Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

Adobe Issues Emergency Patch For Flash Player

As attackers actively target new bugs in Flash Player browser plug-in, Adobe issues Windows, Mac, Linux and Android patches.

Adobe has issued emergency updates for Adobe Flash Player to fix flaws that are being actively exploited by attackers. The vulnerabilities affect versions of Flash Player running on Windows, Mac OS X, Linux and Android.

The two bugs (CVE-2013-0633 and CVE-2013-0634) allow attackers to run arbitrary code on a targeted system and compromise that system. "Failed exploit attempts will likely result in denial-of-service conditions," read an overview of the attacks published by Symantec.

The first vulnerability, which targets the ActiveX version of Flash Player for Windows, "is being exploited in the wild in targeted attacks designed to trick the user into opening a Microsoft Word document delivered as an email attachment which contains malicious Flash (SWF) content," according to a security warning published by Adobe.

The second vulnerability, meanwhile, is being used in drive-by attacks from websites that target browsers with malicious Flash content. To date, the attacks have targeted OS X versions of Flash Player running Firefox and Safari on the Mac OS X platform. Attackers are also using the vulnerability to target Windows users via Microsoft Word documents -- attached to emails -- that include malicious Flash content.

[ Here's what you need to know about the recent Java security breaches. Read Java Security Warnings: Cut Through The Confusion. ]

Vulnerable software includes Flash Player 11.5.502.146 (and earlier) for both Windows and Mac OS X, Flash Player 11.2.202.261 (and earlier) for Linux, Flash Player 11.1.115.36 (and earlier) for Android 4.x, and Flash Player 11.1.111.31 (and earlier) for Android 3.x and 2.x. Flash users can visit the About Flash Player page on Adobe's website to review which version of Flash they're running. "If you use multiple browsers, perform the check for each browser you have installed on your system," Adobe advised. Flash updates, meanwhile, can be obtained from the Adobe Flash Player download page.

Information security firm FireEye said it first witnessed the in-the-wild attacks that are exploiting the two vulnerabilities on Tuesday. The Word files contain a macro to load an embedded SWF flash object, according to an overview of the attacks published by FireEye. The SWF file contains an action script with the name 'LadyBoyle' that contains the exploit code.

Interestingly, the code and documents used in the attacks were respectively compiled and created Tuesday, and while the contents of the documents are written in English, the files' code pages are set to Windows Simplified Chinese (PRC, Singapore).

Despite attackers actively targeting two new zero-day vulnerabilities in Flash Player, Adobe said that it's been putting changes in place that make it more difficult for attackers to exploit newly discovered Flash bugs. Those changes have included sandboxing, working with browser makers and operating system developers to deliver Flash updates -- and disable older versions of Flash -- and hardening applications that are used to disguise Flash attacks.

"Over the last year, Adobe has been driving down the number of Flash-based zero-days used in the wild," said Peleus Uhley, a senior security researcher within the Secure Software Engineering team at Adobe, in a blog post. "Since the introduction of Adobe Reader X Protected Mode (aka sandboxing) in November 2010, the most common Flash Player zero-day attack vector has been malicious Flash content embedded in Microsoft Office documents and delivered via email."

To address that threat, Microsoft created a Protected Mode sandbox in Microsoft Office 2010 that prevents Flash content in Office documents from executing automatically, if the document originated in either an Internet or Untrusted Zone. But no such safeguards exist in Office 2008, so if a user opens a malicious document any Flash content included in the document will execute automatically.

New features built into the next major release of Flash, which is currently being beta tested, should make it more difficult to attack systems running Microsoft Office 2008 or earlier. "The upcoming release of Flash Player will determine whether Flash Player is being launched within Microsoft Office and check the version of Office," said Uhley. "If Flash Player is launched within a version prior to Office 2010, Flash Player will prompt the end user before executing the Flash content, [displaying a warning that recommends that the content not be allowed to play]."

Risk management is all the rage for handling security today, but it's a practice fraught with misconceptions and challenges. In the special Avoid Risky Business By Getting A Grip On Your Real Threats retrospective, Dark Reading takes a look at best practices, new technologies, common missteps -- and the added risks associated with the cloud and mobile devices coming in and out of the enterprise. (Free registration required.)

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
AustinIT
50%
50%
AustinIT,
User Rank: Apprentice
2/11/2013 | 7:37:25 PM
re: Adobe Issues Emergency Patch For Flash Player
You mean Office 2007?

I suppose 2008 counts... MAC version...
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/10/2020
Pen Testers Who Got Arrested Doing Their Jobs Tell All
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/5/2020
Researcher Finds New Office Macro Attacks for MacOS
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/7/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-17478
PUBLISHED: 2020-08-10
ECDSA/EC/Point.pm in Crypt::Perl before 0.33 does not properly consider timing attacks against the EC point multiplication algorithm.
CVE-2020-15648
PUBLISHED: 2020-08-10
Using object or embed tags, it was possible to frame other websites, even if they disallowed framing using the X-Frame-Options header. This vulnerability affects Thunderbird < 78 and Firefox < 78.0.2.
CVE-2020-15649
PUBLISHED: 2020-08-10
Given an installed malicious file picker application, an attacker was able to steal and upload local files of their choosing, regardless of the actually files picked. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR...
CVE-2020-15650
PUBLISHED: 2020-08-10
Given an installed malicious file picker application, an attacker was able to overwrite local files and thus overwrite Firefox settings (but not access the previous profile). *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Fir...
CVE-2020-15651
PUBLISHED: 2020-08-10
A unicode RTL order character in the downloaded file name can be used to change the file's name during the download UI flow to change the file extension. This vulnerability affects Firefox for iOS < 28.