Java MBeanInstantiator.findClass 0Day Analysis

[Nytro]

Java

MBeanInstantiator.findClass

0Day Analysis

January, 2013

Esteban Guillardoy

Table of Contents
Introduction.......................................................................................................................................... 3
MbeanInstantiator.findClass vulnerability........................................................................................... 3
Affected Versions.............................................................................................................................4
Recursive Reflection Vulnerability (technique?)................................................................................. 4
Exploitation Technique.........................................................................................................................5
References............................................................................................................................................ 6

Introduction

Another Java 0day! On one hand, this is exciting because it effects a lot of people and is therefor

important. But there have been many instances of Java vulnerabilities coming out – and if someone

does not have Java disabled by now, they are probably already infected. It's worth noting that unlike

some Java vulnerabilities in the past, this one was first discovered when it was included in

“commercial” malware packages, which were then linked to by ad-farms on legitimate sites, and

used in mass malware installation campaigns.

So even if your organization is quite far ahead when it comes to disabling or limited Java on your

workstations, the particulars of the exploit are interesting because they may give hints as to how

future Java (or .Net or Flash or other VM's with sandboxes) will suffer in the future.

This is also the reason why we include an entire day of Java Sandbox Analysis in the upcoming

INFILTRATE Master Class in April here in Miami Beach. It teaches you how to think about these

problems, and nothing makes a better case study than an 0day.

Once again the exploit is using 2 vulnerabilities together with an exploitation technique in order to

fully exploit a target. We will analyze both below.

Download:

https://partners.immunityinc.com/idocs/Java%20MBeanInstantiator.findClass%200day%20Analysis.pdf