A recent Zero-Day vulnerability in Adobe Flash Player puts many at risks, including the users of Facebook, as the Facebook videos use Flash Player for the video playback.
Recent report regarding a critical Zero-day vulnerability in Adobe Flash Player from a French independent researcher "Kafeine" and an unconfirmed report published by Symantec, drove Adobe to investigate the flaw and fix it. On Thursday, Adobe's representatives announced that they are investigating reports presented to them regarding the flaw.
Today, Adobe has confirmed in a Security Advisory release, stating "a critical Vulnerability (CVE-2015-0311) in Adobe Flash Player 16.0.0.287 and earlier versions for Windows, Macintosh and Linux." According to the security advisory, adobe was aware of the reports that this vulnerability is being being exploited in the wild via drive-by-download attacks against systems running Internet Explorer and Firefox on Windows 8 and below.
"The exploit also affects Internet Explorer 11 running on a fully updated versions of Windows 8.1, and even the Firefox Web browser, Kafeine clarified on Thursday. Chrome is not impacted."
Adobe has confirmed that a patch is in progress and will be delivered as early as the week of 26 January.
The Zero-Day Vulnerability in Adobe Flash Player was revealed by French security researcher Kafeine while analyzing an instance of the Angler exploit kit, and successful exploitation could cause a crash and potentially allow an attacker to take control of the affected system. In the blog post, Kafeine wrote that he has reproduced the exploit with the latest version of Flash Player in Internet Explorer 6 through 8 running on Windows XP, and in Internet Explorer 8 running on Windows 7. The exploit also works in Internet Explorer 10 running on Windows 8.
Disabling Flash Player for some days might be a good idea, he added.
The famous free Anti-Malware and Internet Security Software providing firm, Malwarebytes confirmed this Angler exploit kit to be used for installing the malware known as Bedep. Bedep is a distribution botnet that's capable of loading multiple payloads on infected hosts. In this case, the payload is an ad fraud component.
Upon infection, explorer.exe (not to be confused with iexplore.exe) is injected and performs the ad fraud calls, said Jerome Segura, senior security researcher at Malwarebytes.
Symantec, the Security Firm, published the below infographic detailing the Detections of attempts to exploit the vulnerability from January 19 to 21, 2015.
Also, Symantec detects the SWF File utilized in this exploit as Trojan.Swifi. Below are the Mitigation steps provided by Symantec on their blog.
MitigationUsers of Internet Explorer versions 10 and 11 who are concerned about this issue can temporarily disable Adobe Flash by taking the following steps:
- Open Internet Explorer
- Click on the Tools menu, and then click Manage add-ons
- Under Show, select All add-ons
- Select Shockwave Flash Object and then click on the disable button
You can re-enable Adobe Flash by repeating the same process, selecting Shockwave Flash Object and then clicking on the disable button.
Guidance for users of earlier versions of Internet Explorer is available on the Microsoft website. Select the version of Internet Explorer you are using in the top right corner.
Bad actors behind the production of Angler Exploit Kit often leverage Flash Player vulnerabilities to distribute malware and also sometimes add the exploits for Flash Player vulnerabilities in the exploit kits, though the vulnerabilities are fixed by Adobe shortly.
This vulnerability is treated as "Critical" by Symantec by seeing the usage of Flash Player worldwide on Internet. Also taking a basic example, from the Facebook videos to Youtube and so on, all major Giants use Adobe Flash Player for video playback, putting almost every user on Risk of Zero-Day vulnerability in Adobe Flash Player.
