Adobe Releases Another Emergency Update for Flash

Adobe today released a second security update for its Adobe Flash Player software on both Mac and Windows, addressing a threat that could allow an attacker to take control of an affected system, executing malicious code. The vulnerability (CVE–2014–0502) allowed attackers to compromise at least three nonprofit organizations according to security firm FireEye (via ArsTechnica).

This threat actor clearly seeks out and compromises websites of organizations related to international security policy, defense topics, and other non-profit sociocultural issues. The actor either maintains persistence on these sites for extended periods of time or is able to re-compromise them periodically.

This actor also has early access to a number of zero-day exploits, including Flash and Java, and deploys a variety of malware families on compromised systems. Based on these and other observations, we conclude that this actor has the tradecraft abilities and resources to remain a credible threat in at least the mid-term.

Today's update follows a critical security update that was released just over two weeks ago, fixing the same zero-day vulnerability giving hackers complete control over compromised systems.

The vulnerability affects all Macs with Adobe Flash Player versions before 12.0.0.70 and Adobe recommends all users update their products to the latest of Flash. Adobe maintains a site where users can check the version of Flash installed and the up-to-date Flash software can be downloaded from Adobe's website.