CriticalPublic exploit

Stack-based buffer overflow in Sun Java SE HsbParser.getSoundBank

IdentifiersCVE-2009-3867CWE-121

CVE-2009-3867 is a stack-based buffer overflow in the HsbParser.getSoundBank function in Sun Java SE. According to the provided content, the issue affects JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24. The vulnerability can be triggered via a long file: URL supplied in an argument, leading to memory corruption on the stack. The flaw is identified as Sun Bug Id 6854303. The provided description states that remote attackers may exploit this condition to execute arbitrary code.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows remote arbitrary code execution in the context of the affected Java process. Because the flaw is a stack-based buffer overflow, exploitation can result in control-flow hijacking and full compromise of the vulnerable application or client process handling the malicious input.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, reduce exposure to untrusted file: URL inputs and avoid processing attacker-controlled arguments that may reach HsbParser.getSoundBank. Limit execution of untrusted Java content and restrict delivery paths through which remote attackers can supply crafted file: URLs. These are temporary measures only; patching is the primary mitigation.

Remediation

Patch, then assume compromise.

Upgrade to a fixed Java release. The provided content indicates the issue is fixed in JDK/JRE 5.0 Update 22 and later, JDK/JRE 6 Update 17 and later, SDK/JRE 1.3.1_27 and later in the 1.3.x line, and SDK/JRE 1.4.2_24 and later in the 1.4.x line. Apply the relevant Oracle/Sun security updates for all affected systems.

PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (2 hidden).

VALID 1 / 3 TOTALView more in app

java_getsoundbank_bof.rbMaturityWeaponizedFrameworkmetasploitVerified exploit

This repository contains a single Metasploit module: 'java_getsoundbank_bof.rb', which exploits a buffer overflow vulnerability (CVE-2009-3867) in the getSoundbank function of the Sun Java JRE. The exploit is weaponized and acts as a malicious HTTP server, serving a crafted Java applet (CVE-2009-3867.jar) to victims who visit the attacker's web page. The module supports multiple platforms (Windows and Mac OS X) and architectures (x86, PPC), and allows the attacker to deliver a native payload (such as a reverse shell) to the victim. The exploit targets users running vulnerable versions of Sun Java JRE with browser plugin enabled. The structure is typical for a Metasploit browser exploit: it includes HTTP server logic, target selection based on User-Agent, and dynamic payload delivery via a Java applet. The only fingerprintable endpoint is the malicious JAR file served to the victim. The module is operational and can be used to achieve remote code execution on affected systems.

Disclosed Nov 4, 2009rubybrowser

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

SunJdkapplication

SunJreapplication

SunSdkapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

contagiodump blogNews

May 12, 2015

contagio: An Overview of Exploit Packs (Update 25) May 2015

An older vulnerability included in Siberia Private according to the table.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity