Posted by: Samker
« on: 20. July 2013., 08:58:52 »Thanks for the update, pal. 
Members
Total Members: 14197- Latest: Levine
Stats
- Total Posts: 43440
- Total Topics: 16532
- Online today: 3122
- Online ever: 51419
- (01. January 2010., 10:27:49)
Users Online
Posted by: Pez
« on: 15. July 2013., 09:22:47 »Adobe Flash Zero-Day Attack Uses Advanced Exploitation Technique
On February 7, Adobe issued a security bulletin warning of zero-day attacks that leverage two Flash vulnerabilities. One (CVE-2013-0634) is related to ActionScript regular expression handling. (Some sources refer to this vulnerability as CVE-2013-0633. We are waiting for Adobe to confirm the proper CVE ID.)
McAfee Labs rapidly responded to the threat. While digging in depth into the original sample, we found that the exploit uses highly sophisticated exploitation techniques to attack various Flash Player versions. It also includes “user-friendly” tricks that give no signs or symptoms to its victims.
The ingenious exploit uses a previously unknown technique to craft the heap memory on Flash Player. With the aid of a regular expression-handling vulnerability that is related to a heap-based buffer overflow, the attack can create a highly reliable memory information leak that allows the exploit to bypass the usually effective exploitation mitigations of address space layout randomization (ASLR) and data execution prevention (DEP) on Windows 7 and other versions.
More important, the technique looks like a common exploitation approach to Flash Player. The vulnerability actually doesn’t help much–just overwriting few bytes that are considered as a field of “element number” for a specific ActionScript object. These traits show that the exploitation technique is not limited to this particular Flash vulnerability; it may apply to other Flash or non-Flash vulnerabilities.
McAfee Labs has learned the full details of this exploitation technique, and plan to publish our analysis in the near future. Watch this space for updates.
At this moment, considering the dangerousness of the attack, we strongly recommend that all users update their Flash Players. The official patch is available here. Though the patch doesn’t kill all exploitation techniques, it will keep systems immune to the current exploits in the wild.
For McAfee customers, various protections are provided. We have released signature “0x402df600_HTTP_Adobe_Flash_Player_CFF_Heap_Overflow_Remote_Code_Execution” for the exploits related to CVE-2013-0633 and “0x402df700_HTTP_Adobe_Flash_Player_ActionScript_Buffer_Overflow_Remote_Code_Execution” for CVE-2013-0634 for the Network Security Platform appliances. Also, the generic buffer overflow prevention feature on our HIPS products will stop the related attacks.
Thanks to Bing Sun, Xiaobo Chen, and Chong Xu for their help with this analysis.
Original article: Monday, February 11, 2013 at 3:31pm by Archive and Haifei Li
On February 7, Adobe issued a security bulletin warning of zero-day attacks that leverage two Flash vulnerabilities. One (CVE-2013-0634) is related to ActionScript regular expression handling. (Some sources refer to this vulnerability as CVE-2013-0633. We are waiting for Adobe to confirm the proper CVE ID.)
McAfee Labs rapidly responded to the threat. While digging in depth into the original sample, we found that the exploit uses highly sophisticated exploitation techniques to attack various Flash Player versions. It also includes “user-friendly” tricks that give no signs or symptoms to its victims.
The ingenious exploit uses a previously unknown technique to craft the heap memory on Flash Player. With the aid of a regular expression-handling vulnerability that is related to a heap-based buffer overflow, the attack can create a highly reliable memory information leak that allows the exploit to bypass the usually effective exploitation mitigations of address space layout randomization (ASLR) and data execution prevention (DEP) on Windows 7 and other versions.
More important, the technique looks like a common exploitation approach to Flash Player. The vulnerability actually doesn’t help much–just overwriting few bytes that are considered as a field of “element number” for a specific ActionScript object. These traits show that the exploitation technique is not limited to this particular Flash vulnerability; it may apply to other Flash or non-Flash vulnerabilities.
McAfee Labs has learned the full details of this exploitation technique, and plan to publish our analysis in the near future. Watch this space for updates.
At this moment, considering the dangerousness of the attack, we strongly recommend that all users update their Flash Players. The official patch is available here. Though the patch doesn’t kill all exploitation techniques, it will keep systems immune to the current exploits in the wild.
For McAfee customers, various protections are provided. We have released signature “0x402df600_HTTP_Adobe_Flash_Player_CFF_Heap_Overflow_Remote_Code_Execution” for the exploits related to CVE-2013-0633 and “0x402df700_HTTP_Adobe_Flash_Player_ActionScript_Buffer_Overflow_Remote_Code_Execution” for CVE-2013-0634 for the Network Security Platform appliances. Also, the generic buffer overflow prevention feature on our HIPS products will stop the related attacks.
Thanks to Bing Sun, Xiaobo Chen, and Chong Xu for their help with this analysis.
Original article: Monday, February 11, 2013 at 3:31pm by Archive and Haifei Li
Posted by: Samker
« on: 09. February 2013., 08:28:50 »
Adobe on Thursday updated Flash Player to patch a pair of zero-day vulnerabilities that hackers were already using to hijack Windows PCs and Macs.
The out-of-band, or emergency, update was Flash's first of the year and the first since Adobe moved the media software to a regular update schedule last fall.
As part of that schedule, Adobe was to ship a Flash Player update next Tuesday, but it instead released the fixes early. In a Thursday advisory, Adobe confirmed that the update patched two vulnerabilities, designated CVE-2013-0633 and CVE-2013-0634: http://www.adobe.com/support/security/bulletins/apsb13-04.html
Not surprisingly, it rated the update critical: Criminals have been exploiting both vulnerabilities for an undisclosed amount of time.
"Adobe is aware of reports that CVE-2013-0633 is being exploited in the wild in targeted attacks designed to trick the user into opening a Microsoft Word document delivered as an email attachment which contains malicious Flash content," stated the advisory.
The second vulnerability, CVE-2013-0633, has been used in a similar fashion against Windows targets, but has also been exploited during "drive-by" attacks against Firefox and Safari users on the Mac, said Adobe. A drive-by attack requires only that a victim be duped into browsing to a malicious website hosting an exploit.
Most Flash exploits are aimed at Windows users simply because they constitute the vast majority of potential victims. It's unusual for attacks to also target Macs running Apple's OS X.
Users should update the Windows and OS X editions of Flash Player as soon as possible, said Adobe. People running Flash on Linux and Android need not be in a hurry: Adobe pegged their updates with a priority rating of "3," a label that means users can apply the patches at their discretion.
Because the only reported drive-by attacks, which are indiscriminate rather than targeted, have taken aim at OS X, Mac owners should be especially quick to do an update.
Shortly before Adobe published its advisory, Microsoft posted one of its own to warn users that an IE10 update for Windows 8 and Windows RT was also available. Microsoft has copied a page out of Google Chrome's playbook and baked Flash into its newest browser.
As of Thursday at 6:30 p.m. PT (9:30 ET), however, Google had not yet released a new version of Chrome that included the updated Flash.
Adobe credited a pair of Kaspersky Lab researchers with reporting CVE-2013-0633, and said CVE-2013-0634 had been submitted by the ShadowServer Foundation, aerospace company Lockheed Martin, and MITRE, a firm that manages several research centers funded by U.S. government agencies, including the National Security Engineering Center for the Department of Defense.
Lockheed Martin and MITRE are no strangers to Adobe. In December 2011, the two were credited with reporting an Adobe Reader vulnerability. Like those patched today, the Reader flaw was a zero-day bug that was already in use by attackers by the time it was revealed.
It's possible that the targeted attacks launched through malicious Word documents had been aimed at Lockheed Martin, MITRE or both. Such attacks have been commonplace in defense, aerospace and other industries whose secrets and intellectual property have value to criminals.
It also appears that Microsoft knew of the Flash exploits before Thursday. Searches of the two CVE identifiers found a pair of matching entries in Microsoft's malware database that represented signatures added to Microsoft's antivirus software on Feb. 2. : http://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Exploit%3ASWF%2FCVE-2013-0634!internal&ThreatID=-2147288261
Microsoft and Adobe share vulnerability and exploit information as part of the former's MAPP (Microsoft Active Protection Program), under which the two companies give several dozen other companies early information about upcoming patches so they have more time to create their signatures.
The patched versions of Flash Player for Windows, Mac and Linux can be downloaded from Adobe's website. Windows and Mac users can also wait for Flash's automatic updating tool to kick in: http://get.adobe.com/flashplayer/
(CIO)