Rockin' da fumanchu
Join Date: Nov 2005
Location: On the straight and narrow,stumbling at best, only by Gods grace.
Adobe Flash Player Exploit
Legitimate Web Sites Serving Zero Day Flash Player Exploit
28 May, 2008
These vulnerabilities affect: Adobe Flash Player 126.96.36.199 and earlier on Windows (potentially affects OS X, Unix, and Linux as well)
How an attacker exploits them: By enticing one of your users into playing a maliciously crafted Flash (.SWF) file
Impact: An attacker could execute code on the victim's computer, and take control of it
What to do: Adobe hasn't released a patch yet; see the solution section below for workarounds
Adobe Flash Player displays interactive, animated web content called Flash, often formatted as a Shockwave (.SWF) file. Adobe's Flash Player ships by default with many web browsers, including Internet Explorer (IE). It also runs on many operating systems.
Late yesterday, Symantec, SANS Internet Storm Center Handler's Diary [ 1 / 2 / 3 ], and SecurityFocus all warned of a serious zero day Flash Player vulnerability which they have found attackers exploiting in the wild. As of this writing, researchers do not know the technical details about this new vulnerability; they do know, however, that if one of your users downloads and plays a specially crafted Shockwave Flash (.SWF) file, an attacker could exploit the unpatched flaw to execute code on that user's computer, with that user's privileges. Since most Windows administrators grant their users local administrative privileges, an attacker could potentially exploit these flaws to gain complete control of a victim's computer. The malicious .SWF file could be hosted on a web site, sent via an HTML e-mail, or delivered in other ways via applications that embed Flash.
According to the last update from SecurityFocus, attackers are exploiting this zero day vulnerability in great numbers. They warn that attackers have injected this malicious .SWF exploit into approximately 20,000 legitimate web sites, using web-based attack techniques like those we recently described in our recent Radio Free Security podcast.
On the other hand, this morning Symantec updated their Threatcon information claiming this Flash Player vulnerability may not be as new as they originally thought. Their latest technical analysis reveals that the flaw appears similar to one Adobe has already patched. Even with that, Symantec has still observed this new exploit affecting fully patched versions of Adobe Flash Player. So, either this is a true zero day variant of the original flaw, or Adobe's patch is not working as reliably as it should. Regardless, if you allow Adobe Flash Player in your network, you should remain concerned about this new exploit and follow the workarounds suggested below.
Because researchers first found this vulnerability being exploited in the wild, Adobe has not had time to release a patch for Flash Player. Until they do, the following workarounds will mitigate the risk of this new exploit affecting your users:
Internet Explorer (IE) users can set the killbit for Adobe's Flash Player. This prevents IE from playing any Flash content with the Adobe Flash Player. Bear in mind that this also prevents legitimate Flash content from playing. Refer to this Microsoft Knowledge Base article for more details on how to set a killbit. Flash Player's CLSID is BD96C556-65A3-11D0-983A-00C04FC29E36.
Use a gateway device, like WatchGuard's Firebox products, to block .SWF files from entering your network. See below for more details.