Summary:
$1· This vulnerability affects: Adobe Flash Player 12.0.0.43 and earlier, running on all platforms
$1· How an attacker exploits it: Typically, by enticing users to visit a website containing malicious Flash content
$1· Impact: An attacker can execute code on the user's computer, potentially gaining control of it
$1· What to do: Download and install the latest version of Adobe Flash Player (version 12.0.0.44 for most computers)
Exposure:
Adobe Flash Player displays interactive, animated web content called Flash. Although Flash is optional, 99% of PC users download and install it to view multimedia web content. It runs on many operating systems, including mobile ones like Android. It also comes prepackaged with some web browsers like Chome and the latest version of Internet Explorer (IE).
In an out-of-cycle security bulletin released today, Adobe posted an update that fixes a critical, zero day vulnerability in Adobe Flash Player 12.0.0.43 and earlier, running on all platforms. We urge Flash users to install this update as soon as possible, since advanced attackers are exploiting it in the wild.
Adobe's bulletin describes an integer overflow vulnerability (CVE-2014-0497) in Flash player, which attackers have been exploiting in the wild. In typical fashion, Adobe's bulletin doesn't describe the flaw in much technical detail, but they do describe its impact. If an attacker can entice one of your users to visit a malicious website, or into handling specially crafted Flash content (which could be embedded in a document), he could exploit this flaw to execute code on that user's computer, with that user's privileges. If your users have administrator privileges, the attacker could gain full control of their computers.
This particular flaw was brought to Adobe's attention by one of Kaspersky's (one of WatchGuard's antivirus partners) researchers. Yesterday, members of Kaspersky's research team announced that they plan on disclosing details about a new advanced persistent threat (APT) campaign later next week, which they call "The Mask." According to some reports, this Flash zero day exploit might be associated with that cyber espionage campaign.
In any case, Adobe has assigned this a "Priority 1" severity rating for Windows and Macintosh computers, which means you should fix it within 72 hours. If you use Flash, I recommend you apply the update as soon as possible.
Solution Path
Adobe has released new versions of Flash Player (12.0.0.44 for Windows and Mac) to fix these issues. If you allow Adobe Flash in your network, you should download and install the new versions immediately. If you've enabled Flash Player's recent "silent update" option, you will receive this update automatically.
$1· Download Flash Player for your computer:
