Patched Adobe zero-day exploit used successfully (again)
Last week Adobe issued an emergency patch for a zero-day exploit discovered by FireEye just eight days ago. &nbsp;But today reports are coming through that within just four days of the patch being made, the original zero-day exploit was being used by other groups in larger attacks. &nbsp;The point here is that companies need to be far quicker at installing emergency patches. Adobe issued the Adobe Player patch on Tuesday; by Saturday the exploit (discovered on Tuesday) was out on the deepweb being offered to hackers, who by that time had installed it into a commercially available exploit-kit and had used it effectively. &nbsp;This suggests &nbsp;that the makers of exploit-kits are able to be alerted to "new" zero-days and have them on the market for further exploitation within 72-hours or less. &nbsp;How many companies install patches across their user bases that quickly?
Adobe Systems Inc. today released an emergency update to fix a dangerous security hole in its widely-installed Flash Player browser plugin. The company warned that the vulnerability is already being exploited in targeted attacks, and urged users to update the program as quickly as possible.

In an advisory issued Tuesday morning, Adobe said the latest version of Flash — v. 18.0.0.194 on Windows and Mac OS X — fixes a critical flaw (CVE-2015-3113) that is being actively exploited in “limited, targeted attacks.” The company said systems running Internet Explorer for Windows 7 and below, as well as Firefox on Windows XP, are known targets of these exploits.

If you’re unsure whether your browser has Flash installed or what version it may be running, browse to this link. Adobe Flash Player installed with Google Chrome, as well as Internet Explorer on Windows 8.x, should automatically update to the latest version. To force the installation of an available update on Chrome, click the triple bar icon to the right of the address bar, select “About Google” Chrome, click the apply update button and restart the browser.

The most recent versions of Flash should be available from the Flash home page, but beware potentially unwanted add-ons, like McAfee Security Scan. To avoid this, uncheck the pre-checked box before downloading, or grab your OS-specific Flash download from here. Windows users who browse the Web with anything other than Internet Explorer may need to apply this patch twice, once with IE and again using the alternative browser (Firefox, Opera, e.g.)

In lieu of patching Flash Player yet again, it might be worth considering whether you really need to keep Flash Player installed at all. In a happy coincidence, earlier today I published a piece about my experience going a month without having Flash Player installed. The result? I hardly missed it at all.