The French security expert Kafeine has discovered an unpatched vulnerability (0day) in Flash Player is being exploited by Angler Exploit Kit.
The Angler exploit kit is one of the most popular crimeware kit and according to the French security researcher Kafeine it was enriched with a fresh Adobe Flash zero-day vulnerability. Kafeine has discovered a new variant of the Angler exploit kit that exploit three different vulnerabilities in Flash Player, including the zero-day flaw for the latest version of Flash (version 16.0.0.257) in several versions of Internet Explorer running on Windows 7 and Windows 8.
This new version of the Angler exploit kit includes also the code to exploit two known bugs, the researcher that he first discovered the exploit for the zero-day in Flash on Wednesday and that it is being used in the wild to install a the Bedep malware.
Kafeine has verified that IE 10 on Windows 8, IE 8 on Windows 7 and IE 6-9 on Windows XP all are being exploited, meanwhile Chrome safe such as a fully patched Windows 8.1. Kafeine hasn’t disclosed the MD5 of the new exploit, he is suggesting to disable Flash Player since the flaw will be fixed.
“Disabling Flash player for some days might be a good idea,” he said.
Adobe declared that it is aware of the new Angler exploit kit and is already investigating it.
(Security Affairs – Angler exploit kit, malware)
