Confusion mounts over which Flash versions are under attack
Chinese hackers exploit stand-alone versions, but not current plug-in, says Symantec
Computerworld - Contrary to initial reports, the Flash Player exploit being fed to users who visit legitimate Web sites is not a true zero-day exploit, a researcher said today.
But that's hardly the point, said Don Jackson, the director of threat intelligence at SecureWorks Inc. "I'd still call this catastrophic," said Jackson, "because when you look at the distribution of Flash versions, users hardly ever have the latest one."
In fact, Jackson was on target in more ways than he knew. Ben Greenbaum, a senior research manager at Symantec Corp., said later that although the vulnerability is not new -- and thus not really a "zero-day" bug -- some up-to-date versions of Flash Player are vulnerable to attack.
Greenbaum called it a "false-positive zero-day" and added that the exploit in circulation "does still work against some of the most current and patched versions of Flash Player, and so still has some characteristics of a zero-day."
For his part, Jackson said that the currently available version of Flash Player, dubbed 188.8.131.52, is immune, while computers running Flash Player 184.108.40.206 -- the edition superseded by an April update that Adobe Systems Inc. released to patch other vulnerabilities -- is susceptible to attack. "It looks like [220.127.116.11] has been patched," he said.
Greenbaum, however, went a step further. "The vulnerability is similar enough [to one already disclosed] that we're treating it as the same," he said. "But not all the versions are patched correctly."
The more widely-used browser plug-in of Flash Player 18.104.22.168 is not at risk, said Greenbaum, but the stand-alone Flash Player 22.214.171.124 is. Adobe offers both browser plug-in and stand-alone versions of its Flash Player.
Although it's not unheard of for patches to not properly protect all versions of a particular program, Greenbaum said, it is unusual, and even more so when comparing the stand-alone and plug-in editions of an application.
Adobe was not immediately available to confirm Greenbaum's claims, but the Symantec researcher said that his team had been working with the Flash developer since yesterday on the problem. "This is the latest and greatest news," Greenbaum said.
The Flash Player is-or-isn't-at-risk story began Tuesday, when researchers at the SANS Institute's Internet Storm Center and Symantec raised an alarm about the exploit and said it was triggering an unknown, and unpatched, vulnerability in the popular plug-in and application.
Later yesterday, however, Symantec seemed to back off its initial analysis. "Originally, it was believed that this issue was unpatched and unknown, but further technical analysis has revealed that it is very similar to the previously reported Adobe Flash Player Multimedia File Remote Buffer Overflow Vulnerability (BID 28695), discovered by Mark Dowd of IBM," Symantec said in a explanation of why it had bumped its ThreatCon ranking to Level 2.
- Single-Vendor Security Ecosystems Offer Concrete Benefits Over Point Solutions IT security decision-makers from companies with 100 to 5,000 employees evaluates the current endpoint security solution market based on Forrester's own market data,...
- Case Study: Intuit Turns to Self-Service IT Intuit empowered its users to resolve their own IT issues with a consumer-like experience to free IT to focus on more strategic initiatives....
- Automation for a Better Tomorrow Check out the five most common annoyances facing enterprise IT service desks today, and how automation can resolve all of them. Download the...
- Beyond the Enterprise App Store Leverage proactive, secure and automated IT Service delivery to move beyond the traditional App Store and empower your users. Read the white paper...
- Business-driven data protection Setting up data protection infrastructures with your organizations' core mission or business in mind is key. In this webinar, the ARCserve team will...
- On-Demand Webinar: Mind the Gap! Watch the webinar featuring Bob Janssen, CTO and Co-Founder of RES Software, to start building a solid foundation for business and IT to... All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!