Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

4/8/2016
07:45 AM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Adobe Issues Emergency Updates For Zero-Day Flaw in Flash Player

Memory corruption flaw is being exploited in the wild to distribute ransomware samples like Locky and Cerber.

Adobe Systems has issued emergency patches for a critical zero-day vulnerability in Flash Player that affects all versions of the software running on major versions of Windows, Macintosh, Linux and ChromeOS, meaning potentially millions of systems are impacted.

The flaw is being actively exploited on systems running Windows 10 and earlier with versions 20.0.0.306 and older of Flash Player installed, Adobe said in a security alert issued late Thursday evening. The latest version of Flash Player (21.0.0.197) also has the vulnerability. But the software is somewhat fortuitously protected against attack because of recently introduced exploit mitigations in versions 21.0.0.182 and higher of Flash Player.

Security vendor Proofpoint discovered the zero-day vulnerability when inspecting a change last week to an exploit kit dubbed Magnitude EK that is being used to distribute multiple ransomware tools including the notorious Locky and Cerber samples. According to Proofpoint, its security researchers discovered a new exploit in Magnitude targeting certain recent versions of Flash Player while ignoring the newest versions of the software.

Proofpoint researchers working in collaboration with counterparts from FireEye found the new exploit to be targeting a previously undiscovered vulnerability in Flash Player. The two security vendors described the issue as a memory-corruption vulnerability that exists in an API to an undocumented function reference list known as ASnative. It gives attackers a way to achieve remote code exploitation on recent versions of Flash Players including the latest version.

The researchers informed Adobe of their discovery, which promptly issued an alert earlier this week warning of the threat and promising a quick patch for it. The company has urged all Flash Player users to upgrade to the latest versions of the software for their particular OS to mitigate risk.

Bad as it is, the exploit could have been worse if its authors had known it would work on the latest versions of Flash Player, security researchers from FireEye and Proofpoint said in comments to Dark Reading.

“Exploit kits regularly incorporate new exploits to attack slightly outdated versions of software,’ says Dan Caselden, research science manager from FireEye. This time, the threat actors exploited a zero-day flaw that affected not just older versions of the software but, apparently unknown to them, the most updated version of Adobe Flash Player as well. “This means that, instead of only attacking users with outdated versions of Flash, the vulnerability could be used to attack updated versions as well.”

Kevin Epstein, vice president of the threat operations center at Proofpoint says it’s not clear if the attackers made a strategic decision to target only older Flash Player versions to evade detection, But “the targeting in this case suggests that the attackers didn't realize their exploit -- their skeleton key -- would work on other versions as well,” he says.

Epstein says that the vulnerability needs to be taken seriously. "Any exploit that enables attackers to download ransomware on to an end-users' computer without the users' taking any action other than visiting a website is a serious concern,’ he says.

In this case, because the exploit applies to such a broad range of target systems the threat is quite widespread, he said.

If it hadn’t been for Adobe introducing an exploit mitigation technique in 21.0.0.182, the threat would have been even wider, Caselden says. In that case, either the exploit would have been sold for targeted attack purposes, or be used to exploit many more users, he says.

News of the latest vulnerability will do little to enhance Flash Player’s reputation as one of the most buggy software products around. Last year, eight of the top 10 vulnerabilities used by exploit kit makers existed in Adobe Flash Player, according to Recorded Future.  Others like Flexera Software have noted how products from vendors like Microsoft often end up having a lot of vulnerabilities because they bundle Flash Player.

Related Content:

   

Gain insight into the latest threats and emerging best practices for managing them. Attend the Security Track at Interop Las Vegas, May 2-6. Register now!

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
Former CISA Director Chris Krebs Discusses Risk Management & Threat Intel
Kelly Sheridan, Staff Editor, Dark Reading,  2/23/2021
Edge-DRsplash-10-edge-articles
Security + Fraud Protection: Your One-Two Punch Against Cyberattacks
Joshua Goldfarb, Director of Product Management at F5,  2/23/2021
News
Cybercrime Groups More Prolific, Focus on Healthcare in 2020
Robert Lemos, Contributing Writer,  2/22/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Building the SOC of the Future
Building the SOC of the Future
Digital transformation, cloud-focused attacks, and a worldwide pandemic. The past year has changed the way business works and the way security teams operate. There is no going back.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-25329
PUBLISHED: 2021-03-01
The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previousl...
CVE-2021-25122
PUBLISHED: 2021-03-01
When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request...
CVE-2021-27225
PUBLISHED: 2021-03-01
In Dataiku DSS before 8.0.6, insufficient access control in the Jupyter notebooks integration allows users (who have coding permissions) to read and overwrite notebooks in projects that they are not authorized to access.
CVE-2021-27132
PUBLISHED: 2021-02-27
SerComm AG Combo VD625 AGSOT_2.1.0 devices allow CRLF injection (for HTTP header injection) in the download function via the Content-Disposition header.
CVE-2021-25284
PUBLISHED: 2021-02-27
An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level.