Attacks/Breaches
2/11/2013
11:13 AM
50%
50%

Adobe Issues Emergency Patch For Flash Player

As attackers actively target new bugs in Flash Player browser plug-in, Adobe issues Windows, Mac, Linux and Android patches.

Adobe has issued emergency updates for Adobe Flash Player to fix flaws that are being actively exploited by attackers. The vulnerabilities affect versions of Flash Player running on Windows, Mac OS X, Linux and Android.

The two bugs (CVE-2013-0633 and CVE-2013-0634) allow attackers to run arbitrary code on a targeted system and compromise that system. "Failed exploit attempts will likely result in denial-of-service conditions," read an overview of the attacks published by Symantec.

The first vulnerability, which targets the ActiveX version of Flash Player for Windows, "is being exploited in the wild in targeted attacks designed to trick the user into opening a Microsoft Word document delivered as an email attachment which contains malicious Flash (SWF) content," according to a security warning published by Adobe.

The second vulnerability, meanwhile, is being used in drive-by attacks from websites that target browsers with malicious Flash content. To date, the attacks have targeted OS X versions of Flash Player running Firefox and Safari on the Mac OS X platform. Attackers are also using the vulnerability to target Windows users via Microsoft Word documents -- attached to emails -- that include malicious Flash content.

[ Here's what you need to know about the recent Java security breaches. Read Java Security Warnings: Cut Through The Confusion. ]

Vulnerable software includes Flash Player 11.5.502.146 (and earlier) for both Windows and Mac OS X, Flash Player 11.2.202.261 (and earlier) for Linux, Flash Player 11.1.115.36 (and earlier) for Android 4.x, and Flash Player 11.1.111.31 (and earlier) for Android 3.x and 2.x. Flash users can visit the About Flash Player page on Adobe's website to review which version of Flash they're running. "If you use multiple browsers, perform the check for each browser you have installed on your system," Adobe advised. Flash updates, meanwhile, can be obtained from the Adobe Flash Player download page.

Information security firm FireEye said it first witnessed the in-the-wild attacks that are exploiting the two vulnerabilities on Tuesday. The Word files contain a macro to load an embedded SWF flash object, according to an overview of the attacks published by FireEye. The SWF file contains an action script with the name 'LadyBoyle' that contains the exploit code.

Interestingly, the code and documents used in the attacks were respectively compiled and created Tuesday, and while the contents of the documents are written in English, the files' code pages are set to Windows Simplified Chinese (PRC, Singapore).

Despite attackers actively targeting two new zero-day vulnerabilities in Flash Player, Adobe said that it's been putting changes in place that make it more difficult for attackers to exploit newly discovered Flash bugs. Those changes have included sandboxing, working with browser makers and operating system developers to deliver Flash updates -- and disable older versions of Flash -- and hardening applications that are used to disguise Flash attacks.

"Over the last year, Adobe has been driving down the number of Flash-based zero-days used in the wild," said Peleus Uhley, a senior security researcher within the Secure Software Engineering team at Adobe, in a blog post. "Since the introduction of Adobe Reader X Protected Mode (aka sandboxing) in November 2010, the most common Flash Player zero-day attack vector has been malicious Flash content embedded in Microsoft Office documents and delivered via email."

To address that threat, Microsoft created a Protected Mode sandbox in Microsoft Office 2010 that prevents Flash content in Office documents from executing automatically, if the document originated in either an Internet or Untrusted Zone. But no such safeguards exist in Office 2008, so if a user opens a malicious document any Flash content included in the document will execute automatically.

New features built into the next major release of Flash, which is currently being beta tested, should make it more difficult to attack systems running Microsoft Office 2008 or earlier. "The upcoming release of Flash Player will determine whether Flash Player is being launched within Microsoft Office and check the version of Office," said Uhley. "If Flash Player is launched within a version prior to Office 2010, Flash Player will prompt the end user before executing the Flash content, [displaying a warning that recommends that the content not be allowed to play]."

Risk management is all the rage for handling security today, but it's a practice fraught with misconceptions and challenges. In the special Avoid Risky Business By Getting A Grip On Your Real Threats retrospective, Dark Reading takes a look at best practices, new technologies, common missteps -- and the added risks associated with the cloud and mobile devices coming in and out of the enterprise. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
AustinIT
50%
50%
AustinIT,
User Rank: Apprentice
2/11/2013 | 7:37:25 PM
re: Adobe Issues Emergency Patch For Flash Player
You mean Office 2007?

I suppose 2008 counts... MAC version...
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "Why else would HR ask me if I have a handicap?"
Current Issue
The Changing Face of Identity Management
Mobility and cloud services are altering the concept of user identity. Here are some ways to keep up.
Flash Poll
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio

The cybersecurity profession struggles to retain women (figures range from 10 to 20 percent). It's particularly worrisome for an industry with a rapidly growing number of vacant positions.

So why does the shortage of women continue to be worse in security than in other IT sectors? How can men in infosec be better allies for women; and how can women be better allies for one another? What is the industry doing to fix the problem -- what's working, and what isn't?

Is this really a problem at all? Are the low numbers simply an indication that women do not want to be in cybersecurity, and is it possible that more women will never want to be in cybersecurity? How many women would we need to see in the industry to declare success?

Join Dark Reading senior editor Sara Peters and guests Angela Knox of Cloudmark, Barrett Sellers of Arbor Networks, Regina Wallace-Jones of Facebook, Steve Christey Coley of MITRE, and Chris Roosenraad of M3AAWG on Wednesday, July 13 at 1 p.m. Eastern Time to discuss all this and more.