Menu
Adobe patches zero-day Flash Player flaw used in targeted attacks

Adobe patches zero-day Flash Player flaw used in targeted attacks

The vulnerability has been exploited by a China-based cyberespionage group for several weeks, security firm FireEye says

Adobe Systems released an emergency security update for Flash Player Tuesday to fix a critical vulnerability that has been exploited by a China-based cyberespionage group.

Over the past several weeks, a hacker group identified as APT3 by security firm FireEye has used the vulnerability to attack organizations from the aerospace, defense, construction, engineering, technology, telecommunications and transportation industries.

The hacking group targeted the companies with generic phishing emails that contained a link to a compromised server, researchers from FireEye said in a blog post Tuesday. The server used JavaScript code to profile potential victims and then served the Flash exploit to the ones meeting attackers' criteria, the company said.

The attackers use the exploit to install a backdoor known as SHOTPUT or CookieCutter and then move through the organization's network, using other techniques and exploits to compromise additional systems.

In order to be protected against this vulnerability, which is tracked as CVE-2015-3113, Adobe advises users to update to the newly released Flash Player versions: 18.0.0.194 for Windows and Mac, 11.2.202.468 for Linux, and 13.0.0.296 for the extended support release.

The Flash Player plug-in that's installed by default with Google Chrome and Internet Explorer on Windows 8.x will be automatically updated. Flash Player users on Windows or Mac who have selected "allow Adobe to install updates" will also get the update automatically.

APT3 is a sophisticated group known for using other zero-day browser-based exploits in the past for Internet Explorer, Firefox and Flash Player, according to FireEye. The group also uses custom backdoors and often changes command-and-control infrastructure, making it hard for researchers to track its activity.

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags patchesintrusionsecurityAdobe SystemsFireEyeExploits / vulnerabilitiesmalware

Featured

Slideshows

Arrow exclusively introduces Tenable Network Security to A/NZ channel

Arrow exclusively introduces Tenable Network Security to A/NZ channel

Arrow Electronics introduced Tenable Network Security to local resellers in Sydney last week, officially launching the distributor's latest security partnership across Australia and New Zealand. Representing the first direct distribution agreement locally for Tenable specifically, the deal sees Arrow deliver security solutions directly to mid-market and enterprise channel partners on both sides of the Tasman.

Arrow exclusively introduces Tenable Network Security to A/NZ channel
Examining the changing job scene in the Kiwi channel

Examining the changing job scene in the Kiwi channel

Typically, the New Year brings new opportunities for personnel within the Kiwi channel. 2017 started no differently, with a host of appointments, departures and reshuffles across vendor, distributor and reseller businesses. As a result, the job scene across New Zealand has changed - here’s a run down of who is working where in the year ahead…

Examining the changing job scene in the Kiwi channel
​What are the top 10 tech trends for New Zealand in 2017?

​What are the top 10 tech trends for New Zealand in 2017?

Digital Transformation (DX) has been a critical topic for business over the last few years and IDC is now predicting a step change as DX reaches macroeconomic levels. By 2020 a DX economy will emerge and it will become the core of what New Zealand industries focus on. From the board level through to the C-Suite, Kiwi organisations must be prepared to think and act digital when the DX economy emerges in 2017.

​What are the top 10 tech trends for New Zealand in 2017?
Show Comments