Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

Adobe Flash Attacks Exploit Zero-Day Vulnerability

No patch is yet available against threat targeting government workers that uses malicious Flash inserted into Microsoft Word documents.

How Firesheep Can Hijack Web Sessions
(click image for larger view)
Slideshow: How Firesheep Can Hijack Web Sessions
Adobe on Monday released a security advisory warning that Adobe Flash Player, Adobe Reader, and Adobe Acrobat are susceptible to a zero-day vulnerability that's being actively exploited.

"There are reports that this vulnerability is being exploited in the wild in targeted attacks via a Flash (.swf) file embedded in a Microsoft Word (.doc) file delivered as an email attachment, targeting the Windows platform," said Adobe. "At this time, Adobe is not aware of any attacks via PDF targeting Adobe Reader and Acrobat."

A successful exploit would allow the attacker to crash or take over the targeted system.

Vulnerable software includes Flash Player 10.2.153.1 and earlier versions for Windows, Macintosh, Linux, and Solaris operating systems; Flash Player 10.2.154.25 and earlier for Chrome users; and Adobe Flash Player 10.2.156.12 and earlier for Android. In addition, the Authplay.dll component--included with Adobe Reader and Acrobat X (10.0.2) and earlier 10.x and 9.x versions for Windows and Macintosh--is also vulnerable.

But Adobe said that protected mode in Adobe Reader X would prevent this type of exploit from being able to execute. In addition, these products aren't affected: Reader 9.x for Unix, Reader for Android, and 8.x versions of Reader and Acrobat.

Attackers are exploiting the vulnerability via spear-phishing campaigns against U.S. government workers and contractors, according to security reporter Brian Krebs.

No patch is available yet for Flash, Reader, or Acrobat, though Adobe said it is "in the process of finalizing a schedule for delivering updates." Since Adobe Reader X would block the attack, Adobe said it won't get patched until the next regularly scheduled quarterly security update, planned for June 14.

The new vulnerability announcement comes three weeks after Adobe released an emergency patch to safeguard its products against similar exploits. As that suggests, when it comes to vulnerabilities, attackers have largely shifted their focus from operating systems and browsers to browser plug-ins--and especially Flash.

But businesses are having a difficult time coping with the non-stop "patch or perish" cycle that results from the seemingly endless stream of new vulnerabilities. According to the forthcoming May 2011 InformationWeek Analytics Strategic Security Survey of business technology and security professionals, from 2010 to 2011 the number of organizations that rated their patch management processes "very effective" dropped from 27% to 22%.

Furthermore, according to VirusTotal, a service that analyzes antivirus software effectiveness, as of Saturday, only one out of 42 antivirus products was detecting as malicious a file--"Disentangling Industrial Policy and Competition Policy.doc"--being used in the attack. By Tuesday, however, 15% of the 42 antivirus software applications were detecting it.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Commentary
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
Edge-DRsplash-11-edge-ask-the-experts
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
News
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Who knew face masks could also prevent the PII from spreading
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-31618
PUBLISHED: 2021-06-15
Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used for the HTTP/1 protocol as well. On violation of these restrictions and HTTP response is sent to the client with a status code indicating why...
CVE-2021-20027
PUBLISHED: 2021-06-14
A buffer overflow vulnerability in SonicOS allows a remote attacker to cause a Denial of Service (DoS) by sending a specially crafted request. This vulnerability affects SonicOS Gen5, Gen6, Gen7 platforms, and SonicOSv virtual firewalls.
CVE-2021-32684
PUBLISHED: 2021-06-14
magento-scripts contains scripts and configuration used by Create Magento App, a zero-configuration tool-chain which allows one to deploy Magento 2. In versions 1.5.1 and 1.5.2, after changing the function from synchronous to asynchronous there wasn't implemented handler in the start, stop, exec, an...
CVE-2021-34693
PUBLISHED: 2021-06-14
net/can/bcm.c in the Linux kernel through 5.12.10 allows local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized.
CVE-2021-27887
PUBLISHED: 2021-06-14
Cross-site Scripting (XSS) vulnerability in the main dashboard of Ellipse APM versions allows an authenticated user or integrated application to inject malicious data into the application that can then be executed in a victim’s browser. This issue affects: Hitachi ABB Power Grids ...