Adobe updated Flash Player over the weekend to fix the second zero-day vulnerability (CVE-2015-0311) reported last week. The patch was initially announced for this week, but the company released it ahead of schedule.
For the time being, only users who have auto-update enabled will get Flash Player 16.0.0.296, which addresses the critical vulnerability.
“Adobe expects to have an update available for manual download during the week of January 26, and we are working with our distribution partners to make the update available in Google Chrome and Internet Explorer 10 and 11,” Adobe said in an update to its initial advisory for this flaw.
The vulnerability affects all versions of Internet Explorer and Firefox running on Windows 8.1 and earlier versions of Microsoft’s operating system. Chrome doesn’t appear to be impacted.
An exploit for this security hole was spotted last week by the French researcher “Kafeine” in an instance of the Angler exploit kit. The flaw has been leveraged by cybercriminals in drive-by download attacks designed to distribute a variant of the Bedep malware, which in this case has been used for ad fraud. The expert says he has spotted several Bedep samples in this attack, including a variant designed for 64-bit systems.
According to the researcher, the attackers are leveraging migsetup.exe, a legitimate component of the Windows Easy Transfer application, to bypass User Account Control (UAC) on infected computers.
In addition to the Angler attacks, CVE-2015-0311 has also been used by cybercriminals in “standalone mode” to distribute a variant of the notorious Reveton ransomware through adult websites, Kafeine said in a blog post.
“There was a spike of traffic utilizing the 0-day beginning on January 20th, all of which were blocked by Cloud Web Security (CWS). Although this spike showed an increase in Angler related attacks, these attacks represent a small minority of the overall attack traffic,” Cisco researchers explained in a blog post. “Based on our telemetry data we have seen domains associated with a single registrar being primarily responsible for the exploits being delivered. The approach appears to be rapid domain registration and exploitation with quick rotation of domains.”
A different zero-day patched last week by Adobe (CVE-2015-0310) was seen in the same Angler exploit kit instance. Kafeine, who discovered the exploit, initially believed the attackers had been using a combination of two recently patched Flash Player flaws, but it later turned out to be an unpatched memory leak that could be leveraged to circumvent memory address randomization in Windows.