• Articles
    • Editorial Articles
    • Research Articles
    • WatchGuard Articles
  • The 443 Podcast
  • Threat Landscape
  • About
    • About Us
    • Contact Us
    • Contribute to Secplicity

Secplicity - Security Simplified

Powered by WatchGuard Technologies

Adobe Flash Player Update and Reader X 0day

November 8, 2012 By Corey Nachreiner

Summary:

  • These vulnerabilities affect: Adobe Flash Player running on all platforms, Adobe Air, and all versions of Reader X
  • How an attacker exploits it: By enticing users to visit a website containing malicious Flash content (or into downloading and opening a malicious PDF)
  • Impact: In the worst case, an attacker can execute code on the user’s computer, potentially gaining control of it
  • What to do: Download and install the latest version of Adobe Flash Player for your platform (see Solution section for Reader X flaw mitigation)

Exposure:

Adobe Flash Player displays interactive, animated web content called Flash. Although Flash is optional, 99% of PC users download and install it to view multimedia web content. It runs on many operating systems, including mobile operating systems like Android.

This week, Adobe released a security bulletin describing seven security vulnerabilities  (based on CVE numbers) that affect Flash Player running on any platform. It doesn’t describe the flaws in much technical detail, other than mentioning they consist of buffer overflow vulnerabilities and other types of memory corruption flaws. That said, Adobe does warn that if an attacker can entice one of your users to visit a malicious website containing specially crafted Flash content, he could exploit any of these flaws to execute code on that user’s computer, with that user’s privileges. If your Windows users have local administrator privileges, an attacker could exploit this flaw to gain full control of their PCs.

Though it doesn’t look like attackers are exploiting these Flash flaws in the wild yet, Adobe rates them as “Priority 1” for Windows users, and recommends you apply the Windows updates within 72 hours. These vulnerabilities also affect other platforms as well, though not as severely. I recommend you update any Flash capable device as soon as you can.

In semi-related news, a Russian security group warns they have found attackers exploiting a zero day Adobe Reader X vulnerability in the wild. The flaw affects the most recent versions of the popular PDF reader, and can even escape its sandbox protection. In short, if you interact with the wrong PDF document, an attacker could gain complete control of your computer. The good news is the web version of this attack does require a victim to close and re-open their browser to succeed, making it a little harder to pull off.

At the time of writing, Adobe has yet to respond to this zero day report, and has not released a patch. Your primary recourse is to try to avoid unsolicited PDF documents. You can also leverage WatchGuard’s file-blocking capabilities to temporarily restrict your user’s access to PDF files, though this will also prevent them from downloading legitimate ones, too.

One final note: Next month Adobe plans to sync their Flash updates with Microsoft’s Patch Tuesday updates. So you can expect all future Adobe updates (other than perhaps emergency ones), on the second Tuesday of the month.

Solution Path

Adobe has released new versions of Flash Player to fix these issues. If you allow Adobe Flash in your network, you should download and install the new versions immediately. If you’ve enabled Flash Player’s recent “silent update” option, you will receive this update automatically.

You can download Flash for your computer at the link provided below. See the bulletin’s “Affected Software” section for more details on getting Flash updates for other platforms:

Keep in mind, if you use Google Chrome you’ll have to update it separately.
There is no fix for the zero day Reader X vulnerability. We recommend you avoid handling unsolicited PDF documents, or you can block them on all our security appliances.

For All WatchGuard Users:

If you choose, you can configure the HTTP proxy on your XTM appliance to block Flash or PDF content. Keep in mind, doing so blocks all such content, whether legitimate or malicious.

Our proxies offer many ways for you to block files and content, including by file extension, MIME type, or by using very specific hexidecimal patterns found in the body of a message – a technique sometimes referred to as Magic Byte detection. Below I list the various ways you can identify these various files:

File Extension:

  • .flv –  Adobe Flash file (file typically used on websites)
  • .fla – Flash movie file
  • .f4v – Flash video file
  • .f4p – Protected Flash video file
  • .f4a – Flash audio file
  • .f4b – Flash audiobook file
  • .PDF – Adobe Reader document

MIME types:

  • video/x-flv
  • video/mp4 (used for more than just Flash)
  • audio/mp4 (used for more than just Flash)
  • application/pdf
  • application/x-pdf
  • application/acrobat
  • applications/vnd.pdf
  • text/pdf
  • text/x-pdf

FILExt.com reported Magic Byte Pattern:

  •  FLV Hex: 46 4C 56 01
  • FLV ASCII: FLV
  • FLA Hex:  D0 CF 11 E0 A1 B1 1A E1 00
  • PDF Hex: 25 50 44 46 2D 31 2E
  • PDF ASCII: %PDF-1

(Keep in mind, not all the Hex and ASCII patterns shared here are appropriate for content blocking. If the pattern is too short, or not unique enough, blocking with them could result in many false positives.) 

If you decide you want to block these files, the links below contain instructions that will help you configure your Firebox proxy’s content blocking features using the file and MIME information listed above.

  • XTM Appliance with WSM 11.x
    • How do I block files with the FTP proxy?
    • How do I block files with the HTTP proxy?
    • How do I block files with the POP3 proxy?
    • How do I block files with the SMTP Proxy?
  • Firebox X Edge running 10.x
    • How do I block files with the FTP proxy?
    • How do I block files with the HTTP proxy?
    • How do I block files with the POP3 proxy?
    • How do I block files with the SMTP proxy
  • Firebox X Core and X Peak running Fireware 10.x
    • How do I block files with the FTP proxy?
    • How do I block files with the HTTP proxy?
    • How do I block files with the POP3 proxy?
    • How do I block files with the SMTP proxy?

Status:

Adobe has released updates to fix these Flash vulnerabilities, however, they have not yet responded to the Reader X zero day.

References:

  • November 2012 Adobe Flash Security Bulletin

This alert was researched and written by Corey Nachreiner, CISSP (@SecAdept)

Share This:

Related

Filed Under: Security Bytes Tagged With: Adobe, Remote code execution (RSE), Updates and patches

Comments

  1. http://delicious.com/yseoesle says

    December 5, 2012 at 7:22 pm

    Hey very nice website!! Guy .. Excellent .. Amazing .
    . I will bookmark your blog and take the feeds additionally?

    I am satisfied to search out so many helpful info here in the put
    up, we want develop extra techniques on this regard, thanks for sharing.

    . . . . .

    Reply
  2. Keesha says

    April 12, 2013 at 7:37 pm

    Hi there, after reading this remarkable piece of writing i am too happy to share my knowledge here with
    colleagues.

    Reply
  3. Marylouise O. Mott says

    September 26, 2014 at 7:43 am

    What’s up all, here every one is sharing these kinds
    of experience, so it’s nice to read this webpage, and I used
    to pay a quick visit this weblog all the time.

    Reply

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

The 443 Podcast

A weekly podcast featuring the leading white-hat hackers and security researchers. Listen Now
the 443 podcast

Threat Landscape

Filter and view Firebox Feed data by type of attack, region, country, and date range. View Now
threat landscape

Top Posts

  • Cybersecurity News: Free Cybersecurity Training, TrickBot Group Exposed, Major GoDaddy Breach, and Russia to Legalize cybercrime?!
  • US National Cybersecurity Strategy
  • 3CX Supply Chain Attack
  • Here Come The Regulations

Email Newsletter

Sign up to get the latest security news and threat analysis delivered straight to your inbox

By signing up you agree to our Privacy Policy.


The views and opinions expressed on this website are those of the authors and do not necessarily reflect the policy or position of WatchGuard Technologies.

Stay in Touch

Recent Posts

  • 3CX Supply Chain Attack
  • The NSA’s Guidance on Securing Authentication
  • Cybersecurity News: LastPass Incident Revealed, White House Issues Cybersecurity Strategy, FBI Purchases Leaked USHOR PII Data, and a Slew of Other Breaches
  • An Update on Section 230
  • Here Come The Regulations
View All

Search

Archives

Copyright © 2023 WatchGuard Technologies · Cookie Policy · Privacy Policy · Terms of Use