Adobe zero day flaw being actively exploited in wild |
 |
By SearchSecurity.com Staff
28 May 2008 | SearchSecurity.com |
|
|
The widely used Adobe Flash Player has a zero day flaw that is being targeted by a number of attackers who set up more than 200,000 Web pages to exploit the flaw.
|
|
|
|
|
The current malware attack has been traced back to Chinese blackhats, who are using a zero day to infect users with password stealers.
Dancho Danchev,
security researcher
|
|
|
|
|
|
|
|
|
|
The unspecified remote code-execution vulnerability could be exploited to cause denial of service conditions, according to Symantec, which reported the flaw on Monday.
Symantec said Adobe Flash Player 9.0.115.0 and 9.0.124.0 are vulnerable and other versions may also be affected. The flaw occurs when the flash player tries to process a malicious Shockwave Flash (SWF) file. The vulnerability is similar to an Adobe Flash Player multimedia file remote buffer overflow vulnerability, discovered by Mark Dowd of IBM, Symantec said.
Adobe said it was investigating the incident to determine if the previous flaw was incorrectly patched or if the latest wave of attacks is using a new variant.
Symantec is tracking a number of attacks which involve two Chinese sites known to be hosting exploits. Attackers are injecting malicious code into the sites using SQL-injection vulnerabilities. Up to 20,000 Web pages are serving up a script redirecting users to the malicious sites. As a result of the attacks in the wild, Symantec raised is ThreatCon to level 2.
Meanwhile, McAfee said it has discovered up to 250,000 Web pages designed to exploit the flaw. McAfee Avert Labs reported in its blog that different exploits are crafted to exploit the different versions of Adobe Flash. Exploits exist for both Internet Explorer and Firefox, McAfee said.
"McAfee Avert Labs has received submissions of samples of exploits from many sources spanning multiple domains over the past 24 hours," the research team said.
Security researcher Dancho Danchev said the flaw is "definitely worth assessing." Danchev is recommending that IT administrators consider blocking flash until the vulnerability is patched by Adobe.
"The current malware attack has been traced back to Chinese blackhats, who are using a zero day to infect users with password stealers," Danchev said in his Mind Streams of Information Security Knowledge blog.
|
