Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Two vulnerabilities in Adobe Flash Player can be exploited to execute arbitrary code on system, gain system access and acquire privilege escalation.
IMPACT: CRITICAL
PUBLISH DATE: 06-DEC-2018
OVERVIEW
Multiple vulnerabilities have been reported in Microsoft Windows Adobe Flash Player. Malicious, local users may exploit these to gain escalated privileges or even compromise a vulnerable system. Adobe confirms that one of the vulnerabilities is being exploited in the wild. Updates that address these vulnerabilities are available.
ANALYSIS
A critical vulnerability in Adobe Flash Player and one important vulnerability in Adobe Flash Player installer could lead to arbitrary code-execution and privilege-escalation in the context of the current user respectively.
Researchers have discovered a phishing campaign that exploits CVE-2018-15982. The exploit code for this Flash zero-day (a use-after-free() bug) with an ActiveX call is embedded within an Office document, compressed into one RAR file with a JPG picture. It’s delivered to victims via spear-phishing emails.
When the document is opened by a victim, the ActiveX plug-in calls up Flash Player to run the attack code. Then CVE-2018-15982 is exploited which extracts out RAT from the JPG picture. The malware proceeds to download its real payload ‘backup.exe’; a remotely controlled executable file that collects system information and forwards it to a C&C server via HTTP POST.
Successful exploit enables an attacker to gain command line access to the system. The embedded payload serves to avoid detection by security software.
Since the vulnerability is exploited in the wild, researchers believe that this flaw could be exploited by cybercriminals or APT groups for large-scale attacks, which means applying latest Adobe Flash patch must not be delayed.
Another flaw has been patched in the updates which is an insecure library loading (via DLL hijacking) vulnerability. Identified as CVE-2018-15983, this vulnerability could fulfil privilege escalation motives of an attacker via Adobe Flash.
AFFECTED PRODUCTS
UPDATES
Apply updates for Windows.
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4471331
Apply update (please see the vendor’s service database for details).
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4471331
Apply update (please see the vendor’s service database for details).
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4471331
Apply update (please see the vendor’s service database for details).
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4471331
Note: Security updates for Windows 10, Windows Server 2016, and Windows RT 8.1 are available via e.g. Windows Update or Windows Update Catalog only.
(For General updates, Adobe Flash Player Desktop Runtime, Adobe Flash Player for Google Chrome; Adobe Flash Player for Microsoft Edge and Internet Explorer 11; all for versions 31.0.0.153 and earlier are affected. Adobe Flash Player Installer versions 31.0.0.108 and earlier is also affected.
Users of these impacted products can update to version 32.0.0.101, according to Adobe. Users of Adobe Flash Player Installer can update to version 31.0.0.122.)
If you think you’re a victim of a cyber-attack, immediately send an email to soc@rewterz.com.