Adobe Flash zero-day exploit in the wild
Summary: [ See important update to this story here ]Malware hunters have spotted a previously unknown -- and unpatched -- Adobe Flash vulnerability being exploited in the wild.The zero-day flaw has been added to the Chinese version of the MPack exploit kit and there are signs that the exploits are being injected into third-party sites to redirect targets to malware-laden servers.
[ See important update to this story here ]
Malware hunters have spotted a previously unknown -- and unpatched -- Adobe Flash vulnerability being exploited in the wild.
The zero-day flaw has been added to the Chinese version of the MPack exploit kit and there are signs that the exploits are being injected into third-party sites to redirect targets to malware-laden servers.
Technical details on the vulnerability are not yet available. Adobe's product security incident response team is investigating.
This SecurityFocus advisory warns:
Adobe Flash Player is prone to an unspecified remote code-execution vulnerability.
An attacker may exploit this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts will likely result in denial-of-service conditions.
Adobe Flash Player 9.0.115.0 and 9.0.124.0 are vulnerable; other versions may also be affected.
I've independently verified that redirection scripts have been posted on at least two Chinese-language Web sites to launch drive-by downloads of malware. When the exploit fires, it checks the Flash version on the vulnerable computer and, depending on the result, it uses a different .SWF (shockwave) file to take complete control of the machine.
This threat should be considered very serious because of the widespread distribution that Adobe Flash enjoys on the Windows ecosystem. If this exploit gets seeded on high-traffic Web sites, we could be in for a long clean-up operation.
More from the SANS ISC diary.
[ UPDATE: Continued investigation reveals this issue is fairly widespread. Malicious code is being injected into other third-party domains (approximately 20,000 web pages) most likely through SQL-injection attacks. The code then redirects users to sites hosting malicious Flash files exploiting this issue.]
Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.
Talkback
Clarification
IE7 running in Protected Mode (the default in Vista) runs with fewer privileges than the current user. Would the exploit run in this context? If so, this malware was castrated before it even left the stall.
[i]Failed exploit attempts will likely result in denial-of-service conditions.[/i]
Please, oh please tell me this doesn't mean that your browser will crash. If so, why on earth do people insist on calling a denial of service? Your browser crashes, you open it again, and you don't go back to that site, case closed. Calling it a denial-of-service simply makes it sound like FUD.
Clarification to the Clarifier
Denial of Service is still an accurate term for a browser crash, even if it is blowing things a bit out of proportion. Trust me, every time I'm doing a blog posting and Safari crashes, I get uber pissed.
-Nate
PM is a sandbox not a LUA
Sorry spoke to fast
-Nate
Pwned browser still bad idea.
1) Hacker still can use YOU to perform unwanted activity like hacking.
2) Hacker still can send spam via your machine.
3) Hacker may turn you to some sort of proxy.
All this does not really requires any elevated rights.Fact that malicious code started is really enough for hacker to achieve all these goals.
And finally since these actions are appear to happen from YOUR machine under YOUR control at first it will be YOU who is held responsible for all this.Then you may even succeed in redirecting punishment to a right place.Or you may not, so you'll be held responsible for things you're never did.But in any case you may once have a decent amount of headache anyway due to hackers activity from your PC.
agreed -
As for the Flash plugin crashing - I guess the Adobe people see "play a Flash file/stream" as a service, so they call this a 'denial of service'. The claim is not technically correct in the common usage of the term unless the plugin is invoked via 'sockets'.
Here's a clarification that's needed.
Stop being an idiot and do some research
you sir are a complete idiot who refuses to do any research before claiming you know all possible tech phrases, and that everybody in the world made-up "zero day". you obviously have zero knowledge about computing and you flame every article with the phrase in it..... just go away ( search "dgurney exploit" and you will see he has posted the same thing, every article)
The perfect storm
-Nate
....
AdBlock and NoScript on Ubuntu
Still, I wish the threat advisories were more OS specific. Theoretically a remote threat could get control of user space through a third party app like Flash. Not sure what good that does them. You can't install anything with user privileges on Ubuntu. Can't access system files, config files...nothing.
And Vista as well
Properly configured Ubuntu
C'mon, that's not just lazy
RE: Adobe Flash zero-day exploit in the wild
I wonder if SilverLight is affected by this?
Leaving Adobe Flash?
So do UAC and DEP protect the user
So, any word on if UAC and DEP protect against this flaw?
Vuln still being analyzed
_ryan
Beyond that, how about a little advice
Appreciate you bringing this to our attention, but then how about some interim advice on what to do about it? If no remedial action has yet been proposed by Adobe, do you suggest temporarily disabling Flash and Shockwave? Or would that be an over-reaction at this juncture?
Adobe Flash Player version 9.0.124.0 still appears to be the latest available for download, the very one that is subject to the code-execution.
Advice that works anyway: NoScript
[u]http://hackademix.net/2008/05/28/unpatched-flash-vulnerability-widely-exploited-in-the-wild/#noscript[/u]