Two new Java zero-day vulnerabilities reported to Oracle

A Polish security firm 'Security Explorations' reported two new Java zero-day vulnerabilities, as “issue 54” and “issue 55,” with proof of concept code to Oracle.

Oracle's security team is currently investigating the issue, but the status flaws not yet confirmed by Oracle. Less than a week after Oracle released its latest Java critical patch update, Researcher and Security Explorations's CEO Adam Gowdiak have found two previously unknown security issues affecting Java 7.

Security experts generally advise users to disable the Java browser plugin, which was exploited in recent targeted attacks on developers at Facebook, Apple and Microsoft.

Java has faced an increasing number of zero-day vulnerabilities, bugs that are exploited by criminals before those flaws are patched, or even known by the vendor.

Exploiting Java Applet AverageRangeStatisticImpl Remote Code Execution.

Hoy 23 de Enero, Oracle nuevamente es blanco de los "Hackers", pues se ha publicado una nueva vulnerabilidad que afectan a las versiones de Java 7u7-10 y anteriores, permitiendo a un atacante ejecutar código remoto en el sistema de la victima (Windows - Linux - MAC), para ello el equipo de Metasploit ha desarrollado un modulo denominado java_jre17_glassfish_averagerangestatisticimpl que facilita el trabajo a un atacante en el proceso de explotacion de esta nueva vulnerabilidad.

El respectivo modulo se puede obtener con tal solo ejecutar el comando msfupdate y los pasos para aprovecharse de esta vulnerabilidad, son los siguientes:

REQUERIMIENTOS:

BackTrack 5 R1 - R2 o R3 (Atacante)
Metasploit Framework (Atacante)
Windows XP - 7 - 8 (Victima)
Java 7 Update 10 (Victima)