Article

Adobe zero day flaw being actively exploited in wild

SearchSecurity.com Staff

The widely used Adobe Flash Player has a zero day flaw that is being targeted by a number of attackers who set up more than 200,000 Web pages to exploit the flaw.

    Requires Free Membership to View

The current malware attack has been traced back to Chinese blackhats, who are using a zero day to infect users with password stealers.
Dancho Danchev,
security researcher

The unspecified remote code-execution vulnerability could be exploited to cause denial of service conditions, according to Symantec, which reported the flaw on Monday.

Symantec said Adobe Flash Player 9.0.115.0 and 9.0.124.0 are vulnerable and other versions may also be affected. The flaw occurs when the flash player tries to process a malicious Shockwave Flash (SWF) file. The vulnerability is similar to an Adobe Flash Player multimedia file remote buffer overflow vulnerability, discovered by Mark Dowd of IBM, Symantec said.

Adobe said it was investigating the incident to determine if the previous flaw was incorrectly patched or if the latest wave of attacks is using a new variant.

Symantec is tracking a number of attacks which involve two Chinese sites known to be hosting exploits. Attackers are injecting malicious code into the sites using SQL-injection vulnerabilities. Up to 20,000 Web pages are serving up a script redirecting users to the malicious sites. As a result of the attacks in the wild, Symantec raised is ThreatCon to level 2.

Meanwhile, McAfee said it has discovered up to 250,000 Web pages designed to exploit the flaw. McAfee Avert Labs reported in its blog that different exploits are crafted to exploit the different versions of Adobe Flash. Exploits exist for both Internet Explorer and Firefox, McAfee said.

"McAfee Avert Labs has received submissions of samples of exploits from many sources spanning multiple domains over the past 24 hours," the research team said.

Security researcher Dancho Danchev said the flaw is "definitely worth assessing." Danchev is recommending that IT administrators consider blocking flash until the vulnerability is patched by Adobe.

"The current malware attack has been traced back to Chinese blackhats, who are using a zero day to infect users with password stealers," Danchev said in his Mind Streams of Information Security Knowledge blog.


There are Comments. Add yours.

 
TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to: