Requires Immediate Action: Recent Unpatched Flash Vulnerability Found Circulating In the Wild

Urgent Update on Adobe Flash Vulnerability | StopAd Blog

Historically, Flash player is known for being haunted by multiple bugs of different severity levels. In 2015, it had an average of 6.1 bug fixes per week. However, not all of them are critical to your computer safety. Today’s post is about a critical vulnerability discovered in Flash that requires your immediate action.

TL;DR Uninstall/Disable Your Flash Player.

New Flash player exploit, abusing a critical vulnerability has been spotted in the wild by South Korean research team (KR-CERT). It’s a zero-day threat, which means that no patches exist as of now. Hackers may use this vulnerability to take over the infected machines. Simon Choi, director of the Security Research Center at Harui Inc. provided additional details, adding a screenshot of an Excel file with a malicious object containing an exploit

Flash vulnerability | StopAd blog
Post about the Flash vulnerability on Simon Choi’s twitter

What’s the Attack Vector? “Poisoned” Flash objects or files embedded in MS Office docs sent via email attachments and web pages. If opened, they trigger the execution of malicious code.

Adobe published an advisory statement, clarifying that vulnerability affects several Adobe products starting with version 28.0.0.137 and earlier for Windows, MacOS, Linux and ChromeOS. According to Adobe, patches are due to roll out on February 5th. For the time being it is recommended to either remove or disable it.

Adobe products affected by Flash vulnerability
List of Adobe products, affected by vulnerability (CVE-2018-4878). Source: Adobe Security Advisory

How to Uninstall/Disable Flash Player on Windows?

 

Follow Adobe’s instructions for uninstalling Flash Player on Windows, using Adobe Uninstaller.

Be sure to close all browsers and programs running Flash.

Please note that these instructions ARE NOT applicable to Flash in Microsoft Edge & IE browsers on Windows 8 and later, or with Google Chrome on all supported operating systems.

How To Disable Flash in Edge & IE on Windows

Follow the instructions from Windowscentral.com that outline the main steps you need to take. They’re similar for all versions of the operating system.

How To Disable Flash in Chrome (Works for Windows, MacOS, ChromeOS and Linux)

  • Type in address bar chrome://settings/
  • Scroll down and click “Advanced”=>click “Content Settings”=>click “Flash”
  • Toggle radio button left to show “Block Sites from Running Flash”

How to Disable Flash in Firefox on Windows

Because the Firefox version 55 Flash plugin is set to “Click to play” mode, you have to allow it to work on a trusted site. In order to completely uninstall it, you may use the Adobe Uninstaller (link provided above).

If you’re still using an old version of Firefox, we strongly recommend updating it to the latest version. To update, click on the 3 lines in upper right corner of Firefox window=> go to the “Help” menu and click “About Firefox”. In the window that opens you’ll be able to initiate an update to Firefox 58.01 (the latest version).

How to Disable Flash in Opera on Windows

  • Click the Opera Logo in the upper left corner of the Window
  • Click  “Settings” => click “Websites”
  • Scroll down to Flash section
  • Click “Block sites from running Flash”

How to Uninstall/Disable Flash Player on MacOS

Adobe offers Flash Player uninstallers of their own, but you need to determine your MacOS version first, as the uninstallers are version-specific. Download the installer, but remember to close your browsers prior to launching it. Follow the instructions in the uninstaller to remove the product.

How to Disable Flash Player in Safari

Safari is keeping Flash off by default, though it will ask your permission to turn Flash on, if Flash objects are found on the page. In case with Safari, Adobe uninstaller will take care of it.

How to Disable Flash Player in Chrome on MacOS

You may use the same approach as on Windows.

 

If you need to keep Flash, you must make sure that it will always ask your permission to run in the browser on a site you trust.

Stay vigilant and be sure not to open suspicious emails or their MS Office attachments.

To add an extra layer of protection, set your MS Office documents to be viewed in Protected view when opened from an internet location or untrusted location. Protected view is enabled by default, but to make sure, do the following:

  • Open a Word document
  • Click “File”=>“Options”=>”Trust Center”=>“Trust Center Settings” button.
  • Locate the “Protected View” menu on the left and click it.
  • In the menu that opens on the right, make sure all checkboxes are selected.

If you need to keep Flash, you must make sure that it will always ask your permission to run in the browser on a site you trust.

Am I Going to Miss Flash?

Not really.

Over the years, Flash has earned a bad reputation for being a regular source of exploitable bugs that were often abused by adversaries. It’s no surprise then that its era is coming to an end, the bugs being among main reasons. As you may see, most large browsers, websites and companies are trying to limit the usage of Flash, as technologies like HTML5 become more widespread. In a joint motion by Adobe and large browser makers, Flash is expected to be retired and no longer in use by 2020. Microsoft, Mozilla, and Google have presented their roadmaps for gradual reduction in Flash support in their products  

Share