688116 - malware site can remotely execute code

Status: VERIFIED WORKSFORME

(Firefox :: Security, defect)

Description

[Alan]

User Agent: Mozilla/5.0 (Windows NT 6.0; rv:6.0.2) Gecko/20100101 Firefox/6.0.2
Build ID: 20110902133214

Steps to reproduce:

Logged on to http://financeuser-infostore.com/


Actual results:

It tried to execute malicious code - intercepted by my AV. I did not click on anything or download anything.


Expected results:

Nothing.

Comment 1

[Bob Clary [:bc] (inactive)]

Contains an iframe hosted at http://wxxhytjujqrtjklttff.cx.cc/main.php?page=6c9ce277482cac0d that uses a Java applet. Saving the file activates Security Essentials that flags this as Exploit:Win32/CVE-2010-1885.A

See http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Exploit%3AWin32%2FCVE-2010-1885.A

Alan, please make sure your Windows is up to date with security patches then visit https://www.mozilla.org/en-US/plugincheck/ to check your plugins and update any that are out of date, especially Java.

Comment 3

[Daniel Veditz [:dveditz]]

Malicious page is now gone, looks like a known Java exploit.