Attacks/Breaches
2/11/2013
11:13 AM
50%
50%

Adobe Issues Emergency Patch For Flash Player

As attackers actively target new bugs in Flash Player browser plug-in, Adobe issues Windows, Mac, Linux and Android patches.

Adobe has issued emergency updates for Adobe Flash Player to fix flaws that are being actively exploited by attackers. The vulnerabilities affect versions of Flash Player running on Windows, Mac OS X, Linux and Android.

The two bugs (CVE-2013-0633 and CVE-2013-0634) allow attackers to run arbitrary code on a targeted system and compromise that system. "Failed exploit attempts will likely result in denial-of-service conditions," read an overview of the attacks published by Symantec.

The first vulnerability, which targets the ActiveX version of Flash Player for Windows, "is being exploited in the wild in targeted attacks designed to trick the user into opening a Microsoft Word document delivered as an email attachment which contains malicious Flash (SWF) content," according to a security warning published by Adobe.

The second vulnerability, meanwhile, is being used in drive-by attacks from websites that target browsers with malicious Flash content. To date, the attacks have targeted OS X versions of Flash Player running Firefox and Safari on the Mac OS X platform. Attackers are also using the vulnerability to target Windows users via Microsoft Word documents -- attached to emails -- that include malicious Flash content.

[ Here's what you need to know about the recent Java security breaches. Read Java Security Warnings: Cut Through The Confusion. ]

Vulnerable software includes Flash Player 11.5.502.146 (and earlier) for both Windows and Mac OS X, Flash Player 11.2.202.261 (and earlier) for Linux, Flash Player 11.1.115.36 (and earlier) for Android 4.x, and Flash Player 11.1.111.31 (and earlier) for Android 3.x and 2.x. Flash users can visit the About Flash Player page on Adobe's website to review which version of Flash they're running. "If you use multiple browsers, perform the check for each browser you have installed on your system," Adobe advised. Flash updates, meanwhile, can be obtained from the Adobe Flash Player download page.

Information security firm FireEye said it first witnessed the in-the-wild attacks that are exploiting the two vulnerabilities on Tuesday. The Word files contain a macro to load an embedded SWF flash object, according to an overview of the attacks published by FireEye. The SWF file contains an action script with the name 'LadyBoyle' that contains the exploit code.

Interestingly, the code and documents used in the attacks were respectively compiled and created Tuesday, and while the contents of the documents are written in English, the files' code pages are set to Windows Simplified Chinese (PRC, Singapore).

Despite attackers actively targeting two new zero-day vulnerabilities in Flash Player, Adobe said that it's been putting changes in place that make it more difficult for attackers to exploit newly discovered Flash bugs. Those changes have included sandboxing, working with browser makers and operating system developers to deliver Flash updates -- and disable older versions of Flash -- and hardening applications that are used to disguise Flash attacks.

"Over the last year, Adobe has been driving down the number of Flash-based zero-days used in the wild," said Peleus Uhley, a senior security researcher within the Secure Software Engineering team at Adobe, in a blog post. "Since the introduction of Adobe Reader X Protected Mode (aka sandboxing) in November 2010, the most common Flash Player zero-day attack vector has been malicious Flash content embedded in Microsoft Office documents and delivered via email."

To address that threat, Microsoft created a Protected Mode sandbox in Microsoft Office 2010 that prevents Flash content in Office documents from executing automatically, if the document originated in either an Internet or Untrusted Zone. But no such safeguards exist in Office 2008, so if a user opens a malicious document any Flash content included in the document will execute automatically.

New features built into the next major release of Flash, which is currently being beta tested, should make it more difficult to attack systems running Microsoft Office 2008 or earlier. "The upcoming release of Flash Player will determine whether Flash Player is being launched within Microsoft Office and check the version of Office," said Uhley. "If Flash Player is launched within a version prior to Office 2010, Flash Player will prompt the end user before executing the Flash content, [displaying a warning that recommends that the content not be allowed to play]."

Risk management is all the rage for handling security today, but it's a practice fraught with misconceptions and challenges. In the special Avoid Risky Business By Getting A Grip On Your Real Threats retrospective, Dark Reading takes a look at best practices, new technologies, common missteps -- and the added risks associated with the cloud and mobile devices coming in and out of the enterprise. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
AustinIT
50%
50%
AustinIT,
User Rank: Apprentice
2/11/2013 | 7:37:25 PM
re: Adobe Issues Emergency Patch For Flash Player
You mean Office 2007?

I suppose 2008 counts... MAC version...
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2208
Published: 2014-12-28
CRLF injection vulnerability in the LightProcess protocol implementation in hphp/util/light-process.cpp in Facebook HipHop Virtual Machine (HHVM) before 2.4.2 allows remote attackers to execute arbitrary commands by entering a \n (newline) character before the end of a string.

CVE-2014-2209
Published: 2014-12-28
Facebook HipHop Virtual Machine (HHVM) before 3.1.0 does not drop supplemental group memberships within hphp/util/capability.cpp and hphp/util/light-process.cpp, which allows remote attackers to bypass intended access restrictions by leveraging group permissions for a file or directory.

CVE-2014-5386
Published: 2014-12-28
The mcrypt_create_iv function in hphp/runtime/ext/mcrypt/ext_mcrypt.cpp in Facebook HipHop Virtual Machine (HHVM) before 3.3.0 does not seed the random number generator, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging the use of a single initial...

CVE-2014-6228
Published: 2014-12-28
Integer overflow in the string_chunk_split function in hphp/runtime/base/zend-string.cpp in Facebook HipHop Virtual Machine (HHVM) before 3.3.0 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted arguments to the chunk_split ...

CVE-2014-6229
Published: 2014-12-28
The HashContext class in hphp/runtime/ext/ext_hash.cpp in Facebook HipHop Virtual Machine (HHVM) before 3.3.0 incorrectly expects that a certain key string uses '\0' for termination, which allows remote attackers to obtain sensitive information by leveraging read access beyond the end of the string,...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.