Adobe updated Flash Player over the weekend to fix the second zero-day vulnerability (CVE-2015-0311) reported last week. The patch was initially announced for this week, but the company released it ahead of schedule.
For the time being, only users who have auto-update enabled will get Flash Player 16.0.0.296, which addresses the critical vulnerability.
“Adobe expects to have an update available for manual download during the week of January 26, and we are working with our distribution partners to make the update available in Google Chrome and Internet Explorer 10 and 11,” Adobe said in an update to its initial advisory for this flaw.
The vulnerability affects all versions of Internet Explorer and Firefox running on Windows 8.1 and earlier versions of Microsoft’s operating system. Chrome doesn’t appear to be impacted.
An exploit for this security hole was spotted last week by the French researcher “Kafeine” in an instance of the Angler exploit kit. The flaw has been leveraged by cybercriminals in drive-by download attacks designed to distribute a variant of the Bedep malware, which in this case has been used for ad fraud. The expert says he has spotted several Bedep samples in this attack, including a variant designed for 64-bit systems.
According to the researcher, the attackers are leveraging migsetup.exe, a legitimate component of the Windows Easy Transfer application, to bypass User Account Control (UAC) on infected computers.
In addition to the Angler attacks, CVE-2015-0311 has also been used by cybercriminals in “standalone mode” to distribute a variant of the notorious Reveton ransomware through adult websites, Kafeine said in a blog post.
“There was a spike of traffic utilizing the 0-day beginning on January 20th, all of which were blocked by Cloud Web Security (CWS). Although this spike showed an increase in Angler related attacks, these attacks represent a small minority of the overall attack traffic,” Cisco researchers explained in a blog post. “Based on our telemetry data we have seen domains associated with a single registrar being primarily responsible for the exploits being delivered. The approach appears to be rapid domain registration and exploitation with quick rotation of domains.”
A different zero-day patched last week by Adobe (CVE-2015-0310) was seen in the same Angler exploit kit instance. Kafeine, who discovered the exploit, initially believed the attackers had been using a combination of two recently patched Flash Player flaws, but it later turned out to be an unpatched memory leak that could be leveraged to circumvent memory address randomization in Windows.
Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- China’s Offensive Cyber Operations in Africa Support Soft Power Efforts
- SANS Survey Shows Drop in 2023 ICS/OT Security Budgets
- Apple Patches 3 Zero-Days Likely Exploited by Spyware Vendor to Hack iPhones
- Cisco to Acquire Splunk for $28 Billion
- Car Cybersecurity Study Shows Drop in Critical Vulnerabilities Over Past Decade
- Omron Patches PLC, Engineering Software Flaws Discovered During ICS Malware Analysis
- Intel Launches New Attestation Service as Part of Trust Authority Portfolio
- Atos Unify Vulnerabilities Could Allow Hackers to Backdoor Systems
Latest News
- Researchers Discover Attempt to Infect Leading Egyptian Opposition Politician With Predator Spyware
- In Other News: New Analysis of Snowden Files, Yubico Goes Public, Election Hacking
- China’s Offensive Cyber Operations in Africa Support Soft Power Efforts
- Air Canada Says Employee Information Accessed in Cyberattack
- BIND Updates Patch Two High-Severity DoS Vulnerabilities
- Faster Patching Pace Validates CISA’s KEV Catalog Initiative
- SANS Survey Shows Drop in 2023 ICS/OT Security Budgets
- Apple Patches 3 Zero-Days Likely Exploited by Spyware Vendor to Hack iPhones
