Although Adobe has made the decision to send Flash out to pasture, the application most of us love to hate isn’t letting its reputation for being the malware vector of choice fade away. A new zero day, dubbed BlackOasis, has popped up according to researchers from Kaspersky Labs.
According to Kaspersky Lab, BlackOasis (or CVE-2017-11292 as it’s known to its friends) has been in the wild for over a year. It was detected last May.
The flaw uses embedded ActiveX objects which carry the exploit. Those objects are typically delivered when embedded in Word documents.
Once executed, the exploit can be used to read and write information in memory. This allows the threat actor to execute their own code which is used to download the real payload which is then used for surveilling the bad guys’ target.
According to Kaspersky labs, the targets are mainly focussed in the Middle East.
Adobe has issued a patch for the vulnerability.
It’s going to be a long two years until Flash is officially retired.
Leave a Reply
You must be logged in to post a comment.