Subscribe

Adobe issues fix for zero-day vulnerability

Martin Czernowalow
By Martin Czernowalow, Contributor.
Johannesburg, 26 Jan 2015
Trend Micro warns the Adobe vulnerability could be used by attackers to run code or programs on users' Windows PCs.
Trend Micro warns the Adobe vulnerability could be used by attackers to run code or programs on users' Windows PCs.

Software maker Adobe has issued a fix for a critical vulnerability in Adobe Flash Player 16.0.0.287 and earlier versions for Windows and Macintosh.

The company said last Thursday that a successful exploitation could cause a crash and potentially allow an attacker to take control of the affected system. "We are aware of reports that this vulnerability is being actively exploited in the wild via drive-by-download attacks against systems running Internet Explorer and Firefox on Windows 8.1 and below."

The company then issued a statement at the weekend, saying users who have enabled auto-update for the Flash Player desktop runtime will be receiving version 16.0.0.296, from Saturday.

"This version includes a fix for CVE-2015-0311. Adobe expects to have an update available for manual download during the week of 26 January, and we are working with our distribution partners to make the update available in Google Chrome and Internet Explorer 10 and 11," it says.

Security software company Trend Micro warned last week the vulnerability could be used by attackers to run code or programs on users' Windows computers. "Anything you can do on your computer, the attacker's program can do. In a worst case like this, they can load malware on your computer."

Trend Micro further warned the vulnerability is particularly serious as it is a "zero-day" situation, meaning that even if users keep their system up-to-date, they remain at risk of attack until Adobe releases a patch.

"What makes this situation more serious is that the attacks we've seen are using banner ads (called 'malvertisements') to spread malware. This means you can go to trusted sites you expect to be safe and still get malware on your system.

"These attacks work by attackers targeting and compromising the third-party ad servers that offer the ads you see on legitimate and popular sites. This is a particularly nasty form of attack, one that puts average users at great risk."

Trend Micro adds the situation is further exacerbated because this vulnerability is being used by what is called an "exploit kit" - a tool that cyber criminals make and sell to other cyber criminals so they can carry out attacks, which spreads attacks more widely.

"Taken all together, this means this is a vulnerability that can be widely attacked. It's a potentially very serious situation that everyone running Microsoft Windows should be aware of."

Share