rapid7/metasploit-framework — pull request #178 by juanvazquez (2012-02-15 22:40:22+00:00)
Title: Added CVE-2010-0842

I would like to make a contribution to metasploit with a module for "CVE-2010-0842: Sun Java Runtime Environment MixerSequencer Invalid Array Index Remote Code Execution Vulnerability" with the hope you find it useful.

It's a little old vulnerability but it seems exploited by the "hierarchy" exploit kit (http://malwareint.blogspot.com/2012/01/hierarchy-exploit-pack-new-crimeware.html). So I suppose it could be useful to someone for testing :). I haven't found it on msf.

I've tested on:
Windows XP SP3 / IE 6 / Java 6u18
Windows XP SP3 / IE 7 / Java 6u18
Windows XP SP3 / IE 8 / Java 6u18
Windows XP SP3 / Firefox 7.0.1 / Java 6u18
Windows XP SP3 / IE 8 / Java 6u17
Windows XP SP3 / Firefox 7.0.1 / Java 6u17
Windows 7 / IE 8 / Java 6u18

Finally I'm learning and training exploit writing and metasploit dev so any feedback is welcome!

Regards,

juan

(PD: All credits to Peter Vreugdenhil. He did an awesome research with this vulnerability!!)