Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

2/1/2018
05:50 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Adobe to Patch Flash Zero-Day Discovered in South Korean Attacks

Critical use-after-free vulnerability being used in targeted attacks.

A previously unknown and critical flaw in Adobe Flash found being exploited in targeted attacks against victims in South Korea will be patched the week of February 5.

Adobe today confirmed a report yesterday by South Korea's Computer Emergency Response Team (KrCERT/CC) of the discovery of the zero-day vulnerability in Flash Player ActiveX 28.0.0.137 and earlier versions. The bug (CVE-2018-4878) abused in the attacks is a use-after-free vulnerability that allows remote code execution, according to Adobe's advisory.

Johannes Ullrich, head of the SANS Internet Storm Center, says the fact that this was a targeted, zero-day attack makes it more likely to be the handiwork of a nation-state actor.

"The attack was rather limited, and targeted at individuals in South Korea who are involved in research about North Korea. I think this makes for a pretty strong case that this was a nation-state sponsored attack. Other actors would have little motivation to use a zero-day exploit in an attack against a group like this," Ullrich says. "On the other hand, it doesn't have to be North Korea," given the difficulty of attribution.

A researcher from South Korea in a tweet today said North Korea was behind the attacks, and the victims all conduct research on North Korea. Simon Choi, who is director of the security research center at Hauri, said the zero-day exploit had been in use since mid-November by North Korea. 

John Bambenek, manager of threat systems at Fidelis Cybersecurity, says the ideological theme of the attacks' targeting could mean the Lazarus Group is behind the attacks, but it's difficult to discern without the technical details from the South Korean CERT. Even so, the Lazarus Group isn't known for employing homegrown zero-day exploits, he says.

The Flash vulnerability was spotted targeting Windows users via emails with Office documents that contain embedded and malware-laden Flash content. "Successful exploitation could potentially allow an attacker to take control of the affected system," according to Adobe's advisory.

While awaiting the patch, an attack can be mitigated by configuring Flash Player 27 and above on Windows 7 and below (running Internet Explorer) to prompt the user before playing Flash content. Protected View for Office also can be set up for Windows that marks files as potentially unsafe, leaving them in Read-Only mode for users, Adobe noted in its advisory.

Products affected by the vulnerability include Adobe's Flash Player Desktop Runtime on Windows and Mac; Flash Player for Google Chrome on Windows, Mac, Linux, and Chrome OS; Flash for Microsoft Edge and Internet Explorer 11 on Windows 10 and 8.1; and Flash Player Desktop Runtime on Linux.

Related Content:

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/17/2020
Cybersecurity Bounces Back, but Talent Still Absent
Simone Petrella, Chief Executive Officer, CyberVista,  9/16/2020
Meet the Computer Scientist Who Helped Push for Paper Ballots
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/16/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5421
PUBLISHED: 2020-09-19
In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.
CVE-2020-8225
PUBLISHED: 2020-09-18
A cleartext storage of sensitive information in Nextcloud Desktop Client 2.6.4 gave away information about used proxies and their authentication credentials.
CVE-2020-8237
PUBLISHED: 2020-09-18
Prototype pollution in json-bigint npm package < 1.0.0 may lead to a denial-of-service (DoS) attack.
CVE-2020-8245
PUBLISHED: 2020-09-18
Improper Input Validation on Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix ADC and NetScaler Gateway 12.0, Citrix ADC and NetScaler Gateway 11.1 before 11.1-65.12, Citrix SD-WAN WANOP 11....
CVE-2020-8246
PUBLISHED: 2020-09-18
Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix ADC and NetScaler Gateway 12.0, Citrix ADC and NetScaler Gateway 11.1 before 11.1-65.12, Citrix SD-WAN WANOP 11.2 before 11.2.1a, Citrix SD-W...