Traps Prevents Adobe Flash Player Zero-Day
Summary: On January 31 the Korean CERT published an advisory on a new Adobe Flash Player zero-day, CVE-2018-4878, observed exploited in the wild, and Adobe released a patch and security bulletin on February 6. The vulnerability is a use-after-free bug in Adobe tvsdk, and the exploit's goal is allegedly to download and execute DogCall (aka ROKRAT), an information-stealing backdoor often delivered via malicious Hangul Word Processor files.
Key Takeaway: The attack chain starts with an ordinary XLS spreadsheet that pulls an encrypted Flash file and fetches its decryption key from a remote server, so the exploit only assembles itself at runtime - a pattern that leaves signature-based detection with little to match on.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2018-4878
- Related
- CVE-2018-4878: Adobe Flash Player Use-After-Free Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021Attackers Exploiting Unpatched Flaw in Flash Cyber Risks ·Threat Brief: Maze Ransomware Cyber Risks ·