FILE-JAVA -- Snort has detected traffic targeting vulnerabilities that are exploited in java files such as .class or .jar.
FILE-JAVA Oracle Java JPEGImageWriter memory corruption attempt
This event is generated when an Oracle Java JPEGImageWriter memory corruption attempt is detected.
Attempted User Privilege Gain
Ease of Attack:
What To Look For
Event is triggered by vulnerability in Oracle Java JPEGImageWriter, due to improper locking of the state of the class as defined by its private properties, when a specially crafted Java file is seen across traffic.
No public information
No known false positives
Cisco Talos Intelligence Group
MITRE ATT&CK Framework
Technique: Exploitation for Client Execution
For reference, see the MITRE ATT&CK vulnerability types here:
Memory Corruption is any vulnerability that allows the modification of the content of memory locations in a way not intended by the developer. Memory corruption results are inconsistent; they could lead to fatal errors and system crashes or data leakage; some have no effect at all.
CVE Additional Information
CVE-2013-2429Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to ImageIO. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "JPEGImageWriter state corruption" when using native code, which triggers memory corruption.
||Ease of Access||