BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Adobe Flash Player and Air (APSB12-24) Critical Memory Vulnerabilities – November 2012

Posted November 9, 2012    Jerome Diggs

Nine new audits are being released in our Retina vulnerability scan engine to help customers identify a security vulnerability that can enable an attacker to gain control of a vulnerable system (CVE-2012-5274, CVE-2012-5275, CVE-2012-5276, CVE-2012-5277, CVE-2012-5278, CVE-2012-5279, CVE-2012-5280) These nine new audits have been released with Retina Network Community and the commercial version of Retina Network. Learn more about these products here.

Users can include these new checks in a general vulnerability scan, or can create a targeted scan to specifically look for these specific vulnerabilities using the following Retina audits:

17585 – Adobe Flash Multiple Vulnerabilities (20121107) – IE

17586 – Adobe Flash Multiple Vulnerabilities (20121107) – IE 10

17587 – Adobe Flash Multiple Vulnerabilities (20121107) – Mozilla/Opera

17588 – Adobe Flash Multiple Vulnerabilities (20121107) – Linux Player

17589 – Adobe Flash Multiple Vulnerabilities (20121107) – Mac OS X Player

17591 – Adobe Flash Multiple Vulnerabilities (20121107) – Adobe AIR – Windows

17592 – Adobe Flash Multiple Vulnerabilities (20121107) – Adobe AIR – Mac OS X

17593 – Adobe Flash Multiple Vulnerabilities (20121107) – Android Flash

17594 – Adobe Flash Multiple Vulnerabilities (20121107) – Android AIR

If you have concerns of the security posture of your desktop, server or mobile environments feel free to download and try out our community version to discover, assess and gain remediation guidance in our simple to use standalone scanner. In addition to standard assessment of patches, insecure configurations and zero-days, the commercial version of Retina solutions also provides in-depth credentialed database, web application, virtual, cloud and mobile scanning.

We should also mention that our new version of the Retina Network Community scanner includes a complete user interface overhaul and allows users to select from a list of built-in profiles to align the product to your specific job function.

Scan Metrics

 

Both Retina CS and Retina CS Community allow users to create email alerts based on conditional Smart Rules.  In the example below we’ve created a rule looking for the assets that have the APSB12-24 vulnerability flagged and set an action to email the Operation team for any machines that match the criteria in the last day.

 

Tags:
, , , ,

Leave a Reply

6 Responses to “Adobe Flash Player and Air (APSB12-24) Critical Memory Vulnerabilities – November 2012”

  1. Greg

    We update them as soon as we are aware an update is available, and that’s part of the problem! They need a better notification program. One part of me wishes they’d get on a monthly schedule; the other part acknowledges that they have to release so many unexpected updates that a schedule is a crazy idea.

    I do like that they are offering automatic updates within their own products now, although getting our users updated to versions that will perform that going forward is a bother. As is getting those updates not to also install crapware as they do the update.

    (Why can’t they just even temporarily create some kind of plugin for WSUS that enables us to at least get everything updated one time to a version that will heal itself?)

    One very handy utility that seems to be a great alarm for an Adobe update is the Qualys Browser Check. Obviously it runs in the browser, but notices things beyond the browser (at least in Windows), and more than once has told me about an Adobe update that I hadn’t heard about.

    The more traditional method is to have Cassandra tell you. https://cassandra.cerias.purdue.edu/main/index.html

    November 14, 2012 1:46:50, Reply
  2. Hoa

    We patch Adobe products soonest and lately the scheduled updates have been monthly. We use the Retina scanning engine to identify the affect assets then scan again after initial round of deployment completes. To help manage the vulnerability we utilize automated deployment and furthermore limit the installation of Adobe products on assets that requires them.

    November 15, 2012 8:57:23, Reply
  3. Daniel

    We are limited the list of Adobe software deployed. Also to manage update, beside the Adobe manager, we are using BigFix product to manage the update and push them automatically.

    November 16, 2012 12:27:25, Reply
  4. mona

    I update everytime that a new package is available.. via the automatic update from Adobe manager..
    But hacking even the manager to try to push a compromised version is still possible..

    November 16, 2012 12:27:30, Reply
  5. R.G

    Adobe has been removed from the computer.. at least for PDF (I’m using alternative pdf reader). Flash is difficult to avoid so I’m using FileHippo to be alert for any update.. even beta version. Even it can offer new version 1 day before the public release… good and bad thing to prevent 0day vulnerability… it’s a risk to take…

    November 16, 2012 12:35:35, Reply
  6. Haralambos 'Harry'

    At the recent VEF the query was posed about how often we update Adobe apps and to give some ways we identify and manage these types of vulnerabilities. Such a simple question but it results in a convoluted answer.

    With a workforce that is geographically diverse and not always connected there are challenges or holes in the protection scheme we have at hand currently. There are multiple levels of updating these vulnerable apps.

    The most undesirable of these is unfortunately something that does occur after a system is compromised, re-imaging with the latest versions. Even with the best protection and proactive controls, the weakest link is the human factor and someone will fall prey to a crafted attack or social engineering exploit that typically use Adobe products.

    Otherwise a combination of Microsoft solutions including WSUS, SUP and SCCM and deploying packaged application updates to devices (which works so long as they are connected to the corporate network) is the method used now.

    The most desirable method would be to use Microsoft’s NAP or Cisco’s NAC and have the devices isolated if they are not current with the approved application levels. This of course means that you would potentially have a device “out in the wild” if you do not have Microsoft’s Direct Access and your device/data is vulnerable. If you are using Cisco VPN, if the device is detached it’s on its own again and unprotected.

    How to solve this?
    • Remove and replace Adobe and JAVA products with equivalents as much as possible
    • Secure and lock down systems and isolate them if they are compromised
    • Use scanning solutions like Retina to identify, target update or work to isolate vulnerable devices

    November 16, 2012 1:34:20, Reply

Additional articles

Integrating Least Privilege and Password Management to Solve Account Security Challenges

Integrating Least Privilege and Password Management to Solve Account Security Challenges

Posted July 24, 2014    Morey Haber

There is a reason all BeyondTrust Privileged Account Management (PAM) solutions share the PowerBroker name: They all inherently enable you to reduce user-based risk and can be integrated under a centralized IT risk management platform. Here’s one common use case that demonstrates how this integration changes the playing field. Consider the challenge of privileged access:…

Tags:
, , , , ,
PowerBroker Password Safe Password Age Report

Reshaping Privileged Password Management with Password Safe 5.2

Posted July 21, 2014    Martin Cannard

Today, we’re pleased to unveil the latest edition of our privileged password management solution, PowerBroker Password Safe. I’ll start with a brief intro of what’s new and then tell you a little about the driving factors behind Password Safe development. New features for mitigating password risk and ensuring accountability enterprise-wide Here’s the 10,000-foot overview of…

Tags:
, , ,
PowerBroker for Windows tamper protection

PowerBroker for Windows 6.6 Tamper Protection

Posted July 18, 2014    Morey Haber

I have a bone to pick: Stopping an administrator from performing an action on a system is futile endeavor. As an administrator, there is always a way to circumvent a solution’s from tampered protection. Really! By default, Windows administrators have unrestricted access to the system – and even though an application, hardened configuration, or group policy…

Tags:
, ,