Skip to main content

New zero-day exploit hits fully patched Adobe Flash


Jasper_The_Rasper
Moderator
Forum|alt.badge.img+54

Attacks used to hijack end users' computers when they visit booby-trapped sites.

by Dan Goodin - Oct 13, 2015
 
Attackers are exploiting a previously unknown vulnerability in fully patched versions of Adobe's Flash Player so they can surreptitiously install malware on end users' computers, security researchers warned Tuesday.
 
So far, the attacks are known to target only government agencies as part of a long-running espionage campaign carried out by a group known as Pawn Storm, researchers from antivirus provider Trend Micro said in a blog post published Tuesday. It's not unusual for such zero-day exploits to be more widely distributed once the initial element of surprise wanes. The critical security flaw is known to reside in Flash versions 19.0.0.185 and 19.0.0.207 and may also affect earlier versions. At this early stage, no other technical details are available. The researchers wrote:
 
Full Article

7 replies

RetiredTripleHelix
Gold VIP
Forum|alt.badge.img+56
Here is another Article: http://blog.trendmicro.com/trendlabs-security-intelligence/new-adobe-flash-zero-day-used-in-pawn-storm-campaign/
 
Adobe needs to get ahead of this not always working behind and the new release yesterday come-on Adobe.
 
Daniel 😠

shorTcircuiT
Gold VIP
  • Gold VIP
  • 7721 replies
  • October 14, 2015
Pretty embarassing indeed given the patch just yesterday. 

Jasper_The_Rasper
Moderator
Forum|alt.badge.img+54
Adobe Security Bulletin

 

Security Advisory for Adobe Flash Player


Release date: October 14, 2015
Vulnerability identifier: APSA15-05
CVE number: CVE-2015-7645
Platforms: Windows, Macintosh and Linux

Summary


A critical vulnerability (CVE-2015-7645) has been identified in Adobe Flash Player 19.0.0.207 and earlier versions for Windows, Macintosh and Linux. Successful exploitation could cause a crash and potentially allow an attacker to take control of the affected system.  
Adobe is aware of a report that an exploit for this vulnerability is being used in limited, targeted attacks.  Adobe expects to make an update available during the week of October 19.   

Affected software versions


  • Adobe Flash Player 19.0.0.207 and earlier versions for Windows and Macintosh
  • Adobe Flash Player Extended Support Release version 18.0.0.252 and earlier 18.x versions
  • Adobe Flash Player 11.2.202.535 and earlier 11.x versions for Linux
To verify the version of Adobe Flash Player installed on your system, access the About Flash Player page, or right-click on content running in Flash Player and select "About Adobe (or Macromedia) Flash Player" from the menu. If you use multiple browsers, perform the check for each browser you have installed on your system.   

Severity ratings


Adobe categorizes this as a critical vulnerability.

Acknowledgments


Adobe would like to thank Peter Pi of Trend Micro for reporting CVE-2015-7645 and for working with Adobe to help protect our customers.  
 
https://helpx.adobe.com/security/products/flash-player/apsa15-05.html

 


Petrovic
Gold VIP
Forum|alt.badge.img+52
  • Gold VIP
  • 1544 replies
  • October 16, 2015
Adobe Flash Player 19.0.0.226
 
Click here to check your version and Here to Download and here is an Alternate Download make sure you uncheck any unwanted add-ons and download both the one for IE if you have Windows 7 and older as it's not needed for Windows 8 or Windows 10 as it's downloaded via Windows Update and the same with Chrome they have it built in there own Browser, for other Browsers such as Firefox, Safari, Opera plugins continue to download and install!

nic
Forum|alt.badge.img+56
  • Retired Webrooter
  • 6752 replies
  • October 16, 2015

Forum|alt.badge.img+15
  • New Voice
  • 19 replies
  • November 2, 2015
Why is Adobe ALWAYS behind. Do they not have tech's to test for problems in advance?

Baldrick
Gold VIP
  • Gold VIP
  • 16060 replies
  • November 2, 2015
Hi caa1
 
If I may offfer a personal observation...? It the nature of a patch that it applies retrospectively to some issue that has already been found...that is by definition. I suppose what you mean is why is it not Adobe finding the issues and providing the patch rather than someone else finding them so that Adobe can provide the patch?
 
Well, by definition software suppliers rarely look backwards...if they did they would not be in business for long (as proven by many that have fallen by the way side over the years. Their focus is onwards and upwards and so they leave it to organisations that are dedicated to looking backwards for such vulnerabilities, etc.
 
IMHO it is just the way of the world...I do not like it anymore than the next person but that is the way it is and is unlikely to change.
 
Regards, Baldrick

Reply