2

I'm scanning one of my systems with Clamav like this:

$ clamscan -r -i --remove --max-filesize=4000M --max-scansize=4000M \
     --exclude=/proc --exclude=/sys --exclude=/dev --bytecode-timeout=190000

It just found a virus in my download directory:

/home/user/Downloads/jdk-8u31-linux-x64.tar.gz: Java.Exploit.CVE_2013_2472 FOUND
/home/user/Downloads/jdk-8u31-linux-x64.tar.gz: Removed.

What is the damage from this kind of malware?

I downloaded this file from the official Oracle site, so I can't understand how it could be infected. Did someone manipulate this file before it entered my system and I installed some kind of malware on my Fedora?

I removed the Java in question from my system and activated openjdk from the repository.

Information from Oracle:

Excerpt:

CVE-2013-2472 Vulnerability in the Java Runtime Environment component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are 7 Update 21 and before, 6 Update 45 and before and 5.0 Update 45 and before. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution.

Note: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets.

CVSS Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C). (legend) [Advisory]

What are the procedures here, is this a Linux virus? Note "result in unauthorized Operating System takeover".

EDIT #1

Here are the scan results:

/home/user/Downloads/jdk-8u31-linux-x64.tar.gz: Java.Exploit.CVE_2013_2472 FOUND                                                        
/home/user/Downloads/jdk-8u31-linux-x64.tar.gz: Removed.
/usr/share/nmap/scripts/irc-unrealircd-backdoor.nse: Unix.Trojan.MSShellcode-21 FOUND
/usr/share/nmap/scripts/irc-unrealircd-backdoor.nse: Removed.
----------- SCAN SUMMARY -----------
Known viruses: 3791398
Engine version: 0.98.6
Scanned directories: 103265
Scanned files: 746031
Infected files: 2
Total errors: 18624
Data scanned: 330294.49 MB
Data read: 367850.33 MB (ratio 0.90:1)
Time: 33458.657 sec (557 m 38 s)
17 April 2015

ClamAV is saying that there were two infections, according to @dhag this is not the case and one is an exploit/vulnerability in Java.... I am curious as to why frequently the scan is removing scripts from the nmap directory. I suspect that that's not malware but has to do with something about the capability of the script.

4

I think that the message Java.Exploit.CVE_2013_2472 FOUND means that this installer is for a version of Java affected with the security bug you posted the description of.

If so, it's not a virus at all, just some piece of legit-but-dangerous software. I would say the message from ClamAV is a bit confusing, and the action of deleting the affected file may not be the most sensible, but that's open to debate.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.