Vulnerabilities / Threats

4/8/2016
07:45 AM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Adobe Issues Emergency Updates For Zero-Day Flaw in Flash Player

Memory corruption flaw is being exploited in the wild to distribute ransomware samples like Locky and Cerber.

Adobe Systems has issued emergency patches for a critical zero-day vulnerability in Flash Player that affects all versions of the software running on major versions of Windows, Macintosh, Linux and ChromeOS, meaning potentially millions of systems are impacted.

The flaw is being actively exploited on systems running Windows 10 and earlier with versions 20.0.0.306 and older of Flash Player installed, Adobe said in a security alert issued late Thursday evening. The latest version of Flash Player (21.0.0.197) also has the vulnerability. But the software is somewhat fortuitously protected against attack because of recently introduced exploit mitigations in versions 21.0.0.182 and higher of Flash Player.

Security vendor Proofpoint discovered the zero-day vulnerability when inspecting a change last week to an exploit kit dubbed Magnitude EK that is being used to distribute multiple ransomware tools including the notorious Locky and Cerber samples. According to Proofpoint, its security researchers discovered a new exploit in Magnitude targeting certain recent versions of Flash Player while ignoring the newest versions of the software.

Proofpoint researchers working in collaboration with counterparts from FireEye found the new exploit to be targeting a previously undiscovered vulnerability in Flash Player. The two security vendors described the issue as a memory-corruption vulnerability that exists in an API to an undocumented function reference list known as ASnative. It gives attackers a way to achieve remote code exploitation on recent versions of Flash Players including the latest version.

The researchers informed Adobe of their discovery, which promptly issued an alert earlier this week warning of the threat and promising a quick patch for it. The company has urged all Flash Player users to upgrade to the latest versions of the software for their particular OS to mitigate risk.

Bad as it is, the exploit could have been worse if its authors had known it would work on the latest versions of Flash Player, security researchers from FireEye and Proofpoint said in comments to Dark Reading.

“Exploit kits regularly incorporate new exploits to attack slightly outdated versions of software,’ says Dan Caselden, research science manager from FireEye. This time, the threat actors exploited a zero-day flaw that affected not just older versions of the software but, apparently unknown to them, the most updated version of Adobe Flash Player as well. “This means that, instead of only attacking users with outdated versions of Flash, the vulnerability could be used to attack updated versions as well.”

Kevin Epstein, vice president of the threat operations center at Proofpoint says it’s not clear if the attackers made a strategic decision to target only older Flash Player versions to evade detection, But “the targeting in this case suggests that the attackers didn't realize their exploit -- their skeleton key -- would work on other versions as well,” he says.

Epstein says that the vulnerability needs to be taken seriously. "Any exploit that enables attackers to download ransomware on to an end-users' computer without the users' taking any action other than visiting a website is a serious concern,’ he says.

In this case, because the exploit applies to such a broad range of target systems the threat is quite widespread, he said.

If it hadn’t been for Adobe introducing an exploit mitigation technique in 21.0.0.182, the threat would have been even wider, Caselden says. In that case, either the exploit would have been sold for targeted attack purposes, or be used to exploit many more users, he says.

News of the latest vulnerability will do little to enhance Flash Player’s reputation as one of the most buggy software products around. Last year, eight of the top 10 vulnerabilities used by exploit kit makers existed in Adobe Flash Player, according to Recorded Future.  Others like Flexera Software have noted how products from vendors like Microsoft often end up having a lot of vulnerabilities because they bundle Flash Player.

Related Content:

   

Gain insight into the latest threats and emerging best practices for managing them. Attend the Security Track at Interop Las Vegas, May 2-6. Register now!

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Crowdsourced vs. Traditional Pen Testing
Alex Haynes, Chief Information Security Officer, CDL,  3/19/2019
BEC Scammer Pleads Guilty
Dark Reading Staff 3/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Well, at least it isn't Mobby Dick!
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
The State of Cyber Security Incident Response
The State of Cyber Security Incident Response
Organizations are responding to new threats with new processes for detecting and mitigating them. Here's a look at how the discipline of incident response is evolving.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-20165
PUBLISHED: 2019-03-22
Cross-site scripting (XSS) vulnerability in OpenText Portal 7.4.4 allows remote attackers to inject arbitrary web script or HTML via the vgnextoid parameter to a menuitem URI.
CVE-2019-1716
PUBLISHED: 2019-03-22
A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 7800 Series and Cisco IP Phone 8800 Series could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or execute arbitrary code. The vulnerability ...
CVE-2019-1763
PUBLISHED: 2019-03-22
A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series could allow an unauthenticated, remote attacker to bypass authorization, access critical services, and cause a denial of service (DoS) condition. The vulnerability exist...
CVE-2019-1764
PUBLISHED: 2019-03-22
A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack. The vulnerability is due to insufficient CSRF protections for the ...
CVE-2019-1765
PUBLISHED: 2019-03-22
A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series could allow an authenticated, remote attacker to write arbitrary files to the filesystem. The vulnerability is due to insufficient input validation and file-level permis...