I'm scanning one of my systems with Clamav like this:
$ clamscan -r -i --remove --max-filesize=4000M --max-scansize=4000M \ --exclude=/proc --exclude=/sys --exclude=/dev --bytecode-timeout=190000
It just found a virus in my download directory:
/home/user/Downloads/jdk-8u31-linux-x64.tar.gz: Java.Exploit.CVE_2013_2472 FOUND /home/user/Downloads/jdk-8u31-linux-x64.tar.gz: Removed.
What is the damage from this kind of malware?
I downloaded this file from the official Oracle site, so I can't understand how it could be infected. Did someone manipulate this file before it entered my system and I installed some kind of malware on my Fedora?
I removed the Java in question from my system and activated openjdk from the repository.
Information from Oracle:
CVE-2013-2472 Vulnerability in the Java Runtime Environment component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are 7 Update 21 and before, 6 Update 45 and before and 5.0 Update 45 and before. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution.
Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets.
CVSS Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C). (legend) [Advisory]
What are the procedures here, is this a Linux virus? Note "result in unauthorized Operating System takeover".
Here are the scan results:
/home/user/Downloads/jdk-8u31-linux-x64.tar.gz: Java.Exploit.CVE_2013_2472 FOUND /home/user/Downloads/jdk-8u31-linux-x64.tar.gz: Removed. /usr/share/nmap/scripts/irc-unrealircd-backdoor.nse: Unix.Trojan.MSShellcode-21 FOUND /usr/share/nmap/scripts/irc-unrealircd-backdoor.nse: Removed. ----------- SCAN SUMMARY ----------- Known viruses: 3791398 Engine version: 0.98.6 Scanned directories: 103265 Scanned files: 746031 Infected files: 2 Total errors: 18624 Data scanned: 330294.49 MB Data read: 367850.33 MB (ratio 0.90:1) Time: 33458.657 sec (557 m 38 s) 17 April 2015
ClamAV is saying that there were two infections, according to @dhag this is not the case and one is an exploit/vulnerability in Java.... I am curious as to why frequently the scan is removing scripts from the nmap directory. I suspect that that's not malware but has to do with something about the capability of the script.