Adobe to Patch Flash Zero-Day Discovered in South Korean Attacks

Critical use-after-free vulnerability being used in targeted attacks.

A previously unknown and critical flaw in Adobe Flash found being exploited in targeted attacks against victims in South Korea will be patched the week of February 5.
Adobe today confirmed
a report yesterday
by South Koreas Computer Emergency Response Team (KrCERT/CC) of the discovery of the zero-day vulnerability in Flash Player ActiveX 28.0.0.137 and earlier versions. The bug (CVE-2018-4878) abused in the attacks is a use-after-free vulnerability that allows remote code execution, according to Adobes advisory.
Johannes Ullrich, head of the SANS Internet Storm Center, says the fact that this was a targeted, zero-day attack makes it more likely to be the handiwork of a nation-state actor.
The attack was rather limited, and targeted at individuals in South Korea who are involved in research about North Korea. I think this makes for a pretty strong case that this was a nation-state sponsored attack. Other actors would have little motivation to use a zero-day exploit in an attack against a group like this, Ullrich says. On the other hand, it doesnt have to be North Korea, given the difficulty of attribution.
A researcher from South Korea in
a tweet
today said North Korea was behind the attacks, and the victims all conduct research on North Korea. Simon Choi, who is director of the security research center at Hauri, said the zero-day exploit had been in use since mid-November by North Korea.
John Bambenek, manager of threat systems at Fidelis Cybersecurity, says the ideological theme of the attacks targeting could mean the Lazarus Group is behind the attacks, but its difficult to discern without the technical details from the South Korean CERT. Even so, the Lazarus Group isnt known for employing homegrown zero-day exploits, he says.
The Flash vulnerability was spotted targeting Windows users via emails with Office documents that contain embedded and malware-laden Flash content. Successful exploitation could potentially allow an attacker to take control of the affected system, according to Adobes advisory.
While awaiting the patch, an attack can be mitigated by configuring Flash Player 27 and above on Windows 7 and below (running Internet Explorer) to prompt the user before playing Flash content. Protected View for Office also can be set up for Windows that marks files as potentially unsafe, leaving them in Read-Only mode for users, Adobe noted in
its advisory
.
Products affected by the vulnerability include Adobes Flash Player Desktop Runtime on Windows and Mac; Flash Player for Google Chrome on Windows, Mac, Linux, and Chrome OS; Flash for Microsoft Edge and Internet Explorer 11 on Windows 10 and 8.1; and Flash Player Desktop Runtime on Linux.
Related Content:
IoT Botnets by the Numbers
Lazarus Group, Fancy Bear Most Active Threat Groups in 2017
Phishing Campaign Underscores Threat from Low Budget, Low Skilled Attackers
Digital Extortion to Expand Beyond Ransomware

Last News
▸ Senate wants changes to cybercrime law. ◂ Discovered: 23/12/2024 Category: security	▸ Car Sector Speeds Up In Security. ◂ Discovered: 23/12/2024 Category: security	▸ Making use of a homemade Android army ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Adobe to Patch Flash Zero-Day Discovered in South Korean Attacks