Adobe to Patch Flash Zero-Day Discovered in South Korean Attacks
A previously unknown and critical flaw in Adobe Flash found being exploited in targeted attacks against victims in South Korea will be patched the week of February 5.
Adobe today confirmed a report yesterday by South Korea's Computer Emergency Response Team (KrCERT/CC) of the discovery of the zero-day vulnerability in Flash Player ActiveX 28.0.0.137 and earlier versions. The bug (CVE-2018-4878) abused in the attacks is a use-after-free vulnerability that allows remote code execution, according to Adobe's advisory.
Johannes Ullrich, head of the SANS Internet Storm Center, says the fact that this was a targeted, zero-day attack makes it more likely to be the handiwork of a nation-state actor. "The attack was rather limited, and targeted at individuals in South Korea who are involved in research about North Korea. I think this makes for a pretty strong case that this was a nation-state sponsored attack. Other actors would have little motivation to use a zero-day exploit in an attack against a group like this," Ullrich says. "On the other hand, it doesn't have to be North Korea," given the difficulty of attribution.
