Risk Assessment / Security & Hacktivism
Once again, Adobe releases emergency Flash patch for Hacking Team 0-days
Attack code has already been published, all but assuring exploits will go wild.
Adobe Systems has issued an emergency update for its Flash media
player to patch two critical zero-day vulnerabilities that allow
attackers to surreptitiously install malware on end-user computers.
The previously unknown vulnerabilities were unearthed in the 400-gigabyte data dump hackers published nine days ago after rooting the servers of Hacking Team, the Italy-based company that sold spyware and exploits to governments around the world. As previously reported, Hacking Team was itself hacked by unknown individuals, who then published e-mails, sales invoices, and marketing material that appeared to contradict long-standing assurances from company executives that they operated ethically and didn't do business with repressive governments.
The two Flash vulnerabilities unearthed this past weekend are in addition to a third one found earlier in the Hacking Team dump, which Adobe patched last week, a few days after it was discovered. All three critical vulnerabilities were present in Flash versions for Windows, Mac OS X, and Linux. At least one of them was potent enough to pierce the vaunted Google Chrome security sandbox, most likely because it was combined with a separate privilege-escalation exploit for Windows. It took only a few days after the earlier Flash vulnerability was found in the Hacking Team trove for blackhat hackers to begin actively exploiting it in the wild. While there are no indications that the two latest bugs are being similarly targeted, it's a fair bet they are, or at least will be soon. Ars has long advised readers to eliminate, or at least greatly curtail, use of Flash. For those who continue to rely on Flash, this update is a must, and it should be installed immediately. Readers are once again reminded to uncheck the box during the update process that shamelessly pushes Google Chrome, McAfee software, and other unwanted crapware. Windows users who use Firefox are also reminded that Adobe requires them to install a separate update for that browser and Internet Explorer.
As a precautionary measure, Firefox has blacklisted vulnerable versions of Flash. Adobe has more about the vulnerabilities here and here. Adobe has also released updates for its Shockwave player and Acrobat and Reader applications.
The previously unknown vulnerabilities were unearthed in the 400-gigabyte data dump hackers published nine days ago after rooting the servers of Hacking Team, the Italy-based company that sold spyware and exploits to governments around the world. As previously reported, Hacking Team was itself hacked by unknown individuals, who then published e-mails, sales invoices, and marketing material that appeared to contradict long-standing assurances from company executives that they operated ethically and didn't do business with repressive governments.
The two Flash vulnerabilities unearthed this past weekend are in addition to a third one found earlier in the Hacking Team dump, which Adobe patched last week, a few days after it was discovered. All three critical vulnerabilities were present in Flash versions for Windows, Mac OS X, and Linux. At least one of them was potent enough to pierce the vaunted Google Chrome security sandbox, most likely because it was combined with a separate privilege-escalation exploit for Windows. It took only a few days after the earlier Flash vulnerability was found in the Hacking Team trove for blackhat hackers to begin actively exploiting it in the wild. While there are no indications that the two latest bugs are being similarly targeted, it's a fair bet they are, or at least will be soon. Ars has long advised readers to eliminate, or at least greatly curtail, use of Flash. For those who continue to rely on Flash, this update is a must, and it should be installed immediately. Readers are once again reminded to uncheck the box during the update process that shamelessly pushes Google Chrome, McAfee software, and other unwanted crapware. Windows users who use Firefox are also reminded that Adobe requires them to install a separate update for that browser and Internet Explorer.
As a precautionary measure, Firefox has blacklisted vulnerable versions of Flash. Adobe has more about the vulnerabilities here and here. Adobe has also released updates for its Shockwave player and Acrobat and Reader applications.
No comments:
Post a Comment