This is a demo of the Java 0-Day Vulnerability made public on 08-26-2012 (now CVE-2012-4681): http://youtu.be/HO4yO7_5sEc?hd=1 (watch in HD)
This vulnerability was found being exploited in the wild and discovered by Michael Schierl.
This exploit was written based on the PoC published by @jduck1337 at http://pastie.org/pastes/4594319/text
Tested on Windows 7 with Internet Explorer, Firefox and Chrome (keep in mind this affects Java on all platforms)
The exploit is extremely easy to implement, not much needs to be changed from the public PoC besides adding code to drop a payload.
References:
http://blog.fireeye.com/research/2012/08/zero-day-season-is-not-over-yet.html
http://www.deependresearch.org/2012/08/java-7-0-day-vulnerability-information.html
http://immunityproducts.blogspot.com.ar/2012/08/java-0day-analysis-cve-2012-4681.html
No comments:
Post a Comment