Symantec: Sorry, Flash Player attack not a zero day

Submit

After suspecting a zero day exploit was being used to attack the latest version of Flash Player (9.0.124.0), Symantec says the call was a mistake — it was an exploit for versions 9.0.115.0 and prior.

Yesterday it was feared that hackers were using a malicious ShockWave Flash file which Symantec researchers thought was a zero day exploit for the latest version of Flash Player.

Symantec, however, shied away from confirming that it was a zero day exploit, as it appears to be designed for a flaw which Adobe patched in April, prior to it being publicly disclosed by an IBM security researcher.

"Originally this issue was believed to be unpatched and unknown, but further technical analysis has revealed that it is the previously reported Adobe Flash Player Multimedia File Remote Buffer Overflow Vulnerability (BID 28695), discovered by Mark Dowd of IBM," Symantec reported on its ThreatCon page today.

Adobe has also confirmed the exploit is not new. "This exploit does NOT appear to include a new, unpatched vulnerability as has been reported elsewhere — customers with Flash Player 9.0.124.0 should not be vulnerable to this exploit," it states on its Product Security Incident Response Team site.

The CEO of security consultancy Novologica, Nishad Herath, who yesterday acquired a sample of the exploit, told ZDNet.com.au today that the error appears to have been caused by a reference in the malicious SWF file to the new version of Flash Player.

"Actually [the code] does have references to the latest version of Flash, but it is not exploiting a new zero day — it is exploiting the old patched vulnerability," he said.

"It means Adobe patched the flaw properly, but Symantec has made a mistake... The exploit writer had made a reference to a SWF file with the name 9.0.124.0.swf, so it may just be that they were planning to add something to that exploit that may work on the new version in the future, should a zero day vulnerability be released... They might have been attempting to make this code base future-proof, but it's of no real relevance [to the exploit]," said Herath.

Adobe recommends updating Flash Player to the latest version since older versions are vulnerable to the exploit which Symantec discovered yesterday.

Talkback

Quick Poll

What is the biggest data management challenge in your organisation?

Inconsistent data and overlapping sources
Rising management and maintenance costs
Scaling the database to meet business needs
Handling analysis of streaming data
Complexity in data security auditing and reporting databases
Inability to keep up with growth in requirements

ZDNet Australia Live

RT @zdnetaustralia: Google is reportedly getting ready to take on Dropbox with its own cloud-based storage service http://t.co/qEoMRSk4

1 minute ago by soother23 on twitter, retweet

RT @zdnetaustralia: Kodak's shock announcement as it discontinues its camera business http://t.co/dxPWBObW

1 minute ago by jpmobility on twitter, retweet

This is nice but I still find so-called "interactive" installations gimmicky http://t.co/WuT1EOK3

1 minute ago by BadenPailthorpe on twitter, retweet

RT @zdnetaustralia: Vodafone sheds 30K more customers: http://t.co/bZtS82q9

6 minutes ago by jpmobility on twitter, retweet

FACEBOOK: Facebook admits it needs to fight scams more efficiently: By Emil Protalinski | February 9, 2012, 12:3... http://t.co/trTqRr1t

6 minutes ago by Adams123Adams on twitter, retweet

Ethical iPhone protests hit Apple stores: Daisey told ZDNet Australia that a first-hand trip to Foxconn saw him ... http://t.co/2FKFeSrZ

16 minutes ago by LocalMobile911 on twitter, retweet

Optus attacked over council cable costs - Sutherland Shire Council is locked in a stalemate with Optus over the $110... http://t.co/vSc1IhbC

16 minutes ago by pcrepairs_au on twitter, retweet

We'll build it, but will they come? http://t.co/0w28x1Ay

16 minutes ago by zdnetaustralia on twitter, retweet

Why a $25 computer means revolution http://t.co/QMSqOLaq

21 minutes ago by comptgraphicdes on twitter, retweet

We'll build it, but will they come?: I hate to rain on anybody's parade, but the New Zealand Government has unco... http://t.co/1vt5r0W1

21 minutes ago by oztechguy on twitter, retweet

by http://t.co/vmlQ0Ecb: We'll build it, but will they come?: I hate to rain on anybody's parade, but the New Zea... http://t.co/7dEGwqqF

26 minutes ago by InternetTechSec on twitter, retweet

Review: Chrome 17, faster than ever, more secure than ever. http://t.co/9HZCYssv

26 minutes ago by MobiMediaMarket on twitter, retweet

The end of an era as Kodak discontinues camera business http://t.co/dl7yyd7t

31 minutes ago by dmbieg on twitter, retweet

Optus attacked over council cable costs: Sutherland Shire Council is locked in a stalemate with Optus over the $... http://t.co/3kpAuwwD

36 minutes ago by oztechguy on twitter, retweet

Optus attacked over council cable costs: Sutherland Shire Council is locked in a stalemate with Optus over the $... http://t.co/Xv4IwDP9

36 minutes ago by NewsinIT on twitter, retweet

Do more lax Australian #privacy laws hurt international business? http://t.co/Uo2t14TP #law

41 minutes ago by RitchiePo on twitter, retweet

In only 3 months. Yowsers! (And I am one of them) RT @zdnetaustralia: Vodafone sheds 30K more customers: http://t.co/r1CArZg6 #vodafail

41 minutes ago by CaitlinSyrett on twitter, retweet

"BUT WE'RE SPENDING A BILLION DOLLARS TO BUILD A NEW NETWORK" RT @zdnetaustralia @Vodafone_au sheds 30K more customers: http://t.co/zbF32yQh

41 minutes ago by GeordieGuy on twitter, retweet

RT @zdnetaustralia: Vodafone sheds 30K more customers: http://t.co/hkaD9EeK

41 minutes ago by jwinoto on twitter, retweet

Sutherland Shire Council is locked in a stalemate with Optus over the $110,000 cost of a cable replacement http://t.co/zxYTZaJj

46 minutes ago by zdnetaustralia on twitter, retweet

Won't that improve the service? RT @zdnetaustralia: Vodafone sheds 30K more customers: http://t.co/cZtRLzPJ

51 minutes ago by ABCtech on twitter, retweet

RT @zdnetaustralia: Vodafone sheds 30K more customers: http://t.co/hkaD9EeK

51 minutes ago by ACCAN_AU on twitter, retweet

by http://t.co/vmlQ0Ecb: Optus attacked over council cable costs: Sutherland Shire Council is locked in a stalema... http://t.co/CIwHzp5S

56 minutes ago by InternetTechSec on twitter, retweet

Surely Vodafone knew this would happen... the customers certainly did! I jumped ship as soon as I could. http://t.co/ehCrfX2T

56 minutes ago by kristoforlawson on twitter, retweet

It's pretty funny that a local council would think a verbal agreement with Optus was sufficient. http://t.co/Nasa1I9t

56 minutes ago by joshgnosis on twitter, retweet

Vodafone sheds 30K more customers: http://t.co/hkaD9EeK

56 minutes ago by zdnetaustralia on twitter, retweet

RT @zdnetaustralia: Vodafone sheds 30K more customers: http://t.co/hkaD9EeK

56 minutes ago by davidkl_ on twitter, retweet

RT @CTAspley: Apple set to announce the iPad 3 in early March http://t.co/yTZVTkE3

1 hour ago by sal_star1 on twitter, retweet

Ethical iPhone protests hit Apple stores: http://t.co/MjtFB4r7

1 hour ago by zdnetaustralia on twitter, retweet

RT @zdnetaustralia: Ethical iPhone protests hit Apple stores: http://t.co/MjtFB4r7

1 hour ago by miguelcarreteb on twitter, retweet

zvelo is in the news - PC Mag http://t.co/Tg5LCQF1 PC World http://t.co/vj9siTzR ZDNet http://t.co/jkeQ8NOt c|net http://t.co/eAM1Z9nX

1 hour ago by acarrillojr on twitter, retweet

RT @zdnetaustralia: Kodak discontinues camera business http://t.co/jqKWDFO7 < my very first camera was a Kodak instamatic

1 hour ago by CollabTech on twitter, retweet

Apple set to announce the iPad 3 in early March http://t.co/yTZVTkE3

1 hour ago by CTAspley on twitter, retweet

Interpol defends voluntary filter: ZDNet Australia http://t.co/ovXm1UHb (Badly, really.)

1 hour ago by CollinVanUden on twitter, retweet

Aussie activists call for "ethical iPhone": Activists today gathered at the Apple Store in Sydney's CBD to deliv... http://t.co/KgfQQWdu

1 hour ago by NewsinIT on twitter, retweet

buy convert dvd to asf to your friends

1 hour ago by chatheli on 700MHz auction: The death knell for Aussie 4G?

Good article and some good comments guys. The lazy, monopolistic bullies that are bleating about this (TA, AFL, NRL, CA etc) need a reali...

1 hour ago by Progressive on More TV Now may mean less TV later

The Raseberry has a great role in automating heating and cooling systems, and in process control. Just get a few termisters along with an...

1 hour ago by lsatenstein on Why a $25 computer means revolution

invention these appreciate Every using after Numerous Not well ordering customer any custom route do make these current can consider of N...

3 hours ago by gurbapagnonna on Abetz shifted in reshuffle

I'd say a reasonable amount of it would be. In the Queensland Department of Education's case, it said it was trying to make as much of it...

4 hours ago by suzanne.tindal on The application nation

Great article, Suzanne—couldn’t agree more. It is only logical for organisations – private or public-- to take a long, hard look �...

4 hours ago by kashe on The application nation

Every example of action against child molesters in this story related to internet protocols other than the www. This filter then achieves...

5 hours ago by Bob.H on Interpol defends voluntary filter

Soooo... it's okay for Apple to demand use of technologies and designs falling under competitors patents (considered "standards"), but on...

13 hours ago by MoWeb on Apple wants new rules for mobile patents

But I am having an intelligent conversation young fibes, my point is the lofty goal that all are equal is unfortunately not so. That is w...

15 hours ago by Doubt on NBN Co inks $620m satellite deal

May be so, but we do need to lighten up some of these people who are so serious. poor old fibretech nearly brings tears to the eyes and j...

15 hours ago by Doubt on Turnbull decries 'Rolls-Royce' satellites

The latest MS Windows update for XP tries hard to persuade you to update. For those machines that already have IE8 loaded it tries to re-...

16 hours ago by brak on Windows XP clings on as dominant OS

Will be interesting to see if he drives the qld gov political IT agenda or looks to address the IT challenges being faced by qld gov agen...

16 hours ago by Flly on Queensland's CIO returns to the post

So angry! NOKIA has forgotten the main purpose and the user function, and instead prioritised their industry level concerns. I bought my...

16 hours ago by spaceagesoup on Nokia skips Australia in Symbian Belle roll-out

I get what you mean in your context, meski. If the filter is like speed cameras, then people can alternately take side streets and back r...

18 hours ago by techkid on Interpol defends voluntary filter

Remind me again how people can get to a leadership position with absolutely no practical knowledge? I would ask Alexander how he intends...

18 hours ago by cleversoap on Internet won't always be anonymous: ITU

I was reading about DMARC at http://www.unlocktheinbox.com/resources/dmarc.aspx, perhaps they should try to implement something like this...

20 hours ago by wpfn on Phishing scam causes Telstra email woe

As you can tell, I'm a big follower. For AFL read NRL.

20 hours ago by phildobbie on The TV Now aftermath

Im not sure if David Gallop realises he now works for the AFL.

20 hours ago by katerich on The TV Now aftermath

That assumes that people see the stop sign. If you're using proxies, or whatever *all* the time, then these stop signs will never be obs...

21 hours ago by meski on Interpol defends voluntary filter

The advanced remote controlled machines reduce the human working rate from hazardous environment.

21 hours ago by Manasy on Robotic mining worth its high cost: Rio

This story has been voted 20 times in the last 24 hours!

2 days ago, Symantec confirms hacker extortion

This story has been voted 10 times in the last 24 hours!

2 days ago, Symantec confirms hacker extortion

Keep up with ZDNet Australia

Inside ZDNet Australia

ZDNet / Adobe / Story

Symantec: Sorry, Flash Player attack not a zero day

Topics

Top related stories

Related gallery

Related stories

Talkback

Resource Centre Useful content from our premier sponsors

Quick Poll

ZDNet Australia Live

Facebook Activity

Keep up with ZDNet Australia

ZDNet Events Calendar

Plan Comparison

Sponsored resources

Inside ZDNet Australia

Services