Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Vulnerabilities

Adobe Patches Security Flaw Leveraged in Targeted Attacks

Adobe Patches Reader Sandbox Escape Vulnerability Leveraged in Targeted Attacks

Adobe Systems released security updates for Adobe Flash Player, Adobe Reader and Adobe Acrobat on Tuesday to address several critical vulnerabilities, including one that has been exploited in the wild.

Adobe Patches Reader Sandbox Escape Vulnerability Leveraged in Targeted Attacks

Adobe Systems released security updates for Adobe Flash Player, Adobe Reader and Adobe Acrobat on Tuesday to address several critical vulnerabilities, including one that has been exploited in the wild.

The flaw that has been exploited in the wild (CVE-2014-0546) affects the Windows versions of Adobe Reader and Adobe Acrobat, and was reported to the company by Costin Raiu and Vitaly Kamluk of Kaspersky Lab. According to Adobe, the flaw is a sandbox bypass vulnerability that can be exploited to run native code with escalated privileges.

In a blog post on Kaspersky’s Securelist website, Raiu described the vulnerability as a “rather creative sandbox escape technique” that has been exploited in a very limited number of targeted attacks.

 

“At the moment, we are not providing any details on these attacks as the investigation is still ongoing. Although these attacks are very rare, just to stay on the safe side we recommend everyone to get the update from the Adobe site as soon as possible,” Raiu said.

Users of Adobe Reader and Acrobat 11.0.07 and earlier are advised to update their installations to version 11.0.08. Those who use Adobe Reader and Acrobat 10.1.10 should update to version 10.1.11.

As far as Adobe Flash Player is concerned, the latest version addresses a total of 7 critical security holes reported by Wen Guanxing from Venustech Adlab, [email protected], Soroush Dalili from NCC Group, and Chris Evans of Google’s Project Zero.

The issues with the CVE identifiers CVE-2014-0540, CVE-2014-0542, CVE-2014-0543, CVE-2014-0544 and CVE-2014-0545 are memory leakage vulnerabilities that can be leveraged to bypass memory address randomization. CVE-2014-0541 is a security bypass vulnerability, while CVE-2014-0538 is a use-after-free bug that can be exploited to remotely execute arbitrary code on affected systems.

 

Flash Player is utilized internally by Adobe Integrated Runtime (Adobe AIR) so users of the cross-platform run-time system are also advised to update their installations.

Adobe is not the only company that patched security holes on Tuesday. Google updated the stable channel of Chrome to version 36.0.1985.143 for Windows, Mac and Linux to fix a total of 12 flaws. The latest version also includes a Flash Player update.

Additionally, Microsoft released nine security bulletins to address a total of 37 vulnerabilities affecting products like Windows, Internet Explorer, the .NET framework, OneNote, SQL Server and Microsoft Server Software.

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Expert Insights

Related Content

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

IoT Security

Lexmark warns of a remote code execution (RCE) vulnerability impacting over 120 printer models, for which PoC code has been published.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Email Security

Microsoft is urging customers to install the latest Exchange Server updates and harden their environments to prevent malicious attacks.

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Vulnerabilities

Security researchers have observed an uptick in attacks targeting CVE-2021-35394, an RCE vulnerability in Realtek Jungle SDK.

Vulnerabilities

Google has awarded more than $25,000 to the researchers who reported the vulnerabilities patched with the release of the latest Chrome update.

Mobile & Wireless

Apple’s iOS 12.5.7 update patches CVE-2022-42856, an actively exploited vulnerability, in old iPhones and iPads.