Following the Hacking Team data breach, the security researchers discovered the third Adobe Flash Player zero-day vulnerability.
A third Adobe Flash Player zero-day has been discovered since the HackingTeam breach. Thanks to the breach of the Hacking Team‘s private files, the third Adobe Flash zero-day has been made publicly accessible.
“After two Adobe Flash player zero-days disclosed in a row from the leaked data of Hacking Team, we discovered another Adobe Flash Player zero-day (assigned with CVE number, CVE-2015-5123) that surfaced from the said leak. Adobe has already released a security advisory after we reported the said zero-day. This vulnerability is rated as critical and can allow an attacker to take control of the affected system once successfully exploited. It affects all versions of Adobe Flash in Windows, Mac, and Linux.” reported a blog post from Trend Micro.
This newly uncovered zero-day has a similar PoC as the one released immediately prior (CVE-2015-5122), but has not yet been added to the arsenals of any active exploit kits.This new zero-day affects Adobe Flash Player up to version 188.8.131.52.
Differently from previously reported Flash zero-day exploits, it involves the BitmapData object and not the TextLine and ByteArray.
The vulnerability can be triggered by the following steps:
From a new BitmapData object, prepare two Array objects, new two MyClass objects, and assign theMyClass object to each Array objects.
Once the valueOf function of MyClass is override, it calls the BitmapData.paletteMap with the two Arrayobjects as parameters. The BitmapData.paletteMap will trigger the valueOf function.
In the valueOf function, it will call BitmapData.dispose() to dispose the underlying memory of BitmapDataobject, thus causing Flash Player to crash.
The experts at Trend Micro are monitoring the proof-of-concept (POC) for any active attacks that may employ this vulnerability.
Adobe has since updated their previously released security bulletin and expects to patch this vulnerability, along with CVE-2015-5122, at some point during this coming week.
Michael Fratello is a Security Engineer employed by CipherTechs, Inc., a privately held information security services provider located in downtown Manhattan, New York. Specializing in Penetration Testing and Digital Forensics, Michael, a St. John’s University graduate majoring in Computer Security Systems, has developed a passion for information security and often spends his free time studying, programming, and researching the exponentially growing number of threats found in-the-wild today.
Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer.
Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US.
Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines.
Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.