Security News Recently Patched Flash Bug Can Leak Windows Credentials

[frogboy]

Earlier this week, Adobe patched a vulnerability in Flash Player that allows an attacker to use malicious Flash files to leak Windows credentials.

The security issue is tracked under the CVE-2017-3085 identifier and affects Flash Player versions from 23.0.0.162 up to 26.0.0.137, running on Windows XP, Vista, 7, 8.x, and 10.

Flaw derived from older vulnerability
The vulnerability was discovered by Dutch security researcher Björn Ruytenberg and is a variation of an older flaw tracked as CVE-2016-4271, which Adobe patched in September 2016.

Back then, Ruytenberg discovered that he could trick victims into loading a Flash file that called back to a remote SMB server that, in turn, would trick the user's computer into giving over its credentials.

Adobe patched this flaw with the release of Flash Player 23.0.0.162 by preventing Flash from making any outbound connections to URLs with UNC (Universal Naming Convention, eg: \\10.0.0.1\some\file.txt) or file-style paths (file://///10.0.0.1/some/file.txt).

The new bug Ruytenberg discovered relies on a clever trick to bypass Adobe's new protection measures. The researcher explains in a technical blog post that an attacker could comply with the Adobe ban on UNC and file-path URLs by loading a Flash file that made a request to a remote server via HTTP or HTTPS.

Recently Patched Flash Bug Can Leak Windows Credentials

 

[Winter Soldier]

Using Flash is a greater loss... compared to the gain.

 

[Cats-4_Owners-2]

Using Flash is a greater loss... compared to the gain.

Agreed.

From technical blog post above:
"A word about affected environments

Interestingly, and in contrast to the previous flaw, Edge as well as Chrome (with Flash enabled) are unaffected. While otherwise showing similar behavior, including a cross-domain policy file request, both browsers appear to prevent Flash from connecting to SMB hosts.


That said, Firefox as well as Internet Explorer are vulnerable. This also applies to all current versions of Microsoft Office. In addition, the flaw affects both remote and local-with-networking sandboxes."

Update: ..and at the very bottom of the page under "Conclusion",
"Flash Player 26.0.0.151 fixes this issue, and can be downloaded through Windows Update and Adobe’s website."

 

[frogboy]

Agreed.

From technical blog post above:
"A word about affected environments

Interestingly, and in contrast to the previous flaw, Edge as well as Chrome (with Flash enabled) are unaffected. While otherwise showing similar behavior, including a cross-domain policy file request, both browsers appear to prevent Flash from connecting to SMB hosts.


That said, Firefox as well as Internet Explorer are vulnerable. This also applies to all current versions of Microsoft Office. In addition, the flaw affects both remote and local-with-networking sandboxes."

Very good to know, thanks for that @Cats-4_Owners-2 Cheers.

 

[Winter Soldier]

Agreed.

From technical blog post above:
"A word about affected environments

Interestingly, and in contrast to the previous flaw, Edge as well as Chrome (with Flash enabled) are unaffected. While otherwise showing similar behavior, including a cross-domain policy file request, both browsers appear to prevent Flash from connecting to SMB hosts.


That said, Firefox as well as Internet Explorer are vulnerable. This also applies to all current versions of Microsoft Office. In addition, the flaw affects both remote and local-with-networking sandboxes."

Update: ..and at the very bottom of the page under "Conclusion",
"Flash Player 26.0.0.151 fixes this issue, and can be downloaded through Windows Update and Adobe’s website."

Thanks so much Cats for pointing out that
Flash is a total defeat, sadly.