Adobe Patches Reader Sandbox Escape Vulnerability Leveraged in Targeted Attacks
Adobe Systems released security updates for Adobe Flash Player, Adobe Reader and Adobe Acrobat on Tuesday to address several critical vulnerabilities, including one that has been exploited in the wild.
The flaw that has been exploited in the wild (CVE-2014-0546) affects the Windows versions of Adobe Reader and Adobe Acrobat, and was reported to the company by Costin Raiu and Vitaly Kamluk of Kaspersky Lab. According to Adobe, the flaw is a sandbox bypass vulnerability that can be exploited to run native code with escalated privileges.
In a blog post on Kaspersky’s Securelist website, Raiu described the vulnerability as a “rather creative sandbox escape technique” that has been exploited in a very limited number of targeted attacks.
“At the moment, we are not providing any details on these attacks as the investigation is still ongoing. Although these attacks are very rare, just to stay on the safe side we recommend everyone to get the update from the Adobe site as soon as possible,” Raiu said.
Users of Adobe Reader and Acrobat 11.0.07 and earlier are advised to update their installations to version 11.0.08. Those who use Adobe Reader and Acrobat 10.1.10 should update to version 10.1.11.
As far as Adobe Flash Player is concerned, the latest version addresses a total of 7 critical security holes reported by Wen Guanxing from Venustech Adlab, lokihardt@asrt, Soroush Dalili from NCC Group, and Chris Evans of Google’s Project Zero.
The issues with the CVE identifiers CVE-2014-0540, CVE-2014-0542, CVE-2014-0543, CVE-2014-0544 and CVE-2014-0545 are memory leakage vulnerabilities that can be leveraged to bypass memory address randomization. CVE-2014-0541 is a security bypass vulnerability, while CVE-2014-0538 is a use-after-free bug that can be exploited to remotely execute arbitrary code on affected systems.
Flash Player is utilized internally by Adobe Integrated Runtime (Adobe AIR) so users of the cross-platform run-time system are also advised to update their installations.
Adobe is not the only company that patched security holes on Tuesday. Google updated the stable channel of Chrome to version 36.0.1985.143 for Windows, Mac and Linux to fix a total of 12 flaws. The latest version also includes a Flash Player update.
Additionally, Microsoft released nine security bulletins to address a total of 37 vulnerabilities affecting products like Windows, Internet Explorer, the .NET framework, OneNote, SQL Server and Microsoft Server Software.