Zero-Day Bug Found in Adobe Flash

H

HardOCP News

[H] News
Joined
Dec 31, 1969
Messages
0
Symantec has posted an advisory warning of attacks using malicious PDF files that exploit a zero-day bug in Adobe’s Flash.

Recently we came into possession of an Adobe Acrobat PDF file that upon opening drops and executes a malicious binary. It was quite clear that this PDF was exploiting some vulnerability in order to drop its payload. And, during the analysis it soon became apparent that this vulnerability was not one we had seen in the wild before. What was even more surprising was that this vulnerability affects Adobe Flash—not Adobe Reader as we initially suspected.
Click to expand...
 
Is flash the new Internet Explorer? Starting to sound like swiss cheese.
 
anyone have a good explanation of zero-day bug vs a normal bug? whats the zero-day stand for?
 
jroe52 said:
anyone have a good explanation of zero-day bug vs a normal bug? whats the zero-day stand for?
Click to expand...

http://en.wikipedia.org/wiki/Zero_day_attack

A zero-day (or zero-hour) attack or threat is a computer threat that tries to exploit computer application vulnerabilities that are unknown to others, undisclosed to the software vendor, or for which no security fix is available. Zero-day exploits (actual code that can use a security hole to carry out an attack) are used or shared by attackers before the software vendor knows about the vulnerability.

The term derives from the age of the exploit. When a vendor becomes aware of a security hole, there is a race to close it before attackers discover it or the vulnerability becomes public. A "zero day" attack occurs on or before the first or "zeroth" day of vendor awareness, meaning the vendor has not had any opportunity to disseminate a security fix to users of the software.[1] (In computer science, numbering often starts at zero instead of one.)
Click to expand...
 
What you need to know:
Testing shows that the vulnerability is exploitable on Windows XP and Vista, but the dropped executables do not run on Vista if UAC is enabled. Also, because this vulnerability affects Flash, any software that uses Flash is potentially vulnerable to this issue.
Click to expand...

It looks like the vulnerability isn't going to be patched until 7/30. WTG, guys!
 
It seems like I have to deploy as many Flash and Acrobat patches as I do Microsoft patches these days. Something's seriously wrong with that picture.
 
k1pp3r said:
For real, when is adobe going to get a freakin clue
Click to expand...

When they actually have a reason to improve their products. Everyone knows Flash is the most vulnerable part of any internet browser and Acrobat/Reader are infuriatingly bloated and slow programs, but they still control the market. :/
 
Jaerb4 said:
When they actually have a reason to improve their products. Everyone knows Flash is the most vulnerable part of any internet browser and Acrobat/Reader are infuriatingly bloated and slow programs, but they still control the market. :/
Click to expand...

They need a class action suit, or just someone to sue them, i would but i don't have the time or funds to do it.
 
Wraith44 said:
It seems like I have to deploy as many Flash and Acrobat patches as I do Microsoft patches these days. Something's seriously wrong with that picture.
Click to expand...

Totally. The last security scan I ran had about 50% adobe products being flagged: flash, reader, air, you name it.
 
A Flash exploit in a PDF?

You have got to be kidding me. We're seeing MS Office macroscripts all over again. I thought the industry learned its lesson about cross implementation the first time around...
 
Adobe's current suggestion for a workaround:
We are in the process of developing a fix for the issue, and expect to provide an update for Flash Player v9 and v10 for Windows, Macintosh, and Linux by July 30, 2009 (the date for Flash Player v9 and v10 for Solaris is still pending). We expect to provide an update for Adobe Reader and Acrobat v9.1.2 for Windows, Macintosh, and UNIX by July 31, 2009.

Deleting, renaming, or removing access to the authplay.dll file that ships with Adobe Reader and Acrobat v9.x mitigates the threat for those products, but users will experience a non-exploitable crash or error message when opening a PDF that contains SWF content. Depending on the product, the authplay.dll that ships with Adobe Reader and Acrobat 9.x for Windows is typically located at C:\Program Files\Adobe\Reader 9.0\Reader\authplay.dll or C:\Program Files\Adobe\Acrobat 9.0]\Acrobat\authplay.dll. Windows Vista users should consider enabling UAC (User Access Control) to mitigate the impact of a potential exploit. Flash Player users should exercise caution in browsing untrusted websites. Adobe is in contact with Antivirus and Security vendors regarding the issue and recommend users keep their anti-virus definitions up to date.
Click to expand...
http://blogs.adobe.com/psirt/2009/07/update_on_adobe_reader_acrobat.html
 
Well, this is a simple workaround since you can just rename one file to block the PDF attack.
 
k1pp3r said:
Adobe workarounds are crap and a pain in the arse. Have you ever seen their "manual workaround for removing acrobat 6 becuase the program sucks balls and can't even uninstall itself?
Click to expand...

I love how there's no date for a fix for Flash and their recommendation is "browse carefully." One poisoned ad on a safe site and you're SOL.
 
whoops I turned off the adobe updater :D... time to update it .... but but adobe's security can't be breached! :)
 
Wow, big surprise. :rolleyes:

I can't wait until HTML5 with its video tags and many Flash-like features becomes standard and kills Flash once and for all.

I wonder when HTML5 will become standard in browsers.Hopefully for Firefox 4, Safari 5, and IE 15. :p
 
Adobe is awful at these zero-day vulnerabilities...

When you try to package too much nonsense into your client applications (Flash, Reader, etc) that's what happens.
 
You must log in or register to reply here.
Back
Top