Flash player exploit in the wild

Warning: We strongly suggest that readers NOT visit websites mentioned as being behind the attacks discussed. They should be considered dangerous and capable of infecting your system.

- http://isc.sans.org/diary.html?storyid=4465
Last Updated: 2008-05-27 18:12:46 UTC …(Version: 2) - "A vulnerability has been reported in Adobe Flash Player versions 9.0.124.0 and older, which is the current version available…
Update1: Symantec has observed that this issue is being actively exploited in the wild and have elevated their ThreatCon*.
Update2: A SecurityFocus article is now live here**."

ThreatCon is currently at Level 2: Elevated
* http://www.symantec.com/security_response/threatconlearn.jsp
"The DeepSight ThreatCon is being raised to Level 2 in response to the discovery of in-the-wild exploitation of an unspecified and unpatched vulnerability affecting Adobe Flash Player. The flaw occurs when processing a malicious SWF file. At the time of writing, details related to this vulnerability are scarce, but Symantec Security Response has been able to trigger the flaw in some scenarios. We're currently investigating the vulnerability to uncover additional details, including the sites used to host the attack… Currently two Chinese sites are known to be hosting exploits for this flaw: wuqing17173 .cn and woai117 .cn. The sites appear to be exploiting the same flaw, but are using different payloads… Network administrators are advised to blacklist these domains to prevent clients from inadvertently being redirected to them. Further analysis into these attacks, specifically the woai117 .cn attack, uncovered another domain involved dota11 .cn . We have discovered that this site is being actively injected into sites through what is likely SQL injection vulnerabilities. A google search reports approximately 20,000 web pages (not necessarily distinct servers or domains) injected with a script redirecting users to this malicious site…"

** http://www.securityfocus.com/bid/29386

Malicious swf files?
- http://isc.sans.org/diary.html?storyid=4468
Last Updated: 2008-05-27 18:46:44 UTC …(Version: 2) - "…potentially malicious site found at hxxp ://www .play0nlnie .com/pcd/topics/ff11us/20080311cPxl31/07.jpg
The JPG file is actually a script… Unknown at this time if these SWF files are related to this vulnerability."

FYI…

- http://www.shadowserver.org/wiki/pmwiki.ph…lendar.20080527
May 27, 2008 - 11:16 PM - "…important that you make sure you have updated your Adobe Flash Player to the latest version* (9.0.124.0 at the time of this writing)… it seems that several websites are now taking advantage of a flaw in the Adobe Flash Player previously covered by CVE-2007-0071**. It appears that Symantec started noticing this activity being exploited in the wild and initially labeled it a 0-day threat as they thought it affected [removed]. However, they have since posted an update*** potentially changing this view. Both Symantec and the Internet Storm Center have posted information surrounding the vulnerability and some of the websites that are actively exploiting it. It would appear this is in fact fully patched with the latest version and is the same vulnerability described by CVE-2007-0071. We decided to look into this a bit more and see what other websites are out there exploited this vulnerability and what they attempted to install. It did not take us long to find several other websites beyond those already mentioned. It would appear that this exploit has been pretty widely known within the Chinese community for the past two days or so… Did we mention that you should UPGRADE YOUR FLASH PLAYER (if you haven't already)? It's always a good idea to keep your software up-to-date, but it should surely be a priority to do so now…"

* http://www.adobe.com/shockwave/download/do…=ShockwaveFlash

** http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-0071
Last revised: 4/25/2008 - "…Adobe Flash Player 9.0.115.0 and earlier…"

*** http://www.symantec.com/security_response/…atcon/index.jsp

FYI…

- http://blogs.adobe.com/psirt/2008/05/poten…_issue_u_1.html
May 28, 2008 11:09AM - "…This exploit does NOT appear to include a new, unpatched vulnerability as has been reported elsewhere – customers with Flash Player 9.0.124.0 should not be vulnerable to this exploit. We’re still looking in to the exploit files, and will update everyone with further information as we get it, but for now, we strongly encourage everyone to download and install the latest Flash Player update, 9.0.124.0*…"
* http://www.adobe.com/go/getflashplayer

———–

Retired: Adobe Flash Player SWF File Remote Code Execution Vulnerability
- http://www.securityfocus.com/bid/29386/discuss
Updated: May 28 2008 07:53PM - "…Further research indicates that this vulnerability is the same issue described in BID 28695** (Adobe Flash Player Multimedia File Remote Buffer Overflow Vulnerability), so this BID is being retired."

** http://www.securityfocus.com/bid/28695/solution
"…The vendor released Flash Player 9.0.124.0 to address this issue…"

FYI…

- http://securitylabs.websense.com/content/Alerts/3096.aspx
05.29.2008 - "Websense… has detected thousands of web sites infected with the recent mass JavaScript injection that exploits a vulnerability in Adobe Flash (CVE-2007-0071*) to deliver its malicious payload… This vulnerability is not a 0-day and users with the latest version of Flash Player (version 9.0.124.0) are safe. However, there are still many on older versions of Flash that are unaware of this mass web infection and are susceptible to this drive-by attack. An update to the latest version of Flash Player is highly recommended**.
Websense ThreatSeeker has been tracking these malicious web sites and have discovered numerous reputable web sites that are now unwilling participants, infecting their very own visitors. These sites are from various industries such as government, education, healthcare, finance, media, and entertainment. This attack also attempts to exploit other popular vulnerabilities such as MDAC, RealPlayer, and various ActiveX controls… drive-by threat… site screenshots from: Microsoft, Dept. of Education (Australia), PBS, Durex, CDC (Centers for Disease Control and Prevention), Discovery Channel, various universities and a Pakistani district government."

* http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-0071
Last revised: 4/25/2008 - "…Adobe Flash Player 9.0.115.0 and earlier…"

** http://www.adobe.com/go/getflashplayer

(Screenshots available at the Websense URL above.)

FYI…

- http://blogs.zdnet.com/security/?p=1236
June 3, 2008 - "…Google Analytics has a nifty feature where it will give you information on your visitor’s browser capabilities, including the version of Flash installed down to the revision level… the statistics confirmed the low percentage of up-to-date Flash players.
Date % up-to-date
5/26 15.28
5/27 15.93
5/28 16.50
5/29 17.51
Remember, this is still 7 weeks after the update was released… After roughly 2 months, less than 20% of users had applied an update that addresses a critical remote code execution vulnerability… How does the average user know that they should update Flash and how to do so? By reading the trade press? Microsoft learned that you have to harass the user into patching their operating system and even then, it should be as automatic as possible. As Flash currently enjoys an essentially universal market share, now is the time to make significant security improvements without having to repeat the lessons that others have had to so painfully learn…"

- http://www.shadowserver.org/wiki/pmwiki.ph…lendar.20080527
May 27, 2008