I'm scanning one of my systems with Clamav like this:$ clamscan -r -i --remove --max-filesize=4000M --max-scansize=4000M \     --exclude=/proc --exclude=/sys --exclude=/dev --bytecode-timeout=190000It just found a virus in my download directory:/home/user/Downloads/jdk-8u31-linux-x64.tar.gz: Java.Exploit.CVE_2013_2472 FOUND/home/user/Downloads/jdk-8u31-linux-x64.tar.gz: Removed.What is the damage from this kind of malware?I downloaded this file from the official Oracle site, so I can't understand how it could be infected. Did someone manipulate this file before it entered my system and I installed some kind of malware on my Fedora?I removed the Java in question from my system and activated openjdk from the repository.Information from Oracle:Excerpt:CVE-2013-2472 Vulnerability in the Java Runtime Environment component  of Oracle Java SE (subcomponent: 2D). Supported versions that are  affected are 7 Update 21 and before, 6 Update 45 and before and 5.0  Update 45 and before. Easily exploitable vulnerability allows  successful unauthenticated network attacks via multiple protocols.  Successful attack of this vulnerability can result in unauthorized  Operating System takeover including arbitrary code execution.Note: Applies to client deployment of Java only. This vulnerability  can be exploited only through sandboxed Java Web Start applications  and sandboxed Java applets.CVSS Base Score 10.0 (Confidentiality, Integrity and Availability  impacts). CVSS V2 Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C). (legend)  [Advisory]What are the procedures here, is this a Linux virus? Note result in unauthorized Operating System takeover.EDIT #1Here are the scan results:/home/user/Downloads/jdk-8u31-linux-x64.tar.gz: Java.Exploit.CVE_2013_2472 FOUND                                                        /home/user/Downloads/jdk-8u31-linux-x64.tar.gz: Removed./usr/share/nmap/scripts/irc-unrealircd-backdoor.nse: Unix.Trojan.MSShellcode-21 FOUND/usr/share/nmap/scripts/irc-unrealircd-backdoor.nse: Removed.----------- SCAN SUMMARY -----------Known viruses: 3791398Engine version: 0.98.6Scanned directories: 103265Scanned files: 746031Infected files: 2Total errors: 18624Data scanned: 330294.49 MBData read: 367850.33 MB (ratio 0.90:1)Time: 33458.657 sec (557 m 38 s)17 April 2015ClamAV is saying that there were two infections, according to @dhag this is not the case and one is an exploit/vulnerability in Java.... I am curious as to why frequently the scan is removing scripts from the nmap directory. I suspect that that's not malware but has to do with something about the capability of the script.
Exploit FOUND with clamav on Fedora 21 in Oracle's java
fedora;security;malware;jdk;clamav
I think that the message Java.Exploit.CVE_2013_2472 FOUND means thatthis installer is for a version of Java affected with the security bugyou posted the description of.If so, it's not a virus at all, just some piece of legit-but-dangeroussoftware. I would say the message from ClamAV is a bit confusing, andthe action of deleting the affected file may not be the most sensible,but that's open to debate.