Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

4/8/2016
07:45 AM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Adobe Issues Emergency Updates For Zero-Day Flaw in Flash Player

Memory corruption flaw is being exploited in the wild to distribute ransomware samples like Locky and Cerber.

Adobe Systems has issued emergency patches for a critical zero-day vulnerability in Flash Player that affects all versions of the software running on major versions of Windows, Macintosh, Linux and ChromeOS, meaning potentially millions of systems are impacted.

The flaw is being actively exploited on systems running Windows 10 and earlier with versions 20.0.0.306 and older of Flash Player installed, Adobe said in a security alert issued late Thursday evening. The latest version of Flash Player (21.0.0.197) also has the vulnerability. But the software is somewhat fortuitously protected against attack because of recently introduced exploit mitigations in versions 21.0.0.182 and higher of Flash Player.

Security vendor Proofpoint discovered the zero-day vulnerability when inspecting a change last week to an exploit kit dubbed Magnitude EK that is being used to distribute multiple ransomware tools including the notorious Locky and Cerber samples. According to Proofpoint, its security researchers discovered a new exploit in Magnitude targeting certain recent versions of Flash Player while ignoring the newest versions of the software.

Proofpoint researchers working in collaboration with counterparts from FireEye found the new exploit to be targeting a previously undiscovered vulnerability in Flash Player. The two security vendors described the issue as a memory-corruption vulnerability that exists in an API to an undocumented function reference list known as ASnative. It gives attackers a way to achieve remote code exploitation on recent versions of Flash Players including the latest version.

The researchers informed Adobe of their discovery, which promptly issued an alert earlier this week warning of the threat and promising a quick patch for it. The company has urged all Flash Player users to upgrade to the latest versions of the software for their particular OS to mitigate risk.

Bad as it is, the exploit could have been worse if its authors had known it would work on the latest versions of Flash Player, security researchers from FireEye and Proofpoint said in comments to Dark Reading.

“Exploit kits regularly incorporate new exploits to attack slightly outdated versions of software,’ says Dan Caselden, research science manager from FireEye. This time, the threat actors exploited a zero-day flaw that affected not just older versions of the software but, apparently unknown to them, the most updated version of Adobe Flash Player as well. “This means that, instead of only attacking users with outdated versions of Flash, the vulnerability could be used to attack updated versions as well.”

Kevin Epstein, vice president of the threat operations center at Proofpoint says it’s not clear if the attackers made a strategic decision to target only older Flash Player versions to evade detection, But “the targeting in this case suggests that the attackers didn't realize their exploit -- their skeleton key -- would work on other versions as well,” he says.

Epstein says that the vulnerability needs to be taken seriously. "Any exploit that enables attackers to download ransomware on to an end-users' computer without the users' taking any action other than visiting a website is a serious concern,’ he says.

In this case, because the exploit applies to such a broad range of target systems the threat is quite widespread, he said.

If it hadn’t been for Adobe introducing an exploit mitigation technique in 21.0.0.182, the threat would have been even wider, Caselden says. In that case, either the exploit would have been sold for targeted attack purposes, or be used to exploit many more users, he says.

News of the latest vulnerability will do little to enhance Flash Player’s reputation as one of the most buggy software products around. Last year, eight of the top 10 vulnerabilities used by exploit kit makers existed in Adobe Flash Player, according to Recorded Future.  Others like Flexera Software have noted how products from vendors like Microsoft often end up having a lot of vulnerabilities because they bundle Flash Player.

Related Content:

   

Gain insight into the latest threats and emerging best practices for managing them. Attend the Security Track at Interop Las Vegas, May 2-6. Register now!

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
7 Old IT Things Every New InfoSec Pro Should Know
Joan Goodchild, Staff Editor,  4/20/2021
News
Cloud-Native Businesses Struggle With Security
Robert Lemos, Contributing Writer,  5/6/2021
Commentary
Defending Against Web Scraping Attacks
Rob Simon, Principal Security Consultant at TrustedSec,  5/7/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Post a Comment
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-29043
PUBLISHED: 2021-05-17
The Portal Store module in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 does not obfuscate the S3 store's proxy password, which allows attackers to steal the proxy password via man-in-the-middle a...
CVE-2021-29044
PUBLISHED: 2021-05-17
Cross-site scripting (XSS) vulnerability in the Site module's membership request administration pages in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary we...
CVE-2021-29045
PUBLISHED: 2021-05-17
Cross-site scripting (XSS) vulnerability in the Redirect module's redirection administration page in Liferay Portal 7.3.2 through 7.3.5, and Liferay DXP 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_redirect_web_internal_portlet_RedirectPor...
CVE-2021-29046
PUBLISHED: 2021-05-17
Cross-site scripting (XSS) vulnerability in the Asset module's category selector input field in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_asset_categories_admin_web_portlet_AssetCategoriesAdminPortl...
CVE-2021-29053
PUBLISHED: 2021-05-17
Multiple SQL injection vulnerabilities in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1 allow remote authenticated users to execute arbitrary SQL commands via the classPKField parameter to (1) CommerceChannelRelFinder.countByC_C, or (2) CommerceChannelRelFinder.findByC_C.