April 17, 2014

Adobe releases out-of-band security update to fix zero-day exploit

adobe-logoAdobe has released an out-of-band security patch for Flash Player to fix a critical zero-day vulnerability that is being exploited in the wild. The vulnerability allows attackers to remotely take control of the affected system. Once they have control the attackers can install malware and recruit the affected PC into a botnet. Adobe was forced into issuing an immediate patch to the problem as an exploit for this vulnerability exists in the wild and is being used by attackers. Adobe recommends that users update Flash Player on their PCs immediately.

Because of an Integer underflow, that is present in Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, remote attackers can execute arbitrary code on a victim’s PC. However Adobe did not include any details about how the vulnerability is being exploited.

Adobe did however thank two researchers from Kaspersky Lab for reporting the vulnerability. There is speculation that the vulnerability could be related to “The Mask” an Advanced Persistent Threat (APT) that a Kaspersky Lab Expert wrote about recently. The Kaspersky post references Adobe Flash in the context of a long-running cyber espionage campaign that Kaspersky says it will present more about during the next week at the Kaspersky Security Analyst Summit 2014.

In response to Adobe’s update Google has released Chrome 32.0.1700.107 for Windows, Mac and Linux with an updated version of the embedded Flash Player. Microsoft likewise has updated Internet Explorer 10 and 11 on all supported editions of Windows 8, Windows Server 2012, Windows RT, Windows 8.1, Windows Server 2012 R2, and Windows RT 8.1.

Apple has released an update to its web plug-in blocking mechanism to disable all versions prior to Flash Player 12.0.0.44. If OS X users try to view Flash content in Safari they will see a “Blocked Plug-in” alert unless they have updated to the latest version of Flash Player.

Microsoft and Adobe release patches to fix critical vulnerabilities

(LiveHacking.Com) – For March’s Patch Tuesday Microsoft has released seven bulletins, four Critical-class and three Important-class. The bulletins address 20 vulnerabilities in total across several Microsoft products including Windows, Office, Internet Explorer, Server Tools, and Silverlight. Likewise Adobe has released a security update for its popular Flash Player to address vulnerabilities that could potentially allow a hacker to take control of a vulnerable system.

Microsoft

Among the fixes is a patch for an issue in the Kernel-Mode Drivers (KMD) where an attacker could gain administrator privileges by inserting a malicious USB flash drive into a Windows machine. Since the attack works even when no user is currently logged on, it means that anyone with casual access, such as a security guard, office cleaner or anyone with access to office space, could simply plug in a USB flash drive into a PC and perform any action as an administrator. In total MS13-027 resolves three privately reported vulnerabilities correcting the way that a Windows kernel-mode USB drivers handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode.

Nine issues have also been fixed in Internet Explorer. The most severe of these could allow remote code execution if a user views a specially crafted webpage using IE. Upon successful exploit An attacker could gain the same rights as the current owner. All but one of these issues were privately reported to Microsoft and there are no reports of these vulnerabilities being used in the wild.

Microsoft Silverlight has also been patched to fix a vulnerability that could allow remote code execution if an attacker hosts a website that contains a specially crafted Silverlight application. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements.

Adobe

adobe-logoAdobe has released a security update for Adobe Flash Player for Windows, OS X, Linux and Android. These update addresses vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.

Affected Versions

  • Adobe Flash Player 11.6.602.171 and earlier versions for Windows and Macintosh
  • Adobe Flash Player 11.2.202.273 and earlier versions for Linux
  • Adobe Flash Player 11.1.115.47 and earlier versions for Android 4.x
  • Adobe Flash Player 11.1.111.43 and earlier versions for Android 3.x and 2.x
  • Adobe AIR 3.6.0.597 and earlier versions for Windows, Macintosh and Android
  • Adobe AIR 3.6.0.597 SDK and earlier versions
  • Adobe AIR 3.6.0.599 SDK & Compiler and earlier versions

The update address four known vulnerabilities  an integer overflow vulnerability that could lead to code execution (CVE-2013-0646), a use-after-free vulnerability that could be exploited to execute arbitrary code (CVE-2013-0650), a memory corruption vulnerability that could lead to code execution (CVE-2013-1371), a heap buffer overflow vulnerability that could lead to code execution (CVE-2013-1375).

As a result of the update, Google has also released a new version of Chrome.

 

Microsoft to fix 57 unique vulnerabilities in February’s Patch Tuesday, also updates Flash in IE 10

microsoft logo(LiveHacking.Com) – Microsoft has published an advanced notification of security patches that it intends to release on Tuesday February 12, 2013. It will  release 12 bulletins, five of which are rated as Critical and seven as Important. These bulletins address 57 unique vulnerabilities in various Microsoft products including Windows, Internet Explorer and Exchange Software, Office, .NET Framework, and Microsoft Server Software.

All five Critical bulletins resolve remote code execution problems while the Important class advisories will address denial of service and elevation of privilege problem along with another less harmful remote code execution vulnerability.

Windows XP is affected by four of the five Critical bulletins, while Windows 8 is affected by only two of them. The common vulnerabilities between the oldest and newest of Microsoft’s current supported operating systems are all connected with Internet Explorer. It seems that Microsoft will patch some holes in IE which can be found in IE 6, 7, 8, 9 and 10. The version of IE 10 in Windows RT is also affected.

The other Critical bulletin will be issued regarding Microsoft Exchange Server 2007 and Microsoft Exchange Server 2010.

IE 10 and Adobe Flash Player

Microsoft has also issued an update for Internet Explorer 10 on Windows 8 to update the built-in version of Adobe Flash Player which Adobe recently updated.  Adobe released security updates for Adobe Flash Player on Windows, OS X, Linux and Android to address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.

Adobe is reporting that at least two of the vulnerabilities addressed are being exploited in the wild. In one targeted attack, users are tricked  into opening a Microsoft Word document delivered as an email attachment which contains malicious Flash (SWF) content. The other vulnerability is being exploited via malicious Flash (SWF) content hosted on websites that target Flash Player in Firefox or Safari on the Macintosh platform, as well as attacks designed to trick Windows users into opening another Microsoft Word document.

Adobe fixes Flash Player and Microsoft patches IE 10 to update its built-in version

adobe-logo(LiveHacking.Com) – Adobe has released security updates for Adobe Flash Player for Windows, OS X, Linux and Android. These updates address a vulnerability that could cause a crash and potentially allow an attacker to executable arbitrary code on the affected system.

These updates fix a buffer overflow vulnerability in Flash that could lead to code execution.

Affected Versions

  • Adobe Flash Player 11.5.502.135 and earlier versions for Windows
  • Adobe Flash Player 11.5.502.136 and earlier versions for Macintosh
  • Adobe Flash Player 11.2.202.258 and earlier versions for Linux
  • Adobe Flash Player 11.1.115.34 and earlier versions for Android 4.x
  • Adobe Flash Player 11.1.111.29 and earlier versions for Android 3.x and 2.x
  • Adobe AIR 3.5.0.880 and earlier versions for Windows
  • Adobe AIR 3.5.0.890 and earlier versions for Macintosh
  • Adobe AIR 3.5.0.880 for Android
  • Adobe AIR 3.5.0.880 SDK and Adobe AIR 3.5.0.890 SDK

IE10

Microsoft has also revised Security Advisory 2755801 to include the latest Adobe updates. IE10 comes with a built-in version of Flash (like Chrome). An IE10 update is availbale as a cumulative update, which means customers do not need to install previous updates as a prerequisite for installing the current update.

“We remain committed to working closely with Adobe to deliver quality protections that are aligned with Adobe’s update process,” wrote Dustin Childs from Microsoft’s Trustworthy Computing unit.

Adobe hasn’t yet fixed Critical Shockwave vulnerability reported in 2010

adobe-logo(LiveHacking.Com) – According to three advisories published by US-CERT, Adobe Shockwave has three Critical vulnerability which could allow attackers to remotely execute code on vulnerable machines. At least one of the vulnerabilities was reported to Adobe in 2010 and isn’t scheduled to be fixed until 2013.

US-CERT issued Vulnerability Note VU#519137 warning that Adobe Shockwave Player installs Xtras that are signed by Adobe or Macromedia without prompting, this means that an attacker can target vulnerabilities in older versions of Xtras. When Shockwave needs to use an Xtra it will be downloaded and installed automatically without any user interaction. The problem is that the download location is stored in the Shockwave movie itself. By changing the value of the download location attackers can force a vulnerable older version of the Xtra to be installed.

“By convincing a user to view specially crafted Shockwave content (e.g., a web page or an HTML email message or attachment), an attacker may be able to execute arbitrary code with the privileges of the user,” noted US-CERT.

In another issue, US-CERT reported that Adobe Shockwave Player 11.6.8.638 and earlier provide a vulnerable version of the Flash runtime. The included Flash runtime is version 10.2.159.1, which was released on April 15, 2011.This version of Flash contains several exploitable vulnerabilities. Since Shockwave uses its own Flash runtime, the machine is still vulnerable even if a new version of Flash has been installed on the PC.

The third problem is that Adobe Shockwave Player can automatically install a legacy version of its runtime. This can increase the attack surface of systems that have Shockwave installed. Because this is a design feature, attackers can target vulnerabilities in the Shockwave 10 runtime, or any of the Xtras provided by Shockwave 10. The example that US-CERT gives is that the legacy version of Shockwave provides Flash 8.0.34.0, which was released on November 14, 2006 and contains multiple, known vulnerabilities.

“Adobe has been working on addressing this issue in the next major release of Adobe Shockwave Player, which is currently scheduled to be released in February 2013,” an Adobe spokesperson told SecurityWeek. “We are not aware of any active exploits or attacks in the wild using this particular technique.”

Uninstalling the Shockwave Player will remove the vulnerabilities and since it isn’t used that often today you can probably remove it without any impact on your system.  Adobe has an uninstaller.

 

Google updates Chrome to fix a Critical vulnerability and update Flash

(LiveHacking.Com) –  Google has released a new version of Chrome for Windows, Mac and Linux. Chrome 23.0.1271.97 fixes several non-security related bugs along with at least one Critical level security vulnerability. The new version also includes an updated version of Flash following Adobe’s security update.

The Critical level bug is a crash in the history navigation. It was found by Michal Zalewski of the Google Security Team. The other security related bugs, along with the money awarded to the bounty hunter by Google under the Chromium security rewards scheme, are:

  • [$1500] [158204] High CVE-2012-5139: Use-after-free with visibility events. Credit to Chamal de Silva.
  • [$1000] [159429] High CVE-2012-5140: Use-after-free in URL loader. Credit to Chamal de Silva.
  • [160456] Medium CVE-2012-5141: Limit Chromoting client plug-in instantiation. Credit to Google Chrome Security Team (Jüri Aedla).
  • [160926] Medium CVE-2012-5143: Integer overflow in PPAPI image buffers. Credit to Google Chrome Security Team (Cris Neckar).
  • [$2000] [161639] High CVE-2012-5144: Stack corruption in AAC decoding. Credit to pawlkt.

The new version also fixes the following non-security related bugs

  • Some texts in a Website Settings popup are trimmed (Issue: 159156)
  • Linux: <input> selection renders white text on white bg in apps (Issue: 158422)
  • some plugins stopped working (Issue: 159896)
  • Windows 8: Unable to launch system level chrome after self destructing user-level chrome (Issue: 158632)

Adobe releases security updates for Flash Player

(LiveHacking.Com) –  Adobe has released a set of security updates for its Flash Player. The update applies to the Windows, Linux and OS X operating systems as well as to Android. The updates address vulnerabilities that, if exploited, could cause a crash and allow an attacker to execute arbitrary code.

There are three distinct bugs fixed. The first is a buffer overflow vulnerability, the second an integer overflow vulnerability and the last a memory corruption vulnerability. All three could lead to code execution.

AFFECTED SOFTWARE VERSIONS

  • Adobe Flash Player 11.5.502.110 and earlier versions for Windows and Macintosh
  • Adobe Flash Player 11.2.202.251  and earlier versions for Linux
  • Adobe Flash Player 11.1.115.27 and earlier versions for Android 4.x
  • Adobe Flash Player 11.1.111.24 and earlier versions for Android 3.x and 2.x
  • Adobe AIR 3.5.0.600 and earlier versions for Windows and Macintosh, Android and SDK (includes AIR for iOS)

Microsoft has updated IE 10 to include the new version of Flash. Likewise Google has updated Chrome to version 23.0.1271.97.

In brief: Microsoft updates Internet Explorer 10 to address vulnerabilities in Adobe Flash Player

(LiveHacking.Com) – Adobe has released a new version of its ubiquitous Flash Player to address vulnerabilities that could cause a crash and potentially be exploited by an attacker to infect a PC with malware. As a result Microsoft has issued a patch to IE10 to update the browser’s built-in version of Flash Player.

Microsoft has revised Security Advisory 2755801 to reflect the changes. The new version of IE is available for all supported editions of Windows 8, Windows Server 2012, and Windows RT. For more information about the update, including download links, see Microsoft Knowledge Base Article 2770041

“We remain committed to taking the appropriate actions to help protect customers and will continue to work closely with Adobe to deliver quality protections that are aligned with Adobe’s update process,” said Dave Forstrom, Director, Microsoft Trustworthy Computing.

Adobe has released a security update for Adobe Flash Player

(LiveHacking.Com) – Adobe has released a security update for Adobe Flash Player to address vulnerabilities that could cause a crash and potentially be exploited by an attacker to infect a PC with malware.

The update applies to Adobe Flash Player 11.4.402.287 and earlier versions for Windows and Macintosh, Adobe Flash Player 11.2.202.243 and earlier versions for Linux, Adobe Flash Player 11.1.115.20 and earlier versions for Android 4.x, and Adobe Flash Player 11.1.111.19 and earlier versions for Android 3.x and 2.x.

The update addresses six different memory issues and a security bypass vulnerability:

  • Buffer overflow vulnerabilities that could lead to code execution (CVE-2012-5274, CVE-2012-5275, CVE-2012-5276, CVE-2012-5277, CVE-2012-5280).
  • Memory corruption vulnerabilities that could lead to code execution (CVE-2012-5279).
  • Security bypass vulnerability that could lead to code execution (CVE-2012-5278).

If you need to check the version of Adobe Flash Player installed on your system, access the About Flash Player page, or right-click on content running in Flash Player and select “About Adobe (or Macromedia) Flash Player” from the menu. For those with multiple browsers installed you should perform the check for each browser. Android users should tap on Settings > Applications > Manage Applications > Adobe Flash Player x.x.

The built-in version of Flash Player has also been updated in Internet Explorer 10 and Chrome.

Adobe updates Flash Player to fix 25 security vulnerabilities

(LiveHacking.Com) – Adobe has released a new version of its Flash Player to address a multitude of security vulnerabilities. The new release fixes at least 25 separate security flaws. Adobe also released a security patch for its Adobe AIR software. According to Adobe, “these updates address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.”

The update affects all Flash platforms including Windows, Mac, Linux and Android. Adobe has released security updates for:

  • Adobe Flash Player 11.4.402.278 and earlier versions for Windows
  • Adobe Flash Player 11.4.402.265 and earlier versions for Macintosh,
  • Adobe Flash Player 11.2.202.238 and earlier for versions for Linux,
  • Adobe Flash Player 11.1.115.17 and earlier versions for Android 4.x
  • Adobe Flash Player 11.1.111.16 and earlier versions for Android 3.x and 2.x.

For Adobe AIR users, all versions prior to 3.4.0.2540 on Windows, Macintosh and Android should update to Adobe AIR 3.4.0.2710.

There are two categories of vulnerabilities fix in this release: buffer overflow vulnerabilities that could lead to code execution and memory corruption vulnerabilities that could also lead to code execution.

If you are still using Flash Player 10 and you cannot update to Flash Player 11.4.402.287, Adobe has released Flash Player 10.3.183.29, which can be downloaded here.