A new Zero-Day Vulnerability arises from Hacking Team hack

Security Researchers at Trend Micro have discovered a second Zero-Day Vulnerability that arises from Hacking Team cyber attack.

Just Three days ago, Adobe released a new version of Flash to patch the zero-day vulnerability that was disclosed as part of the Hacking Team hack. Security experts at Trend Micro confirmed that the Adobe Flash vulnerability is being used in the wild. But, the Hacking Team archive is the wishing well for hackers, researchers at Trend Micro overnight have found another zero-day vulnerability affecting Adobe Flash that is a result of the Hacking Team attack.

Adobe gives credits to Dhanesh Kizhakkinan of FireEye for reporting CVE-2015-5122 and Peter Pi of TrendMicro for reporting CVE-2015-5123 and for working with Adobe to help protect our customers.

The malware researchers discovered that the new vulnerability is a Use-After-Free vulnerability involving the methods TextBlock.createTextLine() and TextBlock.recreateTextLine(textLine).

“Hot on the heels of the last zero-day vulnerability that was found from the Hacking Team data leak (i.e. CVE-2015-5119) comes yet another that may be as dangerous: CVE-2015-5122, a vulnerability in Adobe Flash Player. If exploited, it could result in a crash that would allow an attacker to take control of the vulnerable system. And yes, just like CVE-2015-5119, it affects all recent versions of Flash on Windows, Mac and Linux (i.e. 18.0.0.203).” states Trend Micro.

Trend Micro has already reported the unpatched flaw to Adobe that is hardly working to fix it asap. Fortunately at this time, the experts have not seen this new vulnerability exploited in the wild neither have detected any exploit kits including it. The experts have seen proof-of-concept (PoC) code that means the situation could escalate quickly in the next few days.

Adobe published out the security advisory for this vulnerability at 11:40 AM (GMT+8), waiting for a new update experts suggest to disable Flash.

Pierluigi Paganini

(Security Affairs – Hacking Team, zero-day)