Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: InfoSec Handlers Diary Blog - Internet Storm Center Diary 2016-04-06 InfoSec Handlers Diary Blog


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

YAFP (Yet Another Flash Patch)

Published: 2016-04-06
Last Updated: 2016-04-06 17:56:55 UTC
by Bojan Zdrnja (Version: 1)
10 comment(s)

Adobe issued a security advisory yesterday about a critical vulnerability (CVE-2016-1019) in Adobe Flash Player 21.0.0.197 and earlier. The vulnerability affects all OSes (Windows, Mac, Linux and Chrome OS).

As Adobe says, it “could cause a crash and potentially allow an attacker to take control of the affected system”. Well, strike that “potentially” since it is being actively exploited in the wild.
The good news is that the current version of Flash Player (21.0.0.182) at the moment prevents exploitation of the vulnerability (at least with exploits that are currently circulating).

In any case, Adobe should release the patch tomorrow (7.4.) so patch as soon as you can to be sure that the vulnerability has been completely mitigated (and of course, use an addon such as NoScript).

Adobe offers a handy web page to check which version you have currently installed at http://www.adobe.com/software/flash/about/, while the original advisory is available at https://helpx.adobe.com/security/products/flash-player/apsa16-01.html

--
Bojan
@bojanz
INFIGO IS

Keywords: 0day flash
10 comment(s)
April OUCH! Newsletter: I'm Hacked, Now What? - https://securingthehuman.sans.org/ouch
ISC Stormcast For Wednesday, April 6th 2016 http://isc.sans.edu/podcastdetail.html?id=4941
Diary Archives