Rewterz Threat Advisory – CVE-2018-15982 & CVE-2018-15983 – Microsoft Windows Adobe Flash Player Multiple Vulnerabilities

Two vulnerabilities in Adobe Flash Player can be exploited to execute arbitrary code on system, gain system access and acquire privilege escalation.

IMPACT:  CRITICAL

PUBLISH DATE:  06-DEC-2018

OVERVIEW

Multiple vulnerabilities have been reported in Microsoft Windows Adobe Flash Player. Malicious, local users may exploit these to gain escalated privileges or even compromise a vulnerable system. Adobe confirms that one of the vulnerabilities is being exploited in the wild. Updates that address these vulnerabilities are available.

ANALYSIS

A critical vulnerability in Adobe Flash Player and one important vulnerability in Adobe Flash Player installer could lead to arbitrary code-execution and privilege-escalation in the context of the current user respectively.

Researchers have discovered a phishing campaign that exploits CVE-2018-15982. The exploit code for this Flash zero-day (a use-after-free() bug) with an ActiveX call is embedded within an Office document, compressed into one RAR file with a JPG picture. It’s delivered to victims via spear-phishing emails.

When the document is opened by a victim, the ActiveX plug-in calls up Flash Player to run the attack code. Then CVE-2018-15982 is exploited which extracts out RAT from the JPG picture. The malware proceeds to download its real payload ‘backup.exe’; a remotely controlled executable file that collects system information and forwards it to a C&C server via HTTP POST.

Successful exploit enables an attacker to gain command line access to the system. The embedded payload serves to avoid detection by security software.

Since the vulnerability is exploited in the wild, researchers believe that this flaw could be exploited by cybercriminals or APT groups for large-scale attacks, which means applying latest Adobe Flash patch must not be delayed.

Another flaw has been patched in the updates which is an insecure library loading (via DLL hijacking) vulnerability. Identified as CVE-2018-15983, this vulnerability could fulfil privilege escalation motives of an attacker via Adobe Flash.

AFFECTED PRODUCTS

• Microsoft Windows Server 2012
• Microsoft Windows RT 8.1
• Microsoft Windows 8.1
• Microsoft Windows 10
• Microsoft Windows Server 2016
• Microsoft Windows Server 2019

UPDATES

Apply updates for Windows.

• Adobe Flash Player on Windows 10 Version 1703 for 32-bit Systems (KB4471331):
• Adobe Flash Player on Windows 10 Version 1703 for x64-based Systems (KB4471331):
• Adobe Flash Player on Windows 10 Version 1803 for 32-bit Systems (KB4471331):
• Adobe Flash Player on Windows 10 Version 1803 for x64-based Systems (KB4471331):

https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4471331

• Adobe Flash Player on Windows 10 Version 1803 for ARM64-based Systems (KB4471331):

Apply update (please see the vendor’s service database for details).

• Adobe Flash Player on Windows 10 Version 1809 for 32-bit Systems (KB4471331):
• Adobe Flash Player on Windows 10 Version 1809 for x64-based Systems (KB4471331):

https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4471331

• Adobe Flash Player on Windows 10 Version 1809 for ARM64-based Systems (KB4471331):

Apply update (please see the vendor’s service database for details).

• Adobe Flash Player on Windows Server 2019 (KB4471331):
• Adobe Flash Player on Windows 10 Version 1709 for 32-bit Systems (KB4471331):
• Adobe Flash Player on Windows 10 Version 1709 for 64-based Systems (KB4471331):

https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4471331

• Adobe Flash Player on Windows 10 Version 1709 for ARM64-based Systems (KB4471331):

Apply update (please see the vendor’s service database for details).

• Adobe Flash Player on Windows 10 for 32-bit Systems (KB4471331):
• Adobe Flash Player on Windows 10 for x64-based Systems (KB4471331):
• Adobe Flash Player on Windows 10 Version 1607 for 32-bit Systems (KB4471331):
• Adobe Flash Player on Windows 10 Version 1607 for x64-based Systems (KB4471331):
• Adobe Flash Player on Windows Server 2016 (KB4471331):
• Adobe Flash Player on Windows 8.1 for 32-bit systems (KB4471331):
• Adobe Flash Player on Windows 8.1 for x64-based systems (KB4471331):
• Adobe Flash Player on Windows RT 8.1 (KB4471331):
• Adobe Flash Player on Windows Server 2012 (KB4471331):
• Adobe Flash Player on Windows Server 2012 R2 (KB4471331):

https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4471331

Note: Security updates for Windows 10, Windows Server 2016, and Windows RT 8.1 are available via e.g. Windows Update or Windows Update Catalog only.

(For General updates, Adobe Flash Player Desktop Runtime, Adobe Flash Player for Google Chrome; Adobe Flash Player for Microsoft Edge and Internet Explorer 11; all for versions 31.0.0.153 and earlier are affected. Adobe Flash Player Installer versions 31.0.0.108 and earlier is also affected.

Users of these impacted products can update to version 32.0.0.101, according to Adobe. Users of Adobe Flash Player Installer can update to version 31.0.0.122.)

If you think you’re a victim of a cyber-attack, immediately send an email to soc@rewterz.com.