Adobe Flash Player 21.0.0.226 and previous versions allows remote malicious users to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
adobe flash_player |
More information about BlackOasis APT is available to customers of Kaspersky Intelligence Reporting Service. Contact: intelreports@kaspersky.com Kaspersky Lab has always worked closely with vendors to protect users. As soon as we find new vulnerabilities we immediately inform the vendor in a responsible manner and provide all the details required for a fix. On October 10, 2017, Kaspersky Lab’s advanced exploit prevention systems identified a new Adobe Flash zero day exploit used in the wild ag...
Since 2014, Kaspersky Lab’s Global Research and Analysis Team (GReAT) has been providing threat intelligence reports to a wide-range of customers worldwide, leading to the delivery of a full and dedicated private reporting service. Prior to the new service offering, GReAT published research online for the general public in an effort to help combat the ever-increasing threat from nation-state and other advanced actors. Since we began offering a threat intelligence service, all deep technical ...
Same group compromised a million users A DAY.
A two-year long, highly sophisticated malvertising campaign infected visitors to some of the most popular news sites in the UK, Australia, and Canada including Channel 9, Sky News, and MSN. Readers of those news sites, just a portion of all affected (since it also affected eBay's UK portal), were infected with modular trojans capable of harvesting account and email credentials, stealing keystrokes, capturing web cam footage, and opening backdoors. The news sites are not at direct fault as they d...
Pay peanuts, get monkeys.
Authors of the Sundown exploit kit have proven themselves masters of copy and paste, stealing exploits from rivals and borking encryption when they opt for originality. Exploit kits offer an arsenal of attacks to the unscrupulous and are popular because they offer many means to point malicious payloads at victim machines. Authors compete to build the most capable exploit kits by reverse-engineering patches to build in the latest exploits, by buying zero-day exploits on underground market or some...
Download the full report (PDF) All the statistics used in this report were obtained using Kaspersky Security Network (KSN), a distributed antivirus network that works with various anti-malware protection components. The data was collected from KSN users who agreed to provide it. Millions of Kaspersky Lab product users from 213 countries and territories worldwide participate in this global exchange of information about malicious activity. In Q2 2016, Kaspersky Lab detected 3,626,458 malicious ins...
Earlier this year, we deployed new technologies in Kaspersky Lab products to identify and block zero-day attacks. This technology already proved its effectiveness earlier this year, when it caught an Adobe Flash zero day exploit (CVE-2016-1010). Earlier this month, our technology caught another zero-day Adobe Flash Player exploit deployed in targeted attacks. We believe the attacks are launched by an APT Group we track under the codename “ScarCruft”. ScarCruft is a relatively new APT group; ...
Unpatched flaw exploited since March
An eastern European group has for more than three months been using an unpatched Flash zero day vulnerability to target 'high profile' victims, Kaspersky Labs researcher Costin Raiu says. The attacks are linked to a group dubbed ScarCruft which under the Operation Daybreak has used the vulnerability since March. A patch for the flaw (CVE-2016-4171) is expected to drop by 16 June. Raiu (@craiu) says the zero day has been restricted to valuable targets. Doing so allows criminals to maximise on the...
Earlier today, Adobe published the security advisory APSA16-03, which describes a critical vulnerability in Adobe Flash Player version 21.0.0.242 and earlier versions for Windows, Macintosh, Linux, and Chrome OS: A few of months ago, we deployed a new set of technologies into our products designed to identify and block zero day attacks. These technologies already proved its effectiveness earlier this year, when they caught an Adobe Flash zero day exploit, CVE-2016-1010. Earlier this month, we ca...
Latest exploit used to sling CryptXXX ransomware
Security researchers are warning of a new wave of malvertising that harnesses the latest Flash exploit. The attack features tainted ads from websites including dailymotion.com, vodlocker.com, answers.com and legacy.com. Fraudulent advertisers are posing as legitimate retail or legal businesses in order distribute "conditional" malvertising, which then redirects to the Angler exploit kit, although that only happens if certain conditions are met. Angler is using a very recently patched Flash Playe...
Adobe readies patch cannons. Yet again
Adobe will this week patch a critical vulnerability in Flash Player that is being actively exploited in the wild. Not information is available on the exploit (CVE-2016-4117) ahead of the patch that is set for release from tomorrow. "A critical vulnerability (CVE-2016-4117) exists in Adobe Flash Player 21.0.0.226 and earlier versions for Windows, Macintosh, Linux, and Chrome OS," Adobe says. "Adobe is aware of a report that an exploit for CVE-2016-4117 exists in the wild. "Successful exploitation...
Go ahead and bang your head on the desk. We'll wait.
Adobe has pushed out a patch for 25 vulnerabilities in Flash Player, including one that is already being targeted in the wild. The latest fix for the internet's screen door includes a remedy for CVE-2016-4117, the remote code execution flaw that is already being exploited by criminals serving up malware-laden advertisements. The May update should be considered a top priority for Flash Player on Windows, OS X, and Linux. Microsoft and Google are respectively pushing their own Flash Player updates...
Vulmon