Vulnerabilitycritical
Adobe Flash Player 0-day and HackingTeam’s Remote Control System
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2010-3333 | Stack Buffer Overflow in Microsoft Office RTF Parsing Allows Remote Code Execution | — | 89% | KEV | — KEV |
| CVE-2012-5054 | Remote Code Execution via Integer Overflow in Adobe Flash Player | — | 21% | KEV | — KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 176.58.100.37 | tW for ~3 months before patching) – used with C2 at: hxxp://176.58.100.37/0000040037/scandale.doc 5. CVE-2012-1682 : (0-day. Security |
| ipv4 | 76.162.33.13 | , we-ve seen attacks using other C2s as well: 1 2 3 4 5 6 7 76.162.33.13 / stagedocsis www . wiki - islam . info / new / stagedocbn |
| url | http://176.58.100.37/0000040037/scandale.doc | tml . ItW for ~3 months before patching) – used with C2 at: hxxp://176.58.100.37/0000040037/scandale.doc 5. CVE-2012-1682 : (0-day. Security Explorations ~2 months |
| url | http://ar-66.com/installer.jar | y. Security Explorations ~2 months ITW before publishing )- hxxp://ar-66.com/installer.jar 6. CVE-2013-0633 : 0-day, previously unknown Some of these |
| url | http://li565-84.members.linode.com/0000000093/word_document.doc3 | ://li565-84.members.linode.com/0000000093/worddocument.doc3 hxxp://li565-84.members.linode.com/0000000093/word_document.doc3 hxxp://li565-84.members.linode.com/0000000098/worddocuments |
| url | http://li565-84.members.linode.com/0000000093/worddocument.doc3 | ://li565-84.members.linode.com/0000000097/worddocument.doc3 hxxp://li565-84.members.linode.com/0000000093/worddocument.doc3 hxxp://li565-84.members.linode.com/0000000093/word_document |
| url | http://li565-84.members.linode.com/0000000097/worddocument.doc3 | ed in the shellcode used in the second stage of the attack: hxxp://li565-84.members.linode.com/0000000097/worddocument.doc3 hxxp://li565-84.members.linode.com/0000000093/worddocument. |
| url | http://li565-84.members.linode.com/0000000098/worddocuments.doc3 | //li565-84.members.linode.com/0000000093/word_document.doc3 hxxp://li565-84.members.linode.com/0000000098/worddocuments.doc3 (a Linode server in Japan) Previously, we-ve seen attacks u |
| url | http://rcs-demo.hackingteam.it/0000000001/exploit.doc2 | 3 : C2 at hxxps://ar-24.com/0000000031/veryimportant.doc2 + hxxp://rcs-demo.hackingteam.it/0000000001/exploit.doc2 4. CVE-2012-5054 : (0-day Vupen, see http://packetstormsecu |
| url | https://ar-24.com/0000000031/veryimportant.doc2 | www.maile-s.com/yarab/stagedocJord 3. CVE-2010-3333 : C2 at hxxps://ar-24.com/0000000031/veryimportant.doc2 + hxxp://rcs-demo.hackingteam.it/0000000001/exploit.doc2 4. |
| url | https://www.maile-s.com/yarab/stagedocJord | -073.cfm . ~3 months ITW before publishing ). Used with C2: hxxps://www.maile-s.com/yarab/stagedocJord 3. CVE-2010-3333 : C2 at hxxps://ar-24.com/0000000031/veryi |
From the original article
4 min read at securelist.com
Last week, Adobe released a patch for a vulnerability in Flash Player that was being exploited in targeted attacks. Before reading any further, we recommend you to take a moment make sure you apply this patch. Adobe offers this nifty tool to check that you have the latest version of Flash Player.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.