Threat Description

Exploit

Details

Aliases: Java.Exploit.CVE-, Exploit.Java.cve-, Java.trojan.exploit., Exploit.js., exploit.html, Exploit kit
Category: Malware
Type: Exploit
Platform: W32

Summary


A program or technique that takes advantage of a vulnerability to remotely access or attack a program, computer or server.



Removal


Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.

More scanning & removal options

More information on scanning or removal options is available in the documentation for your F-Secure security product on the Downloads section of our Home - Global site.

You may also refer to the Knowledge Base on the F-Secure Community site for further assistance.

Vulnerability Protection

The vulnerabilities leveraged by the exploits are usually application or platform specific; in other words, a specific program (or even a specific version of a particular program) must be installed on the machine in order for the exploit to be effective.

To prevent exploitation of such vulnerabilities, please refer to the application vendor for the latest updates and additional advice.


Manually Clearing Temporary or Cache Folders

In some cases, an infected file, or archive file containing infected files, is detected inside a temporary or cache folder. For instructions on dealing with such an infection, see:





Suspect A False Alarm?

If you suspect a file has been incorrectly identified as malicious, (that is, it is a False Alarm or a False Positive), please first ensure your F-Secure security program is up-to-date with the latest detection database updates, then rescan the suspect file.

If you continue to suspect a False Alarm, you may submit a sample of the suspect file to our Security Labs for further analysis via the Sample Analysis System (SAS).






Technical Details


In computer security terms, an exploit is an object - a program, a section of code, even a string of characters - that takes advantage of a vulnerability in a program or operating system to perform various actions. An exploit is almost always used in a malicious context.

If successfully used, exploits can provide an attacker with a wide range of possible actions, from viewing data on a restricted-user database to almost complete control of a compromised system.

For examples of exploits on various platfoms, see the following:

Note that some exploit detection names indicate the vulnerability involved, such as:

  • Exploit.Java.CVE-2012-0507

Where 'CVE-2012-0507' is the name used by the CVE - Common Vulnerabilities and Exposures (CVE) organization to identify the specific vulnerability targeted by the exploit.

Exploit Kits

An exploit kit is a toolkit that contains exploit code for multiple vulnerabilities, either in an operating system or in common, popular programs. Exploit kits are often planted by attackers on malicious or compromised legitimate websites, where they can silently probe the devices of visitors to that site.

If the exploit kit is able to successfully use one of its exploits against a visitor's vulnerable machine, it can then proceed with its actual malicious payload, which may range from installing components on the affected system, stealing data and so on.

Exploit kits are created to be easily updated with the latest exploits for newly discovered vulnerabilities, making it easy for the kit operators to keep them effective for use.

Examples of exploit kits include AnglerEK, Fiesta, Styx, SweetOrange, Archie and Astrum. For more information on these kits:

Vulnerability Protection

Further information on the most common vulnerabilities found in most programs may be found at:






SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More