Emergency Flash Update Nabs Zero Day

Monday, October 19, 2015 @ 07:10 PM gHale

Adobe released a Flash Player update to fix the Zero Day vulnerability Pawn Storm hackers were exploiting.

The latest version of Flash Player for Windows and OS X (v19.0.0.226) and for Linux (v11.2.202.540) plugs three distinct holes, which can lead to a total compromise of the targeted systems.

Flash, Acrobat, Reader Holes Fixed
Adobe Zero Day Under Attack
Adobe Patches Flash Player Vulnerabilities
Adobe Fixes Shockwave Holes

This patch was on tap for this week, but Adobe decided to get the fix out earlier.

The Pawn Storm attackers used the flaw to target foreign affairs ministries from around the globe. The attack and the exploit ended up discovered by Trend Micro threats analyst Peter Pi, but Natalie Silvanovich of Google Project Zero detected the flaw and reported it two weeks before it was found exploited out in the industry.

“Our analysis of the Adobe Flash Zero Day vulnerability used in the latest Pawn Storm campaign reveals that the previous mitigation techniques introduced by Adobe were not enough to secure the platform,” Pi said in a post following the release of the Flash update.

Adobe introduced several mitigation techniques for Flash exploits earlier this year, co-working with Google Project Zero. These mitigation techniques focused on reducing Vector.<*> exploits, because a corrupted Vector.<*> ended up frequently used to achieve the ability to read and write arbitrary parts of memory,” he said.

“Once these mitigations were put in place, the exploits in the wild decreased, but they did not completely disappear,” Pi said. “This latest vulnerability is the first zero-day exploit discovered in the wild after these mitigations were added.”

Users should implement the update as soon as possible.