Adobe Flash Player Use-After-Free Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2021-11-03
• Known to be used in ransomware campaigns
• EPSS: 90% chance of exploitation in the next 30 days (higher than 100% of CVEs)

[ Description ]Official description

A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media player handling of listener objects. A successful attack can lead to arbitrary code execution. This was exploited in the wild in January and February 2018.

CISA: Adobe Flash Player contains a use-after-free vulnerability that could allow for code execution.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 3 May 2022): The impacted product is end-of-life and should be disconnected if still in use.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• blog.talosintelligence.com/2018/02/group-123-goes-wild.htmlTechnical DescriptionThird Party Advisory
• www.securityfocus.com/bid/102893Broken Link
• www.securitytracker.com/id/1040318Broken Link
• access.redhat.com/errata/RHSA-2018:0285Third Party Advisory
• blog.morphisec.com/flash-exploit-cve-2018-4878-spotted-in-the-wild-massive-malspam-camp…Third Party Advisory
• github.com/InQuest/malware-samples/tree/master/CVE-2018-4878-Adobe-Flash-DRM-UAF-0dayThird Party Advisory
• github.com/vysec/CVE-2018-4878Third Party Advisory
• helpx.adobe.com/security/products/flash-player/apsb18-03.htmlVendor Advisory
• securingtomorrow.mcafee.com/mcafee-labs/hackers-bypassed-adobe-flash-protection-mechanismExploitThird Party Advisory
• threatpost.com/adobe-flash-player-zero-day-spotted-in-the-wild/129742Third Party Advisory
• www.darkreading.com/threat-intelligence/adobe-flash-vulnerability-reappears-in-maliciou…Press/Media CoverageThird Party Advisory
• www.exploit-db.com/exploits/44412ExploitThird Party AdvisoryVDB Entry
• www.fireeye.com/blog/threat-research/2018/02/attacks-leveraging-adobe-zero-day.htmlThird Party Advisory
• www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/north-korean-hac…Technical DescriptionThird Party Advisory
• github.com/cisagov/vulnrichment/issues/196Issue Tracking
• www.cisa.gov/known-exploited-vulnerabilities-catalogThird Party AdvisoryUS Government Resource