Share this article on:
A useful and valuable software platform or a collection of security holes held together with code? Opinion is divided on the usefulness of Adobe Flash, when hackers can apparently exploit vulnerabilities with ease.
Some are calling for Adobe Flash to be consigned to the annals of history following after five security flaws have recently been discovered: Flaws that are already being used by hackers to gain access to computers and data.
Three zero-day vulnerabilities have already been discovered this year, including one just a few days ago. Now a further two zero-day vulnerabilities have been identified. The latest two are arguably the most serious; one of which allows hackers to use the Adobe Flash security flaw to take full control of a computer.
Patches not Yet Developed to Address Latest Adobe Flash Security Vulnerabilities
The flaws were uncovered as a result of the recent data breach at Hacking Team, and have been identified as CVE-2015-5122 and CVE-2015-5123. They affect Adobe Flash operating on Windows, OS X and Linus systems. The new bugs are similar to the security vulnerability identified last week (named CVE-2015-5122.), and exploit the Use-After-Free vulnerability in DisplayObject.
The bugs were uncovered in leaked documents from spyware developer, Hacking Team, with the company’s software allegedly exploiting these security vulnerabilities. Hacking Team then supplies the software to “ethical governments” such as those in Saudi Arabia, Russia and Sudan.
Now the bugs have been leaked, multiple hacking groups and individuals are using the vulnerabilities to stage worldwide attacks.
How are the Adobe Flash Vulnerabilities Exploited?
FireEye recently reported how the vulnerability is used to gain access to computers:
The vulnerability is triggered by freeing a TextLine object within the valueOf function of a custom class when setting the TextLine’s opaqueBackground. Once the TextLine object is freed, a Vector object is allocated in its place. Returning from valueOf will overwrite the length field of Vector object with a value of 106. (Initial length is 98)
Exploitation continues by finding the corrupted Vector object by its length, which will be greater than 100. This enables the object to change an adjacent Vector object’s length to 0x40000000. Once exploit achieves this, it follows the same mechanism that was used in CVE-2015-5119 PoC.
Is it Time to Say a Fond Farewell to Flash?
While the software, by the very nature of the platform, is vulnerable to attack, Adobe is usually quick to develop patches and one is planned to be released later this week to address the new security issues. As a minimum security measure, the software should be set so it does not run automatically and it should not be run until the patch has been installed.
If you value your data, it may be time to start looking for an alternative to Adobe Flash. However, love it or hate it, the software is not going to be retired just yet, in spite of calls for the program to be put out of its misery.
Further information on the security vulnerabilities can be found here.