Severity: High
28 May, 2008
Summary:
- These vulnerabilities affect: Adobe Flash Player 9.0.124.0 and earlier on Windows (potentially affects OS X, Unix, and Linux as well)
- How an attacker exploits them: By enticing one of your users into playing a maliciously crafted Flash (.SWF) file
- Impact: An attacker could execute code on the victim’s computer, and take control of it
- What to do: Adobe hasn’t released a patch yet; see the solution section below for workarounds
Exposure:
Adobe Flash Player displays interactive, animated web content called Flash, often formatted as a Shockwave (.SWF) file. Adobe’s Flash Player ships by default with many web browsers, including Internet Explorer (IE). It also runs on many operating systems.
Severity: High
28 May, 2008
Summary:
- These vulnerabilities affect: Adobe Flash Player 9.0.124.0 and earlier on Windows (potentially affects OS X, Unix, and Linux as well)
- How an attacker exploits them: By enticing one of your users into playing a maliciously crafted Flash (.SWF) file
- Impact: An attacker could execute code on the victim’s computer, and take control of it
- What to do: Adobe hasn’t released a patch yet; see the solution section below for workarounds
Exposure:
Adobe Flash Player displays interactive, animated web content called Flash, often formatted as a Shockwave (.SWF) file. Adobe’s Flash Player ships by default with many web browsers, including Internet Explorer (IE). It also runs on many operating systems.
Late yesterday, Symantec, SANS Internet Storm Center Handler’s Diary [ 1 / 2 / 3 ], and SecurityFocus all warned of a serious zero day Flash Player vulnerability which they have found attackers exploiting in the wild. As of this writing, researchers do not know the technical details about this new vulnerability; they do know, however, that if one of your users downloads and plays a specially crafted Shockwave Flash (.SWF) file, an attacker could exploit the unpatched flaw to execute code on that user’s computer, with that user’s privileges. Since most Windows administrators grant their users local administrative privileges, an attacker could potentially exploit these flaws to gain complete control of a victim’s computer. The malicious .SWF file could be hosted on a web site, sent via an HTML e-mail, or delivered in other ways via applications that embed Flash.
According to the last update from SecurityFocus, attackers are exploiting this zero day vulnerability in great numbers. They warn that attackers have injected this malicious .SWF exploit into approximately 20,000 legitimate web sites, using web-based attack techniques like those we recently described in our recent Radio Free Security podcast.
On the other hand, this morning Symantec updated their Threatcon information claiming this Flash Player vulnerability may not be as new as they originally thought. Their latest technical analysis reveals that the flaw appears similar to one Adobe has already patched. Even with that, Symantec has still observed this new exploit affecting fully patched versions of Adobe Flash Player. So, either this is a true zero day variant of the original flaw, or Adobe’s patch is not working as reliably as it should. Regardless, if you allow Adobe Flash Player in your network, you should remain concerned about this new exploit and follow the workarounds suggested below.
Solution Path:
Because researchers first found this vulnerability being exploited in the wild, Adobe has not had time to release a patch for Flash Player. Until they do, the following workarounds will mitigate the risk of this new exploit affecting your users:
- Internet Explorer (IE) users can set the killbit for Adobe’s Flash Player. This prevents IE from playing any Flash content with the Adobe Flash Player. Bear in mind that this also prevents legitimate Flash content from playing. Refer to this Microsoft Knowledge Base article for more details on how to set a killbit. Flash Player’s CLSID is BD96C556-65A3-11D0-983A-00C04FC29E36.
- Firefox users should install the NoScript extension. NoScript prevents web sites from running JavaScript, Java, Flash, or other executable web content by default. While NoScript does prevent legitimate web sites from executing scripts as well, you can easily add those trusted sites to your white list to allow them to run the content you need.
- Use a gateway device, like WatchGuard’s Firebox products, to block .SWF files from entering your network. See below for more details.
For All WatchGuard Users:
Some of WatchGuard’s Firebox models allow you to prevent your users from accessing Shockwave Flash files (.SWF) via the web (HTTP) or emails (SMTP, POP3). If you like, you can temporarily mitigate the risk of this vulnerability by blocking .SWF files using your Firebox’s proxy services (video instructions below). Again, many web sites rely on Flash for interactive content, and blocking Flash prevents these sites from working properly. Note that many popular video streaming sites, such as YouTube and JibJab, deliver video using a Flash front end, so this technique may render many video web sites unusable. Nonetheless, with the severity of this zero day exploit, you may want to temporarily block all .SWF content until Adobe releases a patch.
If you choose to block Flash content, follow the links below for video instructions on using your Firebox proxy’s content blocking features to block .SWF files by their file extensions:
- Firebox X Edge running 10.x
- How do I block files with the FTP proxy? (Video, 2:30)
Windows Media, 17.4MB / QuickTime, 11.8MB - How do I block files with the HTTP proxy? (Video, 2:52)
Windows Media, 32MB / QuickTime, 28.6MB - How do I block files with the POP3 proxy? (Video, 2:35)
Windows Media, 17.6MB / QuickTime, 16.5MB - How do I block files with the SMTP proxy? (Video, 2:18)
Windows Media, 12.2MB / QuickTime, 9.1MB
- How do I block files with the FTP proxy? (Video, 2:30)
- Firebox X Core and X Peak running Fireware 10.x
- How do I block files with the FTP proxy? (Video, 2:30)
Windows Media, 25.2MB / QuickTime, 9.1MB - How do I block files with the HTTP proxy? (Video, 2:52)
Windows Media, 38.2MB / QuickTime, 10.7MB - How do I block files with the POP3 proxy? (Video, 2:35)
Windows Media, 23.2MB / QuickTime, 10.1MB - How do I block files with the SMTP proxy? (Video, 2:18)
Windows Media, 25.6MB / QuickTime, 9.0MB
- How do I block files with the FTP proxy? (Video, 2:30)
Status:
Adobe has not had time to release a patch yet. Apply the workarounds described above.
References:
- SANS Internet Storm Center Handler’s Diary Entries:
- Symantec’s SecurityFocus Advisory