What does PA & GV stand for in Java/CVE-2008-5353.PA and Java/CVE-2009-3867.GV exploits?

Question

What does PA & GV stand for in Java/CVE-2008-5353.PA and Java/CVE-2009-3867.GV exploits? Is there a reference chart for these cryptic acronyms? I was doing some research, and I spotted Java/CVE-2008-5353.D, and supposedly D means Trojan Horse.

In a more general question, can these Java exploits/virus run even when Java runtime doesn't appear to be active on Windows?

The background information here is that ING recently deactivated my bank account, citing the reason that my computer has malwares. I proceeded to virus scan with Microsoft Safety Scanner, and found these aforementioned exploits. But I for the life of me can't figure out how severe the viruses are (Whether my password has been stolen or not).

Thanks for reading.

Answer 1

I don't think the suffixes necessarily stand for anything - if you look, for example, at this Microsoft Security web page listing the various malware packages covered by an update, it looks like the suffix just indicates the sequence number of the fix within some larger bundle of fixes.

For example, look at this set of fixes:

 Exploit:Java/CVE-2008-5353.OX  Severe
 Exploit:Java/CVE-2008-5353.OY  Severe 
 Exploit:Java/CVE-2008-5353.OZ  Severe 
 Exploit:Java/CVE-2008-5353.PA  Severe 
 Exploit:Java/CVE-2008-5353.PB  Severe 
 Exploit:Java/CVE-2008-5353.PC  Severe

I don't think the suffixes in this case identify a particular type of fix, I believe they just identify their sequence number in the fix for this CVE issue, which is described as

The Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier does not properly enforce context of ZoneInfo objects during deserialization, which allows remote attackers to run untrusted applets and applications in a privileged context, as demonstrated by "deserializing Calendar objects".

In general, I don't think a Java exploit can be triggered without Java running. However, if an attacker uses a Java exploit to install some native malware, then you still have a problem even though the JRE might not be running anymore.

Answer 2

I'm actually the (unhappy) author of CVE-2008-5353. It's a Java sandbox privilege escalation vulnerability. Meaning Java is supposed to not let unsigned applets do anything harmful to your machine, but there was a flaw in the logic that allowed one to bypass security. While it would be possible to create pure-java malware with this vulnerability, AFAIK these are basically just downloaders, they run just once and drop several native nasties on your machine, and those are the problem. They might be trojans, bankers, RATs, there's really no way of knowing.

The Java malware gets stored in the Java cache where the AVs see it and report it.

Basically, only rather old versions of Java are vulnerable. If, at the time of "infection", you had Java 6 update 11 (released in December of 2008, if memory serves) or newer, the code may have never run successfully. The malicious applet could have been downloaded to your cache, it could have been run, and your newer Java would have just not let it do anything out of the ordinary, but the AVs would still find the malicious applet in your cache.

If your Java version really is Java 6 update 10 or earlier, it would really be a good idea to update it to the latest version, to protect you from future infections from these particular problems.