+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Keyloggers (https://hackforums.net/forumdisplay.php?fid=113)
+---- Thread: [0-Day] Update for Adobe software (12-13-2016) (/showthread.php?tid=5493012)
Update for Adobe software (12-13-2016) - ra1d - Dec 13, 2016
The security updates from Adobe include the following products: RoboHelp, Adobe Digital Editions, InDesign, Adobe Experience Manager, Adobe DNG Converter, ColdFusion Builder, Adobe Experience Manager Forms, Adobe Animate and Adobe Flash Player.
There is a 0-day exploit in Adobe Flash Player, and besides that there's a bunch of other vulnerabilities. Here are the unique CVE IDs:
Code
CVE-2016-7867, CVE-2016-7868, CVE-2016-7869, CVE-2016-7870, CVE-2016-7871, CVE-2016-7872, CVE-2016-7873, CVE-2016-7874, CVE-2016-7875, CVE-2016-7876, CVE-2016-7877, CVE-2016-7878, CVE-2016-7879, CVE-2016-7880, CVE-2016-7881, CVE-2016-7890, CVE-2016-7892The update is for Windows, Linux, Mac and Chrome OS, so please do update!
Source: https://helpx.adobe.com/security.html
* - Seifer - Dec 13, 2016
Adobe products auto-update these days don't know? I am almost 100% sure flash player does xD
* - ra1d - Dec 13, 2016
(Dec 13, 2016 03:26 PM)Felix™ Wrote: Adobe products auto-update these days don't know? I am almost 100% sure flash player does xDThat is an option that users can toggle.
If they've toggled it off they just get a pop up.
* - Account of the Gods - Dec 13, 2016
how do i hack others with it if they dont patch?
pls tell free
* - Soulmate～っ☆ - Dec 13, 2016
(Dec 13, 2016 03:29 PM)aidenhera Wrote: how do i hack others with it if they dont patch?
pls tell free
😠 whitehat only.
* - ra1d - Dec 13, 2016
(Dec 13, 2016 03:29 PM)aidenhera Wrote: how do i hack others with it if they dont patch?If you're asking this question, I am afraid you wouldn't benefit from knowing it.
pls tell free
* - Mr. Robot - Dec 13, 2016
Wow thanks for the update mate, really really good timing too.
(Dec 13, 2016 03:29 PM)aidenhera Wrote: how do i hack others with it if they dont patch?
pls tell free
Here's an example from one CVE - don't worry I am sure they will add it into SEToolkit within the week and you can press 4 buttons to execute an attack on your public IP
Quote: How could an attacker exploit these vulnerabilities?
In a web-based attack scenario where the user is using Internet Explorer for the desktop, an attacker could host a specially crafted website that is designed to exploit any of these vulnerabilities through Internet Explorer and then convince a user to view the website. An attacker could also embed an ActiveX control marked "safe for initialization" in an application or Microsoft Office document that hosts the IE rendering engine. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit any of these vulnerabilities. In all cases, however, an attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically by clicking a link in an email message or in an Instant Messenger message that takes users to the attacker's website, or by opening an attachment sent through email.
In a web-based attack scenario where the user is using Internet Explorer in the Windows 8-style UI, an attacker would first need to compromise a website already listed in the Compatibility View (CV) list. An attacker could then host a website that contains specially crafted Flash content designed to exploit any of these vulnerabilities through Internet Explorer and then convince a user to view the website. An attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically by clicking a link in an email message or in an Instant Messenger message that takes users to the attacker's website, or by opening an attachment sent through email. For more information about Internet Explorer and the CV List, please see the MSDN Article, Developer Guidance for websites with content for Adobe Flash Player in Windows 8.
Really really great news for pentesting businesses and is going to be fucking amazing over the next couple weeks.
* - Bαker - Dec 13, 2016
Thanks for this raid! Always helping the kids of hf