowtnbuhh.class amqak.class aqctestvveyczxq.class aqxkfcwmvdhynd.class aqxmivhvxhc.class askoqic.class a gvhdpre.class axesbiv.class hjrhxp da446f7a41560b0e3877e65b39fce29dc803f692 hw.class test.class 76bac76730283b298fe67c5e301cf3f32d968e0a bagdfssda.class bagdfssdb.class c6c323e5ddc910799998fb99c62e1208206b4974 GsKm.class MSiwLyspDy.class Ohd.class uzKVWeBCX.class xCaY.class XWsSI.class ac521d5d407710d299c1e04ad89a204ddf38199f ism.class log.class tho.class af919ebcd537a7611f485263bdff0dbc0f9c9941 mob.class sob.class yok.class fe1107609523e5eb06c072fc93e304c2dc7302d2 zxoopw51ebita.class zxoopw51ebitb.class dff6a7a35e697e468a17db2403d2d5076e18cf4a nut.class toe.class vas.class
Once the exploit obtains full privileges on your computer, it may:
Run an executable file (that may be detected as malware) included in the JAR Run an executable file from (that may be detected as malware) a URL hard-coded in the exploit's file Take instructions from the HTML file (such as a URL to the malware executable) that loaded them Related information / Related references
The articles referenced below outline some of the technical details of the weakness this vulnerability exploits:
A technical analysis on new Java vulnerability (CVE-2012-5076) Oracle Java SE Critical Patch Update Advisory - October 2012
Analysis by Tanmay GanacharyaLast update 15 February 2019
