Adobe is recommending that users update their Flash Players immediately. The company has published an emergency security bulletin today, that addresses vulnerabilities the Flash Player and released a patch to fix a vulnerability which is currently being exploited in a sophisticated cyber espionage campaign.
"Adobe is aware of reports that an exploit for this vulnerability exists in the wild, and recommends users apply the updates referenced in the security bulletin."
The vulnerability (CVE-2014-0497), allows an attacker to remotely take control of the targeted system hosting Flash. "These updates address a critical vulnerability that could potentially allow an attacker to remotely take control of the affected system" advisory said.
The security hole affects the version 12.0.0.43 and earlier for both Windows and Mac OSs and Adobe Flash Player 11.2.202.335 and earlier versions for Linux.
The vulnerability was discovered by two researchers at Kaspersky Lab, Alexander Polyakov and Anton Ivanov.
The story started some month ago, when the Kaspersky Team discovered a new sophisticated cyber espionage operation which has been going on at least since 2007. The operation dubbed "The Mask" hit systems in 27 countries leveraging high-end exploits, the attackers adopted an extremely sophisticated malware which includes a bootkit and rootkit.
The malicious code used is able to infect also Mac and Linux versions and included a customized attack against Kaspersky products.
"This is putting them above Duqu in terms of sophistication, making it one of the most advanced threats at the moment. Most interesting, the authors appear to be native in yet another language which has been observed very rarely in APT attacks. We will present more details about the "Mask" APT next week at the Kaspersky Security Analyst Summit 2014 (on Twitter, #TheSAS2014). " Reports a post on SecureList blog.
Kaspersky Lab provides technical analysis of the exploits and payload. They discovered a total of 11 exploits, using same vulnerability and all are unpacked SWF files in the following versions of Adobe Flash Player:
Researchers discovered that these exploits had been detected on three different user machines, one of which worked under Mac OS 10.6.8 and the other two under Windows 7. They found that .docx document with the 0-day exploit was distributed via a targeted email mailing.
There are total three types of Shellcode:
11.3.372.94These exploits only work with Windows XP, Vista, 2003 R2, 2003, Windows 7, Windows 7x64, Windows 2008 R2, Windows 2008, 8, Windows 8x6, Mac OS 10.6.8.
11.3.375.10
11.3.376.12
11.3.377.15
11.3.378.5
11.3.379.14
11.6.602.167
11.6.602.180
11.7.700.169
11.7.700.202
11.7.700.224
Researchers discovered that these exploits had been detected on three different user machines, one of which worked under Mac OS 10.6.8 and the other two under Windows 7. They found that .docx document with the 0-day exploit was distributed via a targeted email mailing.
First one is a primitive shellcode that reads an executable named a.exe from an SWF file and drops it to the hard drive. Only one of the 11 exploits in our possession included a payload.
The second type downloads and executes a file from a URL passed in the SWF file's parameters. The third shellcode type, which is only present in some of the files, is the most interesting.Adobe was informed of the availability of an exploit in the wild used to hit systems running the Flash Player, it recommends users update product installations to the latest versions:
- Users of Adobe Flash Player 12.0.0.43 and earlier versions for Windows and Macintosh should update to Adobe Flash Player 12.0.0.44.
- Users of Adobe Flash Player 11.2.202.335 and earlier versions for Linux should update to Adobe Flash Player 11.2.202.336.
- Adobe Flash Player 12.0.0.41 installed with Google Chrome will automatically be updated to the latest Google Chrome version, which will include Adobe Flash Player 12.0.0.44 for Windows, Macintosh and Linux.
- Adobe Flash Player 12.0.0.38 installed with Internet Explorer 10 will automatically be updated to the latest Internet Explorer 10 version, which will include Adobe Flash Player 12.0.0.44 for Windows 8.0.
- Adobe Flash Player 12.0.0.38 installed with Internet Explorer 11 will automatically be updated to the latest Internet Explorer 11 version, which will include Adobe Flash Player 12.0.0.44 for Windows 8.1.
