Yesterday, Adobe put out an emergency update to fix a dangerous security hole in its widely-installed Flash Player browser plugin. They warned that the vulnerability is already being exploited in targeted attacks, and urged users to issue the patch as soon as possible.
In the advisory that they put on their website yesterday, Adobe said the latest version of Flash — v. 18.0.0.194 on Windows and Mac OS X — fixes a critical flaw (CVE-2015-3113) that is being actively exploited in “limited, targeted attacks.” Systems running Internet Explorer for Windows 7 and below, as well as Firefox on Windows XP, are known targets of these exploits.
Commenting on this, Clinton Karr, Snr Security Strategist at Bromium, said “This Adobe Flash zero-day illustrates why Internet content is so untrustworthy: attacks can be committed through the browser, through scripting languages and even through extensions. It’s a greenfield for hackers with no end in sight if the status quo for protection doesn’t change. Now that the exploit has been discovered, most security and operations teams are scrambling to do one of two things – race to deploy the newest patch before hackers can leverage the exploit for an attack. Or test the patch to make sure it integrates with legacy systems. This latest zero-day and others before it could have been isolated in the first place. Only by isolating the threat, are security and ops teams granted the grace period needed to test and deploy these critical patches.”
Mark James, Security Specialist at ESET, explained why Adobe Flash is targeted so often and what users should do to protect themselves. “Since Flash is such a widely used plugin, it stands to reason that it will be one of the most targeted apps for vulnerability. If you want to affect as many people as possible then you need an application that a lot of users use and flash is one of them. This is an excellent example of why you should be very aware of updates for software not only operating systems. Checking to see if any updates are available and installing them immediately is the only way to help protect yourself in the minefield of the software world that we use today. There is an excellent link that everyone should save and use as often as they can to check to see the latest version of flash and more importantly see if their version is the same or needs updating – https://www.adobe.com/software/flash/about/ I have shown the full link above and I request that you please be very careful of following links to update sites as these could sometimes be used to direct you to other malicious sites. I would personally recommend that you manually type the link to be absolutely sure if you have any concerns at all.”
Amichai Shulman, CTO of Imperva, gave further advice on what users and organisations can do. “This is a reminder that the average end user machine is extremely vulnerable to infection at any given point in time, even for individuals and organisations who carefully observe patching practices. It emphasises what we believe is should be the motto for modern corporate information practices: you have been compromised, make sure it does not turn into a breach. What it means is that organisations must shift their security investments to solutions that protect their data from abuse rather than their end stations from being compromised.”
