Adobe Systems recently released security updates for Adobe Flash Player for Mac, Windows and Linux. "These updates address an object confusion vulnerability (CVE-2012-0779) that could cause the application to crash and potentially allow an attacker to take control of the affected system," the company stated in a security bulletin published on Friday.
"It’s recommended that users of Adobe Flash Player 22.214.171.124 and earlier versions for Windows, Mac and Linux update to Adobe Flash Player 126.96.36.199," writes Forbes' Adrian Kingsley-Hughes. "You can do this by visiting Adobe’s Flash Player update portal."
"The company said the vulnerability ... has been exploited in targeted attacks designed to trick the user into clicking on a malicious file delivered in an email message, and that the exploit used in the attacks seen so far target Flash Player on Internet Explorer for Windows only," writes Krebs on Security's Brian Krebs.
"For the exploit to successfully work, the malicious attachments need to be opened on a computer with a vulnerable version of Adobe Flash Player," Symantec reports. "The malicious documents contain an embedded reference to a malicious Flash file hosted on a remote server. When the Flash file is acquired and opened, it sprays the heap with shellcode and triggers the CVE-2012-0779 exploit. Once the shellcode gains control, it looks for the payload in the original document, decrypts it, drops it to disk, and executes it. Symantec detects this payload as Trojan.Pasam."
"Vulnerabilities in Adobe's products in general and Flash Player in particular are often exploited by cyber attackers, so the company introduced silent automatic updating for Flash Player on Windows in March, and is working on releasing a stable Flash Player for Mac with the feature soon," writes Help Net Security's Zeljka Zorz.