Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

07:45 AM
Connect Directly

Adobe Issues Emergency Updates For Zero-Day Flaw in Flash Player

Memory corruption flaw is being exploited in the wild to distribute ransomware samples like Locky and Cerber.

Adobe Systems has issued emergency patches for a critical zero-day vulnerability in Flash Player that affects all versions of the software running on major versions of Windows, Macintosh, Linux and ChromeOS, meaning potentially millions of systems are impacted.

The flaw is being actively exploited on systems running Windows 10 and earlier with versions and older of Flash Player installed, Adobe said in a security alert issued late Thursday evening. The latest version of Flash Player ( also has the vulnerability. But the software is somewhat fortuitously protected against attack because of recently introduced exploit mitigations in versions and higher of Flash Player.

Security vendor Proofpoint discovered the zero-day vulnerability when inspecting a change last week to an exploit kit dubbed Magnitude EK that is being used to distribute multiple ransomware tools including the notorious Locky and Cerber samples. According to Proofpoint, its security researchers discovered a new exploit in Magnitude targeting certain recent versions of Flash Player while ignoring the newest versions of the software.

Proofpoint researchers working in collaboration with counterparts from FireEye found the new exploit to be targeting a previously undiscovered vulnerability in Flash Player. The two security vendors described the issue as a memory-corruption vulnerability that exists in an API to an undocumented function reference list known as ASnative. It gives attackers a way to achieve remote code exploitation on recent versions of Flash Players including the latest version.

The researchers informed Adobe of their discovery, which promptly issued an alert earlier this week warning of the threat and promising a quick patch for it. The company has urged all Flash Player users to upgrade to the latest versions of the software for their particular OS to mitigate risk.

Bad as it is, the exploit could have been worse if its authors had known it would work on the latest versions of Flash Player, security researchers from FireEye and Proofpoint said in comments to Dark Reading.

“Exploit kits regularly incorporate new exploits to attack slightly outdated versions of software,’ says Dan Caselden, research science manager from FireEye. This time, the threat actors exploited a zero-day flaw that affected not just older versions of the software but, apparently unknown to them, the most updated version of Adobe Flash Player as well. “This means that, instead of only attacking users with outdated versions of Flash, the vulnerability could be used to attack updated versions as well.”

Kevin Epstein, vice president of the threat operations center at Proofpoint says it’s not clear if the attackers made a strategic decision to target only older Flash Player versions to evade detection, But “the targeting in this case suggests that the attackers didn't realize their exploit -- their skeleton key -- would work on other versions as well,” he says.

Epstein says that the vulnerability needs to be taken seriously. "Any exploit that enables attackers to download ransomware on to an end-users' computer without the users' taking any action other than visiting a website is a serious concern,’ he says.

In this case, because the exploit applies to such a broad range of target systems the threat is quite widespread, he said.

If it hadn’t been for Adobe introducing an exploit mitigation technique in, the threat would have been even wider, Caselden says. In that case, either the exploit would have been sold for targeted attack purposes, or be used to exploit many more users, he says.

News of the latest vulnerability will do little to enhance Flash Player’s reputation as one of the most buggy software products around. Last year, eight of the top 10 vulnerabilities used by exploit kit makers existed in Adobe Flash Player, according to Recorded Future.  Others like Flexera Software have noted how products from vendors like Microsoft often end up having a lot of vulnerabilities because they bundle Flash Player.

Related Content:


Gain insight into the latest threats and emerging best practices for managing them. Attend the Security Track at Interop Las Vegas, May 2-6. Register now!

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Oldest First  |  Newest First  |  Threaded View
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Google's new See No Evil policy......
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-06-20
The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin WordPress plugin before 7.1.18 did not sanitise or escape its result_id parameter when displaying an existing quiz result page, leading to a reflected Cross-Site Scripting issue. This c...
PUBLISHED: 2021-06-18
RIOT-OS 2021.01 before commit 44741ff99f7a71df45420635b238b9c22093647a contains a buffer overflow which could allow attackers to obtain sensitive information.
PUBLISHED: 2021-06-18
SerenityOS contains a buffer overflow in the set_range test in TestBitmap which could allow attackers to obtain sensitive information.
PUBLISHED: 2021-06-18
SerenityOS in test-crypto.cpp contains a stack buffer overflow which could allow attackers to obtain sensitive information.
PUBLISHED: 2021-06-18
SerenityOS before commit 3844e8569689dd476064a0759d704bc64fb3ca2c contains a directory traversal vulnerability in tar/unzip that may lead to command execution or privilege escalation.