0x06 vulnerability2011. 4. 13. 13:13


Word/Flash logo



4월 11일 Adobe 신규 0-day가 발표되었습니다.

doc 파일에 포함된 swf에 의해 악성코드에 감염이 될 수 있으며 이메일로 전파되고 있다고 합니다.

분석글들이 나오고 있는데요..

샘플은 확보를 했는데 아직 분석은...ㅜ.ㅜ



1. Vulnerability Description from Adobe
Security Advisory for Adobe Flash Player, Adobe Reader and Acrobat


2. Analysis document
Apr. 8 CVE-2011-0611 Flash Player Zero day - SWF in DOC - Disentangling Industrial Policy..

CVE-2011-0611 Adobe Flash Zero Day embeded in DOC

Analysis of the CVE-2011-0611 Adobe Flash Player vulnerability exploitation

Using "volatility" to study the CVE-2011-0611 Adobe Flash 0-day





Posted by demantos
0x06 vulnerability2011. 3. 22. 09:57





New Adobe Zero-Day [CVE-2011-0609]
2011/03/15 - [0x06 vul info] - New Adobe Zero-Day [CVE-2011-0609]



Security update available for Adobe Flash Player

http://www.adobe.com/support/security/bulletins/apsb11-05.html


SOLUTION

Adobe recommends all users of Adobe Flash Player 10.2.152.33 and earlier versions upgrade to the newest version 10.2.153.1 by downloading it from the Adobe Flash Player Download Center. Windows users can install the update via the auto-update mechanism within the product when prompted.

Users of Flash Player for Android version 10.1.106.16 and earlier can update to Flash Player version 10.2.156.12 by browsing to the Android Marketplace on an Android phone.

Google Chrome users can update to Chrome version 10.0.648.134 or later.

Adobe AIR 
Adobe recommends all users of Adobe AIR 2.5.1 and earlier versions update to the newest version 2.6 by downloading it from the Adobe AIR Download Center.




Security updates available for Adobe Reader and Acrobat

http://www.adobe.com/support/security/bulletins/apsb11-06.html


SOLUTION

Adobe recommends users update their software installations by following the instructions below:

Adobe Reader
Users on Windows and Macintosh can utilize the product's update mechanism. The default configuration is set to run automatic update checks on a regular schedule. Update checks can be manually activated by choosing Help > Check for Updates.

Adobe Reader 9.x users on Windows can also find the appropriate update here:
http://www.adobe.com/support/downloads/product.jsp?product=10&platform=Windows.

Adobe Reader users on Macintosh can also find the appropriate update here:
http://www.adobe.com/support/downloads/product.jsp?product=10&platform=Macintosh.

Because Adobe Reader X Protected Mode would prevent an exploit of this kind from executing, we are planning to address this issue in Adobe Reader X for Windows with the next quarterly security update for Adobe Reader, currently scheduled for June 14, 2011

Adobe Acrobat 
Users can utilize the product's update mechanism. The default configuration is set to run automatic update checks on a regular schedule. Update checks can be manually activated by choosing Help > Check for Updates.

Acrobat Standard and Pro users on Windows can also find the appropriate update here: 
http://www.adobe.com/support/downloads/product.jsp?product=1&platform=Windows.

Acrobat Pro Extended users on Windows can also find the appropriate update here:http://www.adobe.com/support/downloads/product.jsp?product=158&platform=Windows.

Acrobat Pro users on Macintosh can also find the appropriate update here: 
http://www.adobe.com/support/downloads/product.jsp?product=1&platform=Macintosh.

Posted by demantos
0x06 vulnerability2011. 3. 15. 05:30





http://www.adobe.com/support/security/advisories/apsa11-01.html


SUMMARY

A critical vulnerability exists in Adobe Flash Player 10.2.152.33 and earlier versions (Adobe Flash Player 10.2.154.13 and earlier for Chrome users) for Windows, Macintosh, Linux and Solaris operating systems, Adobe Flash Player 10.1.106.16 and earlier versions for Android, and the Authplay.dll component that ships with Adobe Reader and Acrobat X (10.0.1) and earlier 10.x and 9.x versions of Reader and Acrobat for Windows and Macintosh operating systems.

This vulnerability (CVE-2011-0609) could cause a crash and potentially allow an attacker to take control of the affected system. There are reports that this vulnerability is being exploited in the wild in targeted attacks via a Flash (.swf) file embedded in a Microsoft Excel (.xls) file delivered as an email attachment. At this time, Adobe is not aware of attacks targeting Adobe Reader and Acrobat. Adobe Reader X Protected Mode mitigations would prevent an exploit of this kind from executing.

We are in the process of finalizing a fix for the issue and expect to make available an update for Flash Player 10.x and earlier versions for Windows, Macintosh, Linux, Solaris and Android, and an update for Adobe Acrobat X (10.0.1) and earlier 10.x and 9.x versions for Windows and Macintosh, Adobe Reader X (10.0.1) for Macintosh, and Adobe Reader 9.4.2 and earlier 9.x versions during the week of March 21, 2011. Because Adobe Reader X Protected Mode would prevent an exploit of this kind from executing, we are currently planning to address this issue in Adobe Reader X for Windows with the next quarterly security update for Adobe Reader, currently scheduled for June 14, 2011.

AFFECTED SOFTWARE VERSIONS

  • Adobe Flash Player 10.2.152.33 and earlier versions for Windows, Macintosh, Linux and Solaris operating systems
  • Adobe Flash Player 10.2.154.13 and earlier for Chrome users
  • Adobe Flash Player 10.1.106.16 and earlier for Android
  • The Authplay.dll component that ships with Adobe Reader and Acrobat X (10.0.1) and earlier 10.x and 9.x versions for Windows and Macintosh operating systems.

NOTE: Adobe Reader 9.x for UNIX, Adobe Reader for Android, and Adobe Reader and Acrobat 8.x are not affected by this issue.

SEVERITY RATING

Adobe categorizes this as a critical issue.

DETAILS

A critical vulnerability exists in Adobe Flash Player 10.2.152.33 and earlier versions for Windows, Macintosh, Linux and Solaris operating systems (Adobe Flash Player 10.2.154.13 and earlier for Chrome users), Adobe Flash Player 10.1.106.16 and earlier versions for Android, and the authplay.dll component that ships with Adobe Reader and Acrobat X (10.0.1) and earlier 10.x and 9.x versions for Windows and Macintosh operating systems.

This vulnerability (CVE-2011-0609) could cause a crash and potentially allow an attacker to take control of the affected system. There are reports that this vulnerability is being exploited in the wild in targeted attacks via a Flash (.swf) file embedded in a Microsoft Excel (.xls) file delivered as an email attachment. Adobe is not currently aware of attacks targeting Adobe Reader and Acrobat. Adobe Reader X Protected Mode mitigations would prevent an exploit of this kind from executing.

We are in the process of finalizing a fix for the issue and expect to make available an update for Flash Player 10.x and earlier versions for Windows, Macintosh, Linux, Solaris and Android, and an update for Adobe Acrobat X (10.0.1) and earlier 10.x and 9.x versions for Windows and Macintosh, Adobe Reader X (10.0.1) for Macintosh, and Adobe Reader 9.4.2 and earlier 9.x versions during the week of March 21, 2011. Adobe Reader X Protected Mode mitigations would prevent an exploit of this kind from executing. Because Adobe Reader X Protected Mode would prevent an exploit of this kind from executing, we are currently planning to address this issue in Adobe Reader X for Windows with the next quarterly security update for Adobe Reader, currently scheduled for June 14, 2011.

Adobe Reader 9.x for UNIX, Adobe Reader for Android, and Adobe Reader and Acrobat 8.x are not affected by this issue.

Users may monitor the latest information on the Adobe Product Security Incident Response Team blog at http://blogs.adobe.com/psirt or by subscribing to the RSS feed at http://blogs.adobe.com/psirt/atom.xml.

Adobe actively shares information about this and other vulnerabilities with partners in the security community to enable them to quickly develop detection and quarantine methods to protect users until a patch is available. As always, Adobe recommends that users follow security best practices by keeping their anti-malware software and definitions up to date.




http://www.securelist.com/en/blog/6102/New_Adobe_Zero_Day_Under_Attack





다음주쯤에 패치를 발표한다고 하는군요..

http://blogs.adobe.com/asset/2011/03/background-on-apsa11-01-patch-schedule.html





Posted by demantos
0x04 reference&tools2010. 11. 22. 08:42



[출처 : Symantec]

Adobe는 Adobe Reader X를 발표했습니다. 널리 사용되는 PDF reader 소프트웨어의 새로운 이 버전은 권한 분리를 위한 샌드박스를 포함하고 있습니다. 

해당 샌드박스는 클라이언트 측 취약성에 대한 공격에 대해 추가적인 보안을 제공하기 위해 Microsoft Windows 무결성 수준(Integrity level)을 이용합니다.

공격자가 Adobe Reader X에 존재하는 취약성을 성공적으로 공격하더라도, 피해 컴퓨터에 대한 자유로운 액세스를 획득하기 위해서는 해당 샌드박스를 깨고 나와야 합니다.

이런 추가적인 단계의 보안 기능은 일반적인 공격으로부터 네트워크 사용자들을 보호할 수 있을 것입니다.

무결성 수준은 Windows Vista에서 처음 사용되었기 때문에, Adobe Reader X의 샌드박스는 이에 대한 지원이 이루어지는 Windows에서만 작동할 것입니다.

워크스테이션상의 Windows Vista 또는 Windows 7을 사용하는 고객들은, 관리자가 Adobe Reader X를 설치할 수 있도록 계획을 세움으로써, 이 새로운 보안 기능을 사용할 수 있도록 할 것을 권고합니다.

해당 샌드박스 기술에 대한 자세한 정보는 다음에서 확인할 수 있습니다.


Inside Adobe Reader Protected Mode - Part 1
http://blogs.adobe.com/asset/2010/10/inside-adobe-reader-protected-mode-part-1-design.html

Inside Adobe Reader Protected Mode - Part 2
http://blogs.adobe.com/asset/2010/10/inside-adobe-reader-protected-mode-%E2%80%93-part-2-%E2%80%93-the-sandbox-process.html
 
Inside Adobe Reader Protected Mode - Part 3
http://blogs.adobe.com/asset/2010/11/inside-adobe-reader-protected-mode-part-3-broker-process-policies-and-inter-process-communication.html

Adobe Reader X can be downloaded here:Adobe Reader X
http://get.adobe.com/reader/



Posted by demantos