Tweaks.com Forum / Windows & System Security / Security News and Software Updates & Definitions / Hackers exploiting Flash Player zero-day bug / Latest Posts

RE: Hackers exploiting Flash Player zero-day bug

RichieUK — Thu, 29 May 2008 02:25:42 GMT

[quote][b]Symantec: We were wrong on Adobe Flash 'bug'[/b]

[b]Security firm backtracks on Flash threat[/b]
After warning on Tuesday that hackers were exploiting an unpatched bug in Adobe Systems' Flash Player software, Symantec has backtracked from this claim, saying the flaw is "very similar" to another vulnerability that was patched last month.

Symantec's initial warning described a disturbing threat - a previously unknown and unpatched flaw that was being exploited on tens of thousands of web pages. The flaw allowed attackers to install unauthorised software on a victim's machine and was being used to install botnet programs and password-logging software, Symantec said.

Now Symantec believes that the bug was previously known and patched by Adobe on April 8, said Ben Greenbaum, a senior research manager with Symantec Security Response. However, the Linux version of Adobe's stand-alone Flash Player, version 9.0.124, is vulnerable to the attack.[/quote]
[url]http://www.pcadvisor.co.uk/news/index.cfm?newsid=13201[/url]

RE: Hackers exploiting Flash Player zero-day bug

quietman7 — Wed, 28 May 2008 14:37:40 GMT

[quote]There are reports of a critical vulnerability affecting current versions of Adobe Flash and evidence of it being exploited in the wild. Versions including and previous to 9.0.124.0 are reported to be at risk. However — chatter on the security lists we frequent suggest version 9.0.124.0 is not vulnerable and that the attacks are only reliably effective against version 9.0.115.0 and earlier (using CVE-2007-0071).

In any case — we are seeing Flash exploits being used in combination with SQL injection attacks...[/quote]

f-secure.com/weblog

Hackers exploiting Flash Player zero-day bug

RichieUK — Tue, 27 May 2008 15:36:10 GMT

[quote][b]Details skimpy, but in-the-wild attacks taking place, say researchers[/b]
Attackers are exploiting an unpatched bug in Adobe System Inc.'s popular Flash Player, security researchers warned today.

The bug, which is in the most up-to-date version of Flash, was reported by researchers at the SAN Institute's Internet Storm Center and by others from Symantec Corp. [/quote]
[url=http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=security&articleId=9089778&taxonomyId=17&intsrc=kc_top][color="blue"]Computerworld.com[/color][/url]