Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

What does PA & GV stand for in Java/CVE-2008-5353.PA and Java/CVE-2009-3867.GV exploits? Is there a reference chart for these cryptic acronyms? I was doing some research, and I spotted Java/CVE-2008-5353.D, and supposedly D means Trojan Horse.

In a more general question, can these Java exploits/virus run even when Java runtime doesn't appear to be active on Windows?

The background information here is that ING recently deactivated my bank account, citing the reason that my computer has malwares. I proceeded to virus scan with Microsoft Safety Scanner, and found these aforementioned exploits. But I for the life of me can't figure out how severe the viruses are (Whether my password has been stolen or not).

Thanks for reading.

share|improve this question

2 Answers 2

up vote 2 down vote accepted

I don't think the suffixes necessarily stand for anything - if you look, for example, at this Microsoft Security web page listing the various malware packages covered by an update, it looks like the suffix just indicates the sequence number of the fix within some larger bundle of fixes.

For example, look at this set of fixes:

 Exploit:Java/CVE-2008-5353.OX  Severe
 Exploit:Java/CVE-2008-5353.OY  Severe 
 Exploit:Java/CVE-2008-5353.OZ  Severe 
 Exploit:Java/CVE-2008-5353.PA  Severe 
 Exploit:Java/CVE-2008-5353.PB  Severe 
 Exploit:Java/CVE-2008-5353.PC  Severe

I don't think the suffixes in this case identify a particular type of fix, I believe they just identify their sequence number in the fix for this CVE issue, which is described as

The Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier does not properly enforce context of ZoneInfo objects during deserialization, which allows remote attackers to run untrusted applets and applications in a privileged context, as demonstrated by "deserializing Calendar objects".

In general, I don't think a Java exploit can be triggered without Java running. However, if an attacker uses a Java exploit to install some native malware, then you still have a problem even though the JRE might not be running anymore.

share|improve this answer
    
Thank you for the response. To be honest, the Microsoft Security page is really good for nothing. It gives you no details or any researches on what the virus does. The word "Severe" just doesn't cut it. I have marked your answered as accepted. Thanks –  Antony May 14 '11 at 1:02
    
+1 makes sense about the nomenclature. –  Sami Koivu May 14 '11 at 9:19

I'm actually the (unhappy) author of CVE-2008-5353. It's a Java sandbox privilege escalation vulnerability. Meaning Java is supposed to not let unsigned applets do anything harmful to your machine, but there was a flaw in the logic that allowed one to bypass security. While it would be possible to create pure-java malware with this vulnerability, AFAIK these are basically just downloaders, they run just once and drop several native nasties on your machine, and those are the problem. They might be trojans, bankers, RATs, there's really no way of knowing.

The Java malware gets stored in the Java cache where the AVs see it and report it.

Basically, only rather old versions of Java are vulnerable. If, at the time of "infection", you had Java 6 update 11 (released in December of 2008, if memory serves) or newer, the code may have never run successfully. The malicious applet could have been downloaded to your cache, it could have been run, and your newer Java would have just not let it do anything out of the ordinary, but the AVs would still find the malicious applet in your cache.

If your Java version really is Java 6 update 10 or earlier, it would really be a good idea to update it to the latest version, to protect you from future infections from these particular problems.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.