{"id":4453,"date":"2012-04-16T12:34:04","date_gmt":"2012-04-16T19:34:04","guid":{"rendered":"http:\/\/www.intego.com\/mac-security-blog\/?p=4453"},"modified":"2016-02-12T10:17:30","modified_gmt":"2016-02-12T18:17:30","slug":"sabpab-backdoor-exploits-java-vulnerability","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/sabpab-backdoor-exploits-java-vulnerability\/","title":{"rendered":"SabPab Backdoor Exploits Java Vulnerability"},"content":{"rendered":"

Yet another malware has been found to exploit the CVE-2012-0507 Java vulnerability with a drive by download. SabPab is a backdoor that seeks to connect to remote command and control servers, presumably to harvest information on infected Macs. This malware installs in the user’s \/Library\/LaunchAgents folder, so no administrator password is needed. It places its code in the user’s \/Library\/Preferences folder (the com.apple.PubSabAgent.pfile):<\/p>\n


\n\"\"<\/center>Initially, the command and control server that this malware tried to connect to was off-line, but Intego’s malware researchers have found it to be accessible today. Intego has seen a few samples, but this malware does not yet seem to be widely distributed, and the risk is low.<\/p>\n

It is worth noting that the Java vulnerability this malware uses was patched by Apple ten days ago<\/a>. So Mac users should make sure that they have their Java up to date.<\/p>\n

Intego’s Mac antivirus, VirusBarrier X6<\/a> with malware definitions dated April 12, 2012 or later, will detect and remove the SabPab backdoor.<\/p>\n","protected":false},"excerpt":{"rendered":"

Yet another malware has been found to exploit the CVE-2012-0507 Java vulnerability with a drive by download. <\/p>\n","protected":false},"author":3,"featured_media":8755,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[190],"tags":[52,75,86,315,144],"class_list":["post-4453","post","type-post","status-publish","format-standard","has-post-thumbnail","category-malware","tag-exploit","tag-java","tag-mac-malware","tag-sabpab","tag-vulnerability"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t