Home / malware

PDF

Exploit:Java/CVE-2013-0431

First posted on 19 February 2019.
Source: Microsoft

Aliases :

Exploit:Java/CVE-2013-0431 is also known as Java/Exploit.Agent.NIF trojan, Troj/JavaDl-SA, JV/Blacole-FET!29A92C3EEDD7, Exploit-FET!CVE2013-0431, Troj/JavaDl-UG, Trojan.Maljava, JV/Blacole-FET!29A92C3EEDD7, Exploit-FET!CVE2013-0431, Exploit.CVE2013-0422.13, Exploit-FET!Exploit-JAR, Mal/JavaJar-B, JV/Blacole-FHA!949BD2B7DE14, Troj/JavaDl-FC, JAVA_EXPLOYT.BU, RDN/Generic Exploit!1mz, Troj/JavaDl-UL, Exploit.Java.458, JV/Blacole-FHA!D0BA98FA1FE3, Exploit.Java.461, JV/Blacole-FHA!23C205BE86D0, Java/Exploit.Agent.NLX trojan, JAVA_EXPLOIT.WT more.

Explanation :

Threat in context

Java is a general-purpose programming language, but cases of this exploit are targeted against the Java plug-in for web browsers. The intent of the Java plug-in is that Java programs (or "applets") can be offered by websites, and run in a "sandbox" where the Java plug-in enforces rules on what the Java applet can do so that it cannot escape restricted environment.

What is an exploit?

Exploits are written to take advantage of weaknesses (or vulnerabilities) in legitimate software. A project called Common Vulnerabilities and Exposures (or CVE) is used by many vendors and organizations and gives each vulnerability a unique number, in this case "CVE-2013-0431". The portion "2013" refers to the year the vulnerability was discovered, and "0431" is a unique identifier. There is more information on the Common Vulnerabilities and Exposures website.

Payload

Downloads and installs files

This exploit downloads and runs files from a remote server. The list of URLs used varies and are only active for a short time. The files that are downloaded can include other malware.

The exploits can run files from a hard-coded URL, or take instructions from the HTML file that loaded them - like loading a URL to run additional malware.

Additional information

Exploit:Java/CVE-2013-0431 uses a vulnerability that was first disclosed when Oracle released a patch in February 2013. The problem lies in the "com.sun.jmx.mbeanserver.Introspector" class which lets an insecure call to invoke a method of "java.lang.reflect.Method" class. An attacker can exploit this issue to bypass sandbox restrictions and run arbitrary code with elevated privileges.

The exploit attacks the security model instead of memory corruption issues. With memory corruption issues, the exploit is dependent on the specific CPU (Central Processing Unit) type and operating systems, and might be affected by mitigation technology like DEP (Data Execution Prevention) or ASLR (Address Space Layout Randomization).

Attacking the security model means that the exploit might be effective on any platform the Java interpreter is on; for example Windows, MacOS or Linux.

Usually the exploits are written using a few Java classes working together. The various class files are bundled into an archive called a JAR, which uses the ZIP file format. Every JAR contains a Manifest.MF file to identify itself to the Java Runtime Environment. Since it is usually found in every JAR, it won't be listed.

Below are some examples of files that exploit the vulnerability described in CVE-2013-0431:

53fe88cfa1405790d97684dc1a5e44c967b455ad bQLbvMvB.class HCbdWGC.class LmrKVvsU.class MWpWd.hmrf MzHCrXWlvg.class pCXrJlkjl.class YAW.class zEC.class cc18b9aceebdaa6b9c420bad230c418075160976 Asd.class codehex.class d.class hw.class Impossible.class RunnerGood.class test.class test2.class bef7ebd285841f0f064597e5d7dfb79d248ccde8 cfnD.class gcSo.class klowOWkGN.class lPgOyYffM.class sHARLdBue.class VbidYCG.hmrf YHMrMtQohR.class yMDIs.class 1a1607652fdd2e3a48ef8392dda559178998a194 BurkinoGoso.class codehex.class d.class hw.class Impossible.class RunnerGood.class 54b965557266f2fc29b674750d1f5cd27cdd6cd4 ddp.class DOkU.class EeUMUfASp.hmrf etwGk.class NQUzDuEIK.class PYJTIGaCe.class QkQoLAOA.class sfslGDub.class tOKIA.class 1c22ab90fe81db14d69c52596287f6f9e9f055e9 dmq.class dzsrrk.class lem.class mjcluzq.class oxnadowf.class pyt.class rt.class a0b32e4971d1b9c81dd7667e4db4e1d5cb3c98ad EGYMsp.class evJUJyJ.hmrf FSKdGyKTTW.class MJKMwLP.class oegqxHDVz.class PCMpjy.class QRdcLx.class rpjpq.class WHXNv.class 210fd654b32c33e18665df745e4ac39c9bf4eb01 a.class alj.class izemubql.class me.class vwxgngt.class xmd.class xp.class 874c6b1a64145f8c17f83b67eab71f3e9cc2fb2d acHthNK.class bgWMw.class cRdYJ.class efbUDeuaSC.class EqJHhipC.class irn.class lXVMM.class qqpiNAuCR.class SSuauhLQ.hmrf dd3f18743914eb75df98a2c3e3b053377888e662 g.class sox.class Y.ser

The following articles explain some of the technical details of the weakness this vulnerability exploits:

Oracle Java SE Critical Patch Update Advisory - February 2013

Analysis by Tanmay Ganacharya

Last update 19 February 2019

 

TOP