logo_SVG-01
✕
  • Platform
    • Rewterz XDR
    • Rewterz Defense
    • Rewterz Threat Intelligence
    • Managed Security Services
    • Managed Penetration Testing
  • Services
    • Assess
      • Compromise Assessment
      • Advanced Persistent Threats Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      • SOC Maturity Assessment
      • SOC Model Evaluation
      • SOC Gap Analysis
      • SIEM Gap Analysis
      • SIEM Optimization
      • SOC Content Pack
    • Train
      • Simulated Cyber Attack Exercise
      • Tabletop Exercise
      • Security Awareness and Training
    • Respond
      • Incident Analysis
      • Incident Response
  • Solutions
  • Resources
    • Blogs
    • Press Releases
    • Threat Insights
      • Threat Intelligence Reports
      • Threat Advisories
      • Monthly Threat Insights
  • Why Rewterz?
    • About Us
    • Careers
    • Contact
logo_SVG-01
  • Platform
    xdrLogo
    center_new
    Read More about XDR

    Platform

    • Rewterz XDR
    • Rewterz Defense
    • Rewterz Threat Intelligence
    Rewterz Threat Advisory – CVE-2018-15982 & CVE-2018-15983 – Microsoft Windows Adobe Flash Player Multiple Vulnerabilities

    Managed Security Services

    • Managed Security Monitoring
    • Remote SOC
    • Onsite SOC
    • Hybrid SOC

    Managed Penetration Testing

    Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.

  • Services

    Assess

    • Compromise Assessment
    • APT Assessment
    • Penetration Testing
    • Architecture Design & Review
    • Red Team Assessment
    • Purple Team Assessment
    • Social Engineering
    • Source Code Review

    Transform

    • SOC Consultancy
    • SOC Maturity Assessment
    • SOC Model Evaluation
    • SOC Gap Analysis
    • SIEM Gap Analysis
    • SIEM Optimization
    • SOC Content Pack

    Train

    • Simulated Cyber Attack Exercise
    • Tabletop Exercise
    • Security Awareness and Training

    Respond

    • Incident Analysis
    • Incident Response
  • Solutions
  • Resources

    Resources

    • Blog
    • Press Releases
    March 25, 2023
    March 25, 2023
    Rewterz Threat Alert – GandCrab or .CRAB Ransomware – Active IOCs
    Severity Medium Analysis Summary GandCrab – a ransomware-as-a-service variant – was discovered in early 2018. At least five versions of GandCrab have been created since its […]
    March 25, 2023
    March 25, 2023
    Rewterz Threat Alert – NJRAT – Active IOCs
    Severity Medium Analysis Summary NjRat is a Remote Access Trojan, which is found leveraging Pastebin to deliver a second-stage payload after initial infection. There are multiple […]
    March 24, 2023
    March 24, 2023
    Rewterz Threat Advisory – CVE-2023-20113 – Cisco SD-WAN vManage Software Vulnerability
    Severity Medium Analysis Summary CVE-2023-20113  Cisco SD-WAN vManage Software is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By persuading an authenticated […]

    Threat Insights

    16
    pdf-file (1)
    Annual Threat Intelligence Report 2022
    • Threat Advisories
    • Monthly Threat Insights
    • Threat Intelligence Reports
  • Why Rewterz?

    About Us

    Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.

    Read More

    play_btn_Smallplay_btn_hover_Small
    leadership

    Our Leadership

    Our leadership team brings together years of knowledge and experience in cybersecurity to drive our company's mission and vision. Our team is passionate about delivering high-quality products and services, leading by example and assisting our clients in securing their organization’s environment.
    help

    CSR

    At Rewterz, we believe that businesses have a responsibility to impact positively and contribute to the well-being of our communities as well as the planet. That's why we are committed to operating in a socially responsible and sustainable way.

    Connect with Us

    • Contact
    • Careers
Get in Touch
logo_SVG-01
  • Platform
    xdrLogo
    center_new
    Read More about XDR

    Platform

    • Rewterz XDR
    • Rewterz Defense
    • Rewterz Threat Intelligence
    Rewterz Threat Advisory – CVE-2018-15982 & CVE-2018-15983 – Microsoft Windows Adobe Flash Player Multiple Vulnerabilities

    Managed Security Services

    • Managed Security Monitoring
    • Remote SOC
    • Onsite SOC
    • Hybrid SOC

    Managed Penetration Testing

    Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.

  • Services

    Assess

    • Compromise Assessment
    • APT Assessment
    • Penetration Testing
    • Architecture Design & Review
    • Red Team Assessment
    • Purple Team Assessment
    • Social Engineering
    • Source Code Review

    Transform

    • SOC Consultancy
    • SOC Maturity Assessment
    • SOC Model Evaluation
    • SOC Gap Analysis
    • SIEM Gap Analysis
    • SIEM Optimization
    • SOC Content Pack

    Train

    • Simulated Cyber Attack Exercise
    • Tabletop Exercise
    • Security Awareness and Training

    Respond

    • Incident Analysis
    • Incident Response
  • Solutions
  • Resources

    Resources

    • Blog
    • Press Releases
    March 25, 2023
    March 25, 2023
    Rewterz Threat Alert – GandCrab or .CRAB Ransomware – Active IOCs
    Severity Medium Analysis Summary GandCrab – a ransomware-as-a-service variant – was discovered in early 2018. At least five versions of GandCrab have been created since its […]
    March 25, 2023
    March 25, 2023
    Rewterz Threat Alert – NJRAT – Active IOCs
    Severity Medium Analysis Summary NjRat is a Remote Access Trojan, which is found leveraging Pastebin to deliver a second-stage payload after initial infection. There are multiple […]
    March 24, 2023
    March 24, 2023
    Rewterz Threat Advisory – CVE-2023-20113 – Cisco SD-WAN vManage Software Vulnerability
    Severity Medium Analysis Summary CVE-2023-20113  Cisco SD-WAN vManage Software is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By persuading an authenticated […]

    Threat Insights

    16
    pdf-file (1)
    Annual Threat Intelligence Report 2022
    • Threat Advisories
    • Monthly Threat Insights
    • Threat Intelligence Reports
  • Why Rewterz?

    About Us

    Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.

    Read More

    play_btn_Smallplay_btn_hover_Small
    leadership

    Our Leadership

    Our leadership team brings together years of knowledge and experience in cybersecurity to drive our company's mission and vision. Our team is passionate about delivering high-quality products and services, leading by example and assisting our clients in securing their organization’s environment.
    help

    CSR

    At Rewterz, we believe that businesses have a responsibility to impact positively and contribute to the well-being of our communities as well as the planet. That's why we are committed to operating in a socially responsible and sustainable way.

    Connect with Us

    • Contact
    • Careers
Get in Touch
Rewterz
Rewterz Threat Advisory – A Malspam campaign circulating the Lokibot Malware
December 5, 2018
Rewterz
Rewterz Threat Advisory – CVE-2018-5848 – Linux Kernel ‘wmi_set_ie()’ Buffer Overflow Vulnerability
December 6, 2018

Rewterz Threat Advisory – CVE-2018-15982 & CVE-2018-15983 – Microsoft Windows Adobe Flash Player Multiple Vulnerabilities

December 6, 2018

Two vulnerabilities in Adobe Flash Player can be exploited to execute arbitrary code on system, gain system access and acquire privilege escalation.

 

 

IMPACT:  CRITICAL

 

 

PUBLISH DATE:  06-DEC-2018

 

 

OVERVIEW

 

 

Multiple vulnerabilities have been reported in Microsoft Windows Adobe Flash Player. Malicious, local users may exploit these to gain escalated privileges or even compromise a vulnerable system. Adobe confirms that one of the vulnerabilities is being exploited in the wild. Updates that address these vulnerabilities are available.

 

 

ANALYSIS

 

 

A critical vulnerability in Adobe Flash Player and one important vulnerability in Adobe Flash Player installer could lead to arbitrary code-execution and privilege-escalation in the context of the current user respectively.

 

 

Researchers have discovered a phishing campaign that exploits CVE-2018-15982. The exploit code for this Flash zero-day (a use-after-free() bug) with an ActiveX call is embedded within an Office document, compressed into one RAR file with a JPG picture. It’s delivered to victims via spear-phishing emails.

 

 

When the document is opened by a victim, the ActiveX plug-in calls up Flash Player to run the attack code. Then CVE-2018-15982 is exploited which extracts out RAT from the JPG picture. The malware proceeds to download its real payload ‘backup.exe’; a remotely controlled executable file that collects system information and forwards it to a C&C server via HTTP POST.

 

 

Successful exploit enables an attacker to gain command line access to the system. The embedded payload serves to avoid detection by security software.

 

 

Since the vulnerability is exploited in the wild, researchers believe that this flaw could be exploited by cybercriminals or APT groups for large-scale attacks, which means applying latest Adobe Flash patch must not be delayed.

 

 

Another flaw has been patched in the updates which is an insecure library loading (via DLL hijacking) vulnerability. Identified as CVE-2018-15983, this vulnerability could fulfil privilege escalation motives of an attacker via Adobe Flash.

 

 

AFFECTED PRODUCTS

 

 

  • Microsoft Windows Server 2012
  • Microsoft Windows RT 8.1
  • Microsoft Windows 8.1
  • Microsoft Windows 10
  • Microsoft Windows Server 2016
  • Microsoft Windows Server 2019

 

 

UPDATES

 

 

Apply updates for Windows.

 

  • Adobe Flash Player on Windows 10 Version 1703 for 32-bit Systems (KB4471331):
  • Adobe Flash Player on Windows 10 Version 1703 for x64-based Systems (KB4471331):
  • Adobe Flash Player on Windows 10 Version 1803 for 32-bit Systems (KB4471331):
  • Adobe Flash Player on Windows 10 Version 1803 for x64-based Systems (KB4471331):

https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4471331

 

  • Adobe Flash Player on Windows 10 Version 1803 for ARM64-based Systems (KB4471331):

Apply update (please see the vendor’s service database for details).

  • Adobe Flash Player on Windows 10 Version 1809 for 32-bit Systems (KB4471331):
  • Adobe Flash Player on Windows 10 Version 1809 for x64-based Systems (KB4471331):

https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4471331

 

  • Adobe Flash Player on Windows 10 Version 1809 for ARM64-based Systems (KB4471331):

Apply update (please see the vendor’s service database for details).

  • Adobe Flash Player on Windows Server 2019 (KB4471331):
  • Adobe Flash Player on Windows 10 Version 1709 for 32-bit Systems (KB4471331):
  • Adobe Flash Player on Windows 10 Version 1709 for 64-based Systems (KB4471331):

https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4471331

 

  • Adobe Flash Player on Windows 10 Version 1709 for ARM64-based Systems (KB4471331):

Apply update (please see the vendor’s service database for details).

  • Adobe Flash Player on Windows 10 for 32-bit Systems (KB4471331):
  • Adobe Flash Player on Windows 10 for x64-based Systems (KB4471331):
  • Adobe Flash Player on Windows 10 Version 1607 for 32-bit Systems (KB4471331):
  • Adobe Flash Player on Windows 10 Version 1607 for x64-based Systems (KB4471331):
  • Adobe Flash Player on Windows Server 2016 (KB4471331):
  • Adobe Flash Player on Windows 8.1 for 32-bit systems (KB4471331):
  • Adobe Flash Player on Windows 8.1 for x64-based systems (KB4471331):
  • Adobe Flash Player on Windows RT 8.1 (KB4471331):
  • Adobe Flash Player on Windows Server 2012 (KB4471331):
  • Adobe Flash Player on Windows Server 2012 R2 (KB4471331):

https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4471331

 

Note: Security updates for Windows 10, Windows Server 2016, and Windows RT 8.1 are available via e.g. Windows Update or Windows Update Catalog only.

 

(For General updates, Adobe Flash Player Desktop Runtime, Adobe Flash Player for Google Chrome; Adobe Flash Player for Microsoft Edge and Internet Explorer 11; all for versions 31.0.0.153 and earlier are affected. Adobe Flash Player Installer versions 31.0.0.108 and earlier is also affected.

Users of these impacted products can update to version 32.0.0.101, according to Adobe. Users of Adobe Flash Player Installer can update to version 31.0.0.122.)

If you think you’re a victim of a cyber-attack, immediately send an email to soc@rewterz.com.

Platform

  • Rewterz XDR
  • Rewterz Defense
  • Rewterz Threat Intelligence

Managed Security Services

  • Managed Security Monitoring
  • Remote SOC
  • Onsite SOC
  • Hybrid SOC

Assess

  • Compromise Assessment
  • APT Assessment
  • Penetration Testing
  • Architecture Design & Review
  • Red Team Assessment
  • Purple Team Assessment
  • Social Engineering
  • Source Code Review

Transform

  • SOC Consultancy
  • SOC Maturity Assessment
  • SOC Model Evaluation
  • SOC Gap Analysis
  • SIEM Gap Analysis
  • SIEM Optimization
  • SOC Content Pack

Train

  • Simulated Cyber Attack Exercise
  • Tabletop Exercise
  • Security Awareness and Training

Respond

  • Incident Analysis
  • Incident Response

Threat Insights

  • Threat Advisories
  • Monthly Threat Insights
  • Threat Intelligence Reports

Resources

  • Blog
  • Press Releases

Connect With Us

  • Contact
  • Careers
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.
Get a Demo