Attacks/Breaches
2/11/2013
11:13 AM
Connect Directly
RSS
E-Mail
50%
50%

Adobe Issues Emergency Patch For Flash Player

As attackers actively target new bugs in Flash Player browser plug-in, Adobe issues Windows, Mac, Linux and Android patches.

Adobe has issued emergency updates for Adobe Flash Player to fix flaws that are being actively exploited by attackers. The vulnerabilities affect versions of Flash Player running on Windows, Mac OS X, Linux and Android.

The two bugs (CVE-2013-0633 and CVE-2013-0634) allow attackers to run arbitrary code on a targeted system and compromise that system. "Failed exploit attempts will likely result in denial-of-service conditions," read an overview of the attacks published by Symantec.

The first vulnerability, which targets the ActiveX version of Flash Player for Windows, "is being exploited in the wild in targeted attacks designed to trick the user into opening a Microsoft Word document delivered as an email attachment which contains malicious Flash (SWF) content," according to a security warning published by Adobe.

The second vulnerability, meanwhile, is being used in drive-by attacks from websites that target browsers with malicious Flash content. To date, the attacks have targeted OS X versions of Flash Player running Firefox and Safari on the Mac OS X platform. Attackers are also using the vulnerability to target Windows users via Microsoft Word documents -- attached to emails -- that include malicious Flash content.

[ Here's what you need to know about the recent Java security breaches. Read Java Security Warnings: Cut Through The Confusion. ]

Vulnerable software includes Flash Player 11.5.502.146 (and earlier) for both Windows and Mac OS X, Flash Player 11.2.202.261 (and earlier) for Linux, Flash Player 11.1.115.36 (and earlier) for Android 4.x, and Flash Player 11.1.111.31 (and earlier) for Android 3.x and 2.x. Flash users can visit the About Flash Player page on Adobe's website to review which version of Flash they're running. "If you use multiple browsers, perform the check for each browser you have installed on your system," Adobe advised. Flash updates, meanwhile, can be obtained from the Adobe Flash Player download page.

Information security firm FireEye said it first witnessed the in-the-wild attacks that are exploiting the two vulnerabilities on Tuesday. The Word files contain a macro to load an embedded SWF flash object, according to an overview of the attacks published by FireEye. The SWF file contains an action script with the name 'LadyBoyle' that contains the exploit code.

Interestingly, the code and documents used in the attacks were respectively compiled and created Tuesday, and while the contents of the documents are written in English, the files' code pages are set to Windows Simplified Chinese (PRC, Singapore).

Despite attackers actively targeting two new zero-day vulnerabilities in Flash Player, Adobe said that it's been putting changes in place that make it more difficult for attackers to exploit newly discovered Flash bugs. Those changes have included sandboxing, working with browser makers and operating system developers to deliver Flash updates -- and disable older versions of Flash -- and hardening applications that are used to disguise Flash attacks.

"Over the last year, Adobe has been driving down the number of Flash-based zero-days used in the wild," said Peleus Uhley, a senior security researcher within the Secure Software Engineering team at Adobe, in a blog post. "Since the introduction of Adobe Reader X Protected Mode (aka sandboxing) in November 2010, the most common Flash Player zero-day attack vector has been malicious Flash content embedded in Microsoft Office documents and delivered via email."

To address that threat, Microsoft created a Protected Mode sandbox in Microsoft Office 2010 that prevents Flash content in Office documents from executing automatically, if the document originated in either an Internet or Untrusted Zone. But no such safeguards exist in Office 2008, so if a user opens a malicious document any Flash content included in the document will execute automatically.

New features built into the next major release of Flash, which is currently being beta tested, should make it more difficult to attack systems running Microsoft Office 2008 or earlier. "The upcoming release of Flash Player will determine whether Flash Player is being launched within Microsoft Office and check the version of Office," said Uhley. "If Flash Player is launched within a version prior to Office 2010, Flash Player will prompt the end user before executing the Flash content, [displaying a warning that recommends that the content not be allowed to play]."

Risk management is all the rage for handling security today, but it's a practice fraught with misconceptions and challenges. In the special Avoid Risky Business By Getting A Grip On Your Real Threats retrospective, Dark Reading takes a look at best practices, new technologies, common missteps -- and the added risks associated with the cloud and mobile devices coming in and out of the enterprise. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
AustinIT
50%
50%
AustinIT,
User Rank: Apprentice
2/11/2013 | 7:37:25 PM
re: Adobe Issues Emergency Patch For Flash Player
You mean Office 2007?

I suppose 2008 counts... MAC version...
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6306
Published: 2014-08-22
Unspecified vulnerability on IBM Power 7 Systems 740 before 740.70 01Ax740_121, 760 before 760.40 Ax760_078, and 770 before 770.30 01Ax770_062 allows local users to gain Service Processor privileges via unknown vectors.

CVE-2014-0232
Published: 2014-08-22
Multiple cross-site scripting (XSS) vulnerabilities in framework/common/webcommon/includes/messages.ftl in Apache OFBiz 11.04.01 before 11.04.05 and 12.04.01 before 12.04.04 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, which are not properly handled in a (1)...

CVE-2014-3525
Published: 2014-08-22
Unspecified vulnerability in Apache Traffic Server 4.2.1.1 and 5.x before 5.0.1 has unknown impact and attack vectors, possibly related to health checks.

CVE-2014-3563
Published: 2014-08-22
Multiple unspecified vulnerabilities in Salt (aka SaltStack) before 2014.1.10 allow local users to have an unspecified impact via vectors related to temporary file creation in (1) seed.py, (2) salt-ssh, or (3) salt-cloud.

CVE-2014-3594
Published: 2014-08-22
Cross-site scripting (XSS) vulnerability in the Host Aggregates interface in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-3 allows remote administrators to inject arbitrary web script or HTML via a new host aggregate name.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Three interviews on critical embedded systems and security, recorded at Black Hat 2014 in Las Vegas.