Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

Adobe Issues Emergency Patch For Flash Player

As attackers actively target new bugs in Flash Player browser plug-in, Adobe issues Windows, Mac, Linux and Android patches.

Adobe has issued emergency updates for Adobe Flash Player to fix flaws that are being actively exploited by attackers. The vulnerabilities affect versions of Flash Player running on Windows, Mac OS X, Linux and Android.

The two bugs (CVE-2013-0633 and CVE-2013-0634) allow attackers to run arbitrary code on a targeted system and compromise that system. "Failed exploit attempts will likely result in denial-of-service conditions," read an overview of the attacks published by Symantec.

The first vulnerability, which targets the ActiveX version of Flash Player for Windows, "is being exploited in the wild in targeted attacks designed to trick the user into opening a Microsoft Word document delivered as an email attachment which contains malicious Flash (SWF) content," according to a security warning published by Adobe.

The second vulnerability, meanwhile, is being used in drive-by attacks from websites that target browsers with malicious Flash content. To date, the attacks have targeted OS X versions of Flash Player running Firefox and Safari on the Mac OS X platform. Attackers are also using the vulnerability to target Windows users via Microsoft Word documents -- attached to emails -- that include malicious Flash content.

[ Here's what you need to know about the recent Java security breaches. Read Java Security Warnings: Cut Through The Confusion. ]

Vulnerable software includes Flash Player 11.5.502.146 (and earlier) for both Windows and Mac OS X, Flash Player 11.2.202.261 (and earlier) for Linux, Flash Player 11.1.115.36 (and earlier) for Android 4.x, and Flash Player 11.1.111.31 (and earlier) for Android 3.x and 2.x. Flash users can visit the About Flash Player page on Adobe's website to review which version of Flash they're running. "If you use multiple browsers, perform the check for each browser you have installed on your system," Adobe advised. Flash updates, meanwhile, can be obtained from the Adobe Flash Player download page.

Information security firm FireEye said it first witnessed the in-the-wild attacks that are exploiting the two vulnerabilities on Tuesday. The Word files contain a macro to load an embedded SWF flash object, according to an overview of the attacks published by FireEye. The SWF file contains an action script with the name 'LadyBoyle' that contains the exploit code.

Interestingly, the code and documents used in the attacks were respectively compiled and created Tuesday, and while the contents of the documents are written in English, the files' code pages are set to Windows Simplified Chinese (PRC, Singapore).

Despite attackers actively targeting two new zero-day vulnerabilities in Flash Player, Adobe said that it's been putting changes in place that make it more difficult for attackers to exploit newly discovered Flash bugs. Those changes have included sandboxing, working with browser makers and operating system developers to deliver Flash updates -- and disable older versions of Flash -- and hardening applications that are used to disguise Flash attacks.

"Over the last year, Adobe has been driving down the number of Flash-based zero-days used in the wild," said Peleus Uhley, a senior security researcher within the Secure Software Engineering team at Adobe, in a blog post. "Since the introduction of Adobe Reader X Protected Mode (aka sandboxing) in November 2010, the most common Flash Player zero-day attack vector has been malicious Flash content embedded in Microsoft Office documents and delivered via email."

To address that threat, Microsoft created a Protected Mode sandbox in Microsoft Office 2010 that prevents Flash content in Office documents from executing automatically, if the document originated in either an Internet or Untrusted Zone. But no such safeguards exist in Office 2008, so if a user opens a malicious document any Flash content included in the document will execute automatically.

New features built into the next major release of Flash, which is currently being beta tested, should make it more difficult to attack systems running Microsoft Office 2008 or earlier. "The upcoming release of Flash Player will determine whether Flash Player is being launched within Microsoft Office and check the version of Office," said Uhley. "If Flash Player is launched within a version prior to Office 2010, Flash Player will prompt the end user before executing the Flash content, [displaying a warning that recommends that the content not be allowed to play]."

Risk management is all the rage for handling security today, but it's a practice fraught with misconceptions and challenges. In the special Avoid Risky Business By Getting A Grip On Your Real Threats retrospective, Dark Reading takes a look at best practices, new technologies, common missteps -- and the added risks associated with the cloud and mobile devices coming in and out of the enterprise. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
AustinIT
50%
50%
AustinIT,
User Rank: Apprentice
2/11/2013 | 7:37:25 PM
re: Adobe Issues Emergency Patch For Flash Player
You mean Office 2007?

I suppose 2008 counts... MAC version...
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/21/2020
Hacking Yourself: Marie Moe and Pacemaker Security
Gary McGraw Ph.D., Co-founder Berryville Institute of Machine Learning,  9/21/2020
Startup Aims to Map and Track All the IT and Security Things
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-25595
PUBLISHED: 2020-09-23
An issue was discovered in Xen through 4.14.x. The PCI passthrough code improperly uses register data. Code paths in Xen's MSI handling have been identified that act on unsanitized values read back from device hardware registers. While devices strictly compliant with PCI specifications shouldn't be ...
CVE-2020-5783
PUBLISHED: 2020-09-23
In IgniteNet HeliOS GLinq v2.2.1 r2961, the login functionality does not contain any CSRF protection mechanisms.
CVE-2020-11031
PUBLISHED: 2020-09-23
In GLPI before version 9.5.0, the encryption algorithm used is insecure. The security of the data encrypted relies on the password used, if a user sets a weak/predictable password, an attacker could decrypt data. This is fixed in version 9.5.0 by using a more secure encryption library. The library c...
CVE-2020-5781
PUBLISHED: 2020-09-23
In IgniteNet HeliOS GLinq v2.2.1 r2961, the langSelection parameter is stored in the luci configuration file (/etc/config/luci) by the authenticator.htmlauth function. When modified with arbitrary javascript, this causes a denial-of-service condition for all other users.
CVE-2020-5782
PUBLISHED: 2020-09-23
In IgniteNet HeliOS GLinq v2.2.1 r2961, if a user logs in and sets the ‘wan_type’ parameter, the wan interface for the device will become unreachable, which results in a denial of service condition for devices dependent on this connection.