Java exploit added to Metasploit
A new exploit for a recently fixed vulnerability in Java has been added to the Metasploit penetration testing framework, according to vulnerability management firm Rapid7, which owns the open-source Metasploit Project.
The exploit takes advantage of a flaw in the Java Runtime Environment (JRE) component in Oracle Java SE JDK and JRE 7 and 6 Update 27 and earlier versions, according to a vulnerability summary. Users can unknowingly become infected simply by visiting a malicious website.
"It's essentially zero-knowledge from the user's perspective," Jonathan Cran, director of quality assurance for the Metasploit Project, said. "It runs on their computer without them even realising it." The exploit showed up in BlackHole exploit kit, an off-the-shelf software package used to install a range of malware, so Metasploit handlers decided to include it to raise awareness.
