Adobe patches Flash Zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2016-0147 | Microsoft XML Core Services 3.0 allows remote attackers to execute arbitrary code via a crafted web site, aka "MSXML 3.0 Remote Code Execution Vulnerability." Microsoft XML Core Services 3.0 allows remote attackers to execute arbitrary code via a crafted web site, aka "MSXML 3.0 Remote Code Execution Vulnerability." NVD description · AI analysis pending | 8.8 | 16% |
| — | ||
| CVE-2016-4117 | Arbitrary Code Execution in Adobe Flash Player 21.0.0.226 and earlier CVE-2016-4117 is a critical (CVSS 3.1: 9.8) arbitrary code execution vulnerability in Adobe Flash Player 21.0.0.226 and earlier, in which unspecified vectors in the Flash runtime allow remote attackers to execute arbitrary code. It is triggered by delivering malicious Flash content over a network — for example a crafted SWF loaded by a browser or an application that embeds Flash — and, per its CVSS scoring, requires no privileges or authentication. A successful exploit gives the attacker code execution in the context of the Flash runtime (typically the user's browser process), which public reporting shows was used to deliver espionage tooling and, per CISA, is also known to be used in ransomware campaigns. Anyone running Flash Player 21.0.0.226 or earlier was affected, including users of the flash-player packages shipped for Red Hat Enterprise Linux Desktop, Server (including the RHUI variant) and Workstation, openSUSE, openSUSE Evergreen, and SUSE Linux Enterprise Desktop and the SUSE Linux Enterprise Workstation Extension. The bug was exploited in the wild in May 2016 — related headlines tie it to the BlackOasis APT 'Operation Daybreak' espionage campaign using FinFisher — and it was added to the CISA KEV on 2022-03-03 with known ransomware use and a very high 94.4% EPSS. Do: Per CISA's required action, Flash Player is end-of-life: remove or disable Flash wherever it is still present and uninstall the flash-player packages on any remaining RHEL, SUSE or openSUSE hosts, especially internet-facing systems. If a legacy system must keep Flash, ensure it runs a release later than 21.0.0.226 (a fixed build from the May 2016 Adobe update or later) and restrict it from untrusted web content. | 9.8 | 94% | KEV ransomware PoC |
| mass≈100M+ desktop users at the time of disclosure (Flash was then near-universal); residual small base of end-of-life installs today | |
| CVE-2016-4171 | Unspecified Remote Code Execution Flaw in Adobe Flash Player CVE-2016-4171 is an unspecified vulnerability in Adobe Flash Player that allows remote code execution; neither the CVE description nor CISA provides technical detail on the underlying flaw. As a Flash RCE, it is presumably triggered by getting a victim to load attacker-supplied Flash content (for example a malicious SWF in a web page or document), though the available data does not confirm the attack vector. Successful exploitation would let an attacker execute arbitrary code with the privileges of the user running Flash, typically yielding a foothold on the endpoint. All Adobe Flash Player deployments are affected per the data, and because Flash reached end-of-life at the end of 2020, anyone still running it is on an unpatched legacy product. The vulnerability is known exploited: CISA added it to the KEV catalog on 2022-03-25 (ransomware use unknown), EPSS assigns a 20.2% probability of exploitation within 30 days (97th percentile), and no public proof-of-concept is known. Do: Per CISA's required action, remove or disconnect Adobe Flash Player wherever it is still in use - the product is end-of-life and unpatched, so there is no fixed version to upgrade to. Audit endpoints and internal applications for Flash dependencies (standalone Flash, projector files, legacy intranet apps), migrate or retire them, and as a stopgap block SWF/Flash content at mail and web gateways. | 9.8 | 20% | KEV |
| massplausibly millions of residual Flash installs worldwide, though the number actively exposed today is unknown (Flash was historically on nearly every PC but is… |
Full article638 words · extracted from securityaffairs.com · click to collapse
Adobe Flash Player 22.0.0.192 release fixes the Flash Player zero-day vulnerability (CVE-2016-4171) exploited by the APT group dubbed ScarCruft.
Adobe has issued the Flash Player 22.0.0.192, a release that fixes the Flash Player zero-day vulnerability (CVE-2016-4171) exploited by the APT group dubbed ScarCruft in attacks on high-profile targets.
The Flash Player flaw CVE-2016-4171 affects versions 21.0.0.242 and earlier for Windows, Mac, Linux and Chrome OS, according to Kaspersky a threat actor behind the “Operation Daybreak” used it in targeted attacks conducted March 2016.
According to Kaspersky Lab, the ScarCruft APT group exploited the zero day in a series of attacks against high-profile targets against entities in Russia, Nepal, South Korea, China, Kuwait, India and Romania.
“Currently, the group is engaged in two major operations: Operation Daybreak and Operation Erebus. The first of them, Operation Daybreak, appears to have been launched by ScarCruft in March 2016 and employs a previously unknown (0-day) Adobe Flash Player exploit, focusing on high profile victims.” explained Costin Raiu, director of Global Research and Analysis Team at Kaspersky Lab. “The other one, “Operation Erebus” employs an older exploit, for CVE-2016-4117 and leverages watering holes. It is also possible that the group deployed another zero day exploit, CVE-2016-0147, which was patched in April.”
The new release addressed a total of 36 flaws that could be exploited by hackers to run arbitrary code on the vulnerable systems and that could result in information disclosure.
The flaws were reported to Adobe by security experts from Cisco, FireEye, Google, Kaspersky Lab, Microsoft, Pangu LAB, Qihoo 360, and Tencent.
The list of flaws fixed includes use-after-free, directory search path, heap buffer overflow, and same-origin policy (SOP) bypass vulnerabilities.
The ScarCruft APT exploited also another vulnerability (CVE-2016-0147) in Microsoft XML Core Services (MSXML) affecting Microsoft Windows. This second flaw can be exploited through Internet Explorer, Microsoft issued a security patch in April, but hackers exploited before the fix was released.
The Flash Player flaw CVE-2016-4171 affects versions 21.0.0.242 and earlier for Windows, Mac, Linux and Chrome OS, according to Kaspersky a threat actor behind the “Operation Daybreak” used it in targeted attacks conducted March 2016.
“Currently, the group is engaged in two major operations: Operation Daybreak and Operation Erebus. The first of them, Operation Daybreak, appears to have been launched by ScarCruft in March 2016 and employs a previously unknown (0-day) Adobe Flash Player exploit, focusing on high profile victims.” explained Costin Raiu, director of Global Research and Analysis Team at Kaspersky Lab. “The other one, “Operation Erebus” employs an older exploit, for CVE-2016-4117 and leverages watering holes. It is also possible that the group deployed another zero day exploit, CVE-2016-0147, which was patched in April.”
“It is not a secret that anti-malware systems trigger on special system functions that are called in the context of potential vulnerable applications to make a deeper analysis of API calls such as CreateProcess, WinExec or ShellExecute,” Ivanov and Raiu wrote in a blog post published on SecureList.
“For instance, such defense technologies trigger if a potentially vulnerable application such as Adobe Flash starts other untrusted applications, scripts interpreters or even the command console,” the experts added. “To make execution of payload invisible for these defense systems, the threat actors used the Windows DDE interface in a very clever way.”
According to the experts from Kaspersky, the malicious code (HEUR:Trojan.Win32.ScarCruft.gen) used by threat actors in Operation Daybreak is “extremely rare” and likely used only for surgical attacks.
Experts from Kaspersky explained that Flash Player exploits in the wild are becoming rare because they need to be coupled with a Sandbox bypass exploit, furthermore Adobe is spending a significant effort in implementing new mitigations to make exploitation of Flash Player more and more difficult.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
Security Affairs – (CVE-2016-4171 Zero-Day, Adobe)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/48531/hacking/flash-zero-day-scarcruft.html