cbcvebase.
CVE-2015-2590
published 2015-07-16

CVE-2015-2590: Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality…

PriorityP189critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITW
CISA Known Exploited Vulnerabilitydue 2022-03-24
Exploited in the wild
EPSS
25.47%
97.7th percentile
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2015-4732.

Affected

66 ranges· showing 25
VendorProductVersion rangeFixed in
canonicalubuntu_linux
canonicalubuntu_linux
canonicalubuntu_linux
debiandebian_linux
debiandebian_linux
debianopenjdk-8< openjdk-8 8u66-b01-1 (sid)openjdk-8 8u66-b01-1 (sid)
opensuseopensuse
opensuseopensuse
oraclejdk
oraclejdk
oraclejdk
oraclejre
oraclejre
oraclejre
redhatenterprise_linux_desktop
redhatenterprise_linux_desktop
redhatenterprise_linux_desktop
redhatenterprise_linux_eus
redhatenterprise_linux_eus
redhatenterprise_linux_eus
redhatenterprise_linux_eus
redhatenterprise_linux_eus
redhatenterprise_linux_eus
redhatenterprise_linux_eus
redhatenterprise_linux_for_ibm_z_systems

Detection & IOCsextracted from sources · hover to see the quote

path/PhantomSuper.class
snort
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Possible Java/Downloader Observed in Pawn Storm CVE-2015-2590 1"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/PhantomSuper.class"; fast_pattern; http.header; content:"Java/"; http.header_names; to_lowercase; content:!"\|0d 0a\|referer\|0d 0a\|"; reference:url,blog.trendmicro.com/trendlabs-security-intelligence/an-in-depth-look-at-how-pawn-storms-java-zero-day-was-used/; classtype:trojan-activity; sid:2021557; rev:4; metadata:created_at 2015_07_31, cve CVE_2015_2590, confidence Medium, signature_severity Major, tag CISA_KEV, updated_at 2024_04_20;)
  • Exploit delivery involves an HTTP GET request to fetch '/PhantomSuper.class' — a malicious Java class file associated with the Pawn Storm campaign exploiting CVE-2015-2590. Network detection should alert on outbound GET requests for this URI path.
  • Exploit traffic is identifiable by the presence of a 'Java/' string in HTTP request headers (User-Agent or similar), combined with the absence of a Referer header — indicating a direct, non-browser-initiated Java class fetch.
  • The root cause is a deserialization issue in ObjectInputStream.readSerialData() (bug 8076401). Detection of untrusted Java deserialization payloads targeting the Libraries component is relevant.
  • ·The Emergent Threats (ET) Snort rule (sid:2021557) targets outbound traffic from $HOME_NET to $EXTERNAL_NET. Ensure HOME_NET is correctly scoped to your environment to avoid missed detections on internal lateral movement.
  • ·The vulnerability is described as 'unspecified' with 'unknown vectors' by Oracle, meaning behavioral/network indicators (like the PhantomSuper.class fetch) from observed campaigns are the primary detection surface rather than a fully documented exploit mechanism.

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
osv9.8CRITICAL
vulncheck9.8CRITICAL
cisa9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_redhat9.8CRITICAL
vendor_ubuntu9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.