Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

07:45 AM
Connect Directly

Adobe Issues Emergency Updates For Zero-Day Flaw in Flash Player

Memory corruption flaw is being exploited in the wild to distribute ransomware samples like Locky and Cerber.

Adobe Systems has issued emergency patches for a critical zero-day vulnerability in Flash Player that affects all versions of the software running on major versions of Windows, Macintosh, Linux and ChromeOS, meaning potentially millions of systems are impacted.

The flaw is being actively exploited on systems running Windows 10 and earlier with versions and older of Flash Player installed, Adobe said in a security alert issued late Thursday evening. The latest version of Flash Player ( also has the vulnerability. But the software is somewhat fortuitously protected against attack because of recently introduced exploit mitigations in versions and higher of Flash Player.

Security vendor Proofpoint discovered the zero-day vulnerability when inspecting a change last week to an exploit kit dubbed Magnitude EK that is being used to distribute multiple ransomware tools including the notorious Locky and Cerber samples. According to Proofpoint, its security researchers discovered a new exploit in Magnitude targeting certain recent versions of Flash Player while ignoring the newest versions of the software.

Proofpoint researchers working in collaboration with counterparts from FireEye found the new exploit to be targeting a previously undiscovered vulnerability in Flash Player. The two security vendors described the issue as a memory-corruption vulnerability that exists in an API to an undocumented function reference list known as ASnative. It gives attackers a way to achieve remote code exploitation on recent versions of Flash Players including the latest version.

The researchers informed Adobe of their discovery, which promptly issued an alert earlier this week warning of the threat and promising a quick patch for it. The company has urged all Flash Player users to upgrade to the latest versions of the software for their particular OS to mitigate risk.

Bad as it is, the exploit could have been worse if its authors had known it would work on the latest versions of Flash Player, security researchers from FireEye and Proofpoint said in comments to Dark Reading.

“Exploit kits regularly incorporate new exploits to attack slightly outdated versions of software,’ says Dan Caselden, research science manager from FireEye. This time, the threat actors exploited a zero-day flaw that affected not just older versions of the software but, apparently unknown to them, the most updated version of Adobe Flash Player as well. “This means that, instead of only attacking users with outdated versions of Flash, the vulnerability could be used to attack updated versions as well.”

Kevin Epstein, vice president of the threat operations center at Proofpoint says it’s not clear if the attackers made a strategic decision to target only older Flash Player versions to evade detection, But “the targeting in this case suggests that the attackers didn't realize their exploit -- their skeleton key -- would work on other versions as well,” he says.

Epstein says that the vulnerability needs to be taken seriously. "Any exploit that enables attackers to download ransomware on to an end-users' computer without the users' taking any action other than visiting a website is a serious concern,’ he says.

In this case, because the exploit applies to such a broad range of target systems the threat is quite widespread, he said.

If it hadn’t been for Adobe introducing an exploit mitigation technique in, the threat would have been even wider, Caselden says. In that case, either the exploit would have been sold for targeted attack purposes, or be used to exploit many more users, he says.

News of the latest vulnerability will do little to enhance Flash Player’s reputation as one of the most buggy software products around. Last year, eight of the top 10 vulnerabilities used by exploit kit makers existed in Adobe Flash Player, according to Recorded Future.  Others like Flexera Software have noted how products from vendors like Microsoft often end up having a lot of vulnerabilities because they bundle Flash Player.

Related Content:


Gain insight into the latest threats and emerging best practices for managing them. Attend the Security Track at Interop Las Vegas, May 2-6. Register now!

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
7 Old IT Things Every New InfoSec Pro Should Know
Joan Goodchild, Staff Editor,  4/20/2021
Cloud-Native Businesses Struggle With Security
Robert Lemos, Contributing Writer,  5/6/2021
Defending Against Web Scraping Attacks
Rob Simon, Principal Security Consultant at TrustedSec,  5/7/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-05-16
The JSON web services in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 20 and 7.2 before fix pack 10 may provide overly verbose error messages, which allows remote attackers to use the contents of error messages to help launch another, more focused att...
PUBLISHED: 2021-05-16
Denial-of-service (DoS) vulnerability in the Multi-Factor Authentication module in Liferay DXP 7.3 before fix pack 1 allows remote authenticated attackers to prevent any user from authenticating by (1) enabling Time-based One-time password (TOTP) on behalf of the other user or (2) modifying the othe...
PUBLISHED: 2021-05-16
The SimpleCaptcha implementation in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.3 before fix pack 1 does not invalidate CAPTCHA answers after it is used, which allows remote attackers to repeatedly perform actions protected by a CAPTCHA challenge by reusing the same CAPTCHA answer.
PUBLISHED: 2021-05-16
Delta Industrial Automation CNCSoft ScreenEditor Versions 1.01.28 (with ScreenEditor Version 1.01.2) and prior are vulnerable to an out-of-bounds read while processing project files, which may allow an attacker to execute arbitrary code.
PUBLISHED: 2021-05-16
Cross-site scripting (XSS) vulnerability in the Asset module's categories administration page in Liferay Portal 7.3.4 allows remote attackers to inject arbitrary web script or HTML via the site name.