Symantec retracts claim that attack exploit is “zero day”
Severity: Medium
2 June, 2008
Update:
On Wednesday 28 May, we published an alert about attackers exploiting a zero day vulnerability in Adobe Flash Player. By enticing one of your users to a malicious Web site, an attacker can exploit this vulnerability to execute code on your user’s computer, with your user’s privileges. In the worst case scenario, the attacker could gain total control of the victim’s PC.
In our May alert, we reported that this Flash Player vulnerability may not be as new as Symantec originally thought. According to Symantec’s research, the flaw appeared similar to one Adobe has already patched. Nonetheless, Symantec claimed they had observed this new exploit affecting fully patched versions of Adobe Flash Player. So they labeled the threat a zero day vulnerability.
Symantec retracts claim that attack exploit is “zero day”
Severity: Medium
2 June, 2008
Update:
On Wednesday 28 May, we published an alert about attackers exploiting a zero day vulnerability in Adobe Flash Player. By enticing one of your users to a malicious Web site, an attacker can exploit this vulnerability to execute code on your user’s computer, with your user’s privileges. In the worst case scenario, the attacker could gain total control of the victim’s PC.
In our May alert, we reported that this Flash Player vulnerability may not be as new as Symantec originally thought. According to Symantec’s research, the flaw appeared similar to one Adobe has already patched. Nonetheless, Symantec claimed they had observed this new exploit affecting fully patched versions of Adobe Flash Player. So they labeled the threat a zero day vulnerability.
One day after our alert, Symantec updated their Threatcon information, recanting their original claim, and saying the exploit they found in the wild was not a zero day vulnerability. Adobe, the creator of Flash Player, has also confirmed that the exploit found in the wild leverages a vulnerability that was patched in Flash Player 9.0.124.0.
However, despite both Adobe and Symantec’s position on this particular exploit, some researchers still worry that a zero day Flash exploit may exist in the wild. McAfee claims to have observed a Flash exploit with the filename, “WIN 9,0,124,0i.swf,” which could suggest it targets the patched version of Flash. A day after reporting that, however, McAfee could no longer find that particularly named exploit in the wild.
So what does this mean to you? As it stands today, researchers have not found unarguable proof of a zero day Flash exploit in the wild. However, they have observed attackers exploiting a Flash Player vulnerability in the wild even though Adobe has released a patch for it. Our alert from 28 May says that Adobe’s patch from April was not sufficient to protect you from attacks. Now all information we have says that if you deployed the Flash Player patch we described in our 9 April alert, these current attacks shouldn’t affect you. Nonetheless, if you don’t need Flash content in your network, you might still consider using your Firebox to block SWF files until this attack recedes. You can find directions on how to block SWF files in our original alert from April, which you can find in the Latest Broadcasts page of our website.