We’ve recently become aware of a new exploit in the wild targeting a 0-day vulnerability in Adobe Flash Player. This exploit differs from the typical Flash Player attacks we’ve seen where a victim is lured into browsing to a website hosting malicious Flash content. Instead, these attacks involve a malicious Flash .swf file that is embedded into a Microsoft Excel document.
First, customers using Microsoft Office 2010 are not susceptible to the current attacks. The current attacks do not bypass the Data Execution Prevention security mitigation (DEP).
To be protected by EMET, there are a few steps you need to follow. You first need to download the tool, install it, and then finally configure it to protect an application. It’s a good idea to configure EMET to protect not just Excel,*
http://www.giveawayoftheday.com/forums/topic/8853 (info on EMET)
Successful exploitation allows execution of arbitrary code. Secunia Advisory SA43751
The vulnerability is confirmed in Flash Player version 10.2.152.33 for Windows and reported in versions 10.2.152.33 and prior for Windows, Macintosh, Linux, and Solaris, versions 10.2.154.18 and prior for Chrome, and versions 10.1.106.16 and prior for Android, and Adobe AIR for Windows, Macintosh, and Linux prior to version 2.6.
NOTE: The vulnerability is reportedly being actively exploited.
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-0609
http://www.computersecurityarticles.info/antivirus/f-secure/attack-using-cve-2011-0609/
Attackers have been taking advantage of the situation in Japan to trick their targets into opening malicious files. These cases have used infected Excel attachments with Flash exploits.
Here’s a screenshot of one such e-mail, provided by Contagio.
http://blogs.adobe.com/asset/2011/03/background-on-apsa11-01-patch-schedule.html
We just posted Security Advisory APSA11-01 announcing a critical vulnerability (CVE-2011-0609) in Adobe Flash Player, which also impacts the authplay.dll component shipping with Adobe Reader and Acrobat for Windows and Macintosh.
http://xforce.iss.net/xforce/xfdb/66078 (Platforms Affected:Have a look.)
http://blog.fireeye.com/research/2011/03/who-is-exploiting-the-flash-0-day-cve-2011-0609.html
A detailed investigation of the code and functionality inside the malware payload 'a.exe' (1e09970c9bf2ca08ee48f8b2e24f6c44) shows that this is zero day malware. As of Mar 15, 2011 none of the AV on VirusTotal were able to detect it.