Connect with us

Hi, what are you looking for?



Adobe Fixes Second Flash Player Zero-Day Vulnerability

Adobe updated Flash Player over the weekend to fix the second zero-day vulnerability (CVE-2015-0311) reported last week. The patch was initially announced for this week, but the company released it ahead of schedule.

Adobe updated Flash Player over the weekend to fix the second zero-day vulnerability (CVE-2015-0311) reported last week. The patch was initially announced for this week, but the company released it ahead of schedule.

For the time being, only users who have auto-update enabled will get Flash Player, which addresses the critical vulnerability.

“Adobe expects to have an update available for manual download during the week of January 26, and we are working with our distribution partners to make the update available in Google Chrome and Internet Explorer 10 and 11,” Adobe said in an update to its initial advisory for this flaw.

The vulnerability affects all versions of Internet Explorer and Firefox running on Windows 8.1 and earlier versions of Microsoft’s operating system. Chrome doesn’t appear to be impacted.

An exploit for this security hole was spotted last week by the French researcher “Kafeine” in an instance of the Angler exploit kit. The flaw has been leveraged by cybercriminals in drive-by download attacks designed to distribute a variant of the Bedep malware, which in this case has been used for ad fraud. The expert says he has spotted several Bedep samples in this attack, including a variant designed for 64-bit systems.

According to the researcher, the attackers are leveraging migsetup.exe, a legitimate component of the Windows Easy Transfer application, to bypass User Account Control (UAC) on infected computers.

In addition to the Angler attacks, CVE-2015-0311 has also been used by cybercriminals in “standalone mode” to distribute a variant of the notorious Reveton ransomware through adult websites, Kafeine said in a blog post.

Advertisement. Scroll to continue reading.

“There was a spike of traffic utilizing the 0-day beginning on January 20th, all of which were blocked by Cloud Web Security (CWS). Although this spike showed an increase in Angler related attacks, these attacks represent a small minority of the overall attack traffic, Cisco researchers explained in a blog postBased on our telemetry data we have seen domains associated with a single registrar being primarily responsible for the exploits being delivered. The approach appears to be rapid domain registration and exploitation with quick rotation of domains.

A different zero-day patched last week by Adobe (CVE-2015-0310) was seen in the same Angler exploit kit instance. Kafeine, who discovered the exploit, initially believed the attackers had been using a combination of two recently patched Flash Player flaws, but it later turned out to be an unpatched memory leak that could be leveraged to circumvent memory address randomization in Windows.

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join security experts as they discuss ZTNA’s untapped potential to both reduce cyber risk and empower the business.


Join Microsoft and Finite State for a webinar that will introduce a new strategy for securing the software supply chain.


Expert Insights

Related Content


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...


The latest Chrome update brings patches for eight vulnerabilities, including seven reported by external researchers.


Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.


A researcher at IOActive discovered that home security systems from SimpliSafe are plagued by a vulnerability that allows tech savvy burglars to remotely disable...


Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.