Adobe Systems is once again rolling out an emergency Flash update that patches a critical vulnerability under active attack to compromise the computers of unsuspecting users.
The latest Flash versions fix a remote code-execution bug that, as Ars reported last week, recently came under attack in the Angler exploit kit. Malware purveyors and other types of online crooks use such kits to seed compromised websites with attack code. Once people visit the sites with vulnerable computers, the booby-trapped pages surreptitiously exploit the vulnerabilities and install backdoors that can be used to log keystrokes, steal passwords, and install new pieces of malware at will.
An advisory Adobe published late last week warned that the bug resides in versions running on Windows, Macs, and Linux systems. So far, reports suggest that in-the-wild exploits are limited only to Windows systems. The vulnerability stems from a so-called use-after-free bug that allows attackers to corrupt the memory of affected computers. Trend Micro has additional technical details here.
"A critical vulnerability (CVE-2015-0311) exists in Adobe Flash Player 16.0.0.287 and earlier versions for Windows and Macintosh," the Adobe advisory stated. "Successful exploitation could cause a crash and potentially allow an attacker to take control of the affected system. We are aware of reports that this vulnerability is being actively exploited in the wild via drive-by-download attacks against systems running Internet Explorer and Firefox on Windows 8.1 and below."
Adobe said that people who have opted in to automatic Flash updating began receiving the fix over the weekend. For reasons that aren't yet clear, the updated version 16.0.0.296 wasn't available on the standard Flash download page at the time this post was being prepared. Instead, unencrypted HTTP links for updates are listed here. That arrangement is less than ideal since the HTTP links are susceptible to man-in-the-middle attacks that can be used to replace legitimate executable files with malicious ones. In 2015, it's unacceptable for companies to offer downloads over unencrypted webpages.
The latest update shows up as Flash version 16.0.0.296 for Windows and Macs running browsers other than Google Chrome. Non-Chrome updates for Linux are tagged as version 11.2.202.440. Chrome ships with its own version of Flash that often contains a different version number.
The updates mark the second time in less than a week that Adobe has released an emergency fix. Last week, version 16.0.0.287 was released for Windows and OS X to patch CVE-2015-0310. The vulnerability, which allows attackers to bypass security sandbox protections designed to mitigate the effects of exploits, was also being targeted in real-world attacks.
Readers are once again reminded that many Windows users must install two patches to be protected against critical Flash vulnerabilities such as the one being fixed now. One patch works for the Internet Explorer version of the Adobe program, while a separate update works for Firefox and possibly other browsers. The exceptions are Windows 8 and 8.1, which automatically update Flash for IE, and Chrome for all supported operating systems, which also automatically updates Flash. It's disappointing that Adobe has yet to provide a way for most Windows users to protect themselves without installing two fixes.
reader comments
111