How to remediate – MS KB2758994: Update for Vulnerabilities in Adobe Flash Player…

1. Introduction

MS KB2758994 addresses vulnerabilities in Adobe Flash Player, specifically within its ActiveX control. This is a critical issue as it allows attackers to execute code on affected systems. Systems running Internet Explorer with the vulnerable Adobe Flash Player plugin installed are at risk. Successful exploitation could lead to loss of confidentiality, integrity, and availability of data.

2. Technical Explanation

The vulnerability stems from missing security update KB2758994 for multiple memory corruption and buffer overflow errors within the Adobe Flash ActiveX control. An attacker can exploit these flaws by crafting a malicious web page containing specially designed content that triggers the vulnerabilities when visited in Internet Explorer. The preconditions include having an unpatched version of Adobe Flash Player installed, running within an affected version of Internet Explorer, and visiting a website hosting the malicious content.

• Root cause: Multiple memory corruption errors and buffer overflow errors exist within the Adobe Flash ActiveX control.
• Exploit mechanism: An attacker creates a webpage with specially crafted Flash content that triggers the vulnerabilities when loaded in Internet Explorer.
• Scope: Affected systems are those running vulnerable versions of Adobe Flash Player installed as an ActiveX control, typically accessed through Internet Explorer.

3. Detection and Assessment

You can confirm vulnerability by checking the installed version of KB2758994 and identifying if it is missing. A thorough assessment involves scanning for vulnerable versions of Adobe Flash Player.

• Quick checks: Run wmic qfe list | find "KB2758994" in a command prompt to check for the installed patch.
• Scanning: Nessus plugin ID 83160 and Rapid7 InsightVM vulnerability ID CVE-2012-5248 can identify vulnerable systems (examples only).
• Logs and evidence: Check Windows Event Logs for events related to Adobe Flash Player crashes or errors, though specific event IDs are not consistently reported.

wmic qfe list | find "KB2758994"

4. Solution / Remediation Steps

The solution is to install Microsoft KB2758994. Follow the steps below for a safe and effective remediation.

4.1 Preparation

• Ensure you have network connectivity to Microsoft Update servers. Roll back is possible by uninstalling the KB2758994 patch through Windows Update history.
• A standard change window should be used, with approval from IT management.

4.2 Implementation

1. Step 1: Open Windows Update (Control Panel > System and Security > Windows Update).
2. Step 2: Click “Check for updates”.
3. Step 3: Install any available important updates, including KB2758994.
4. Step 4: Restart the system if prompted to complete the installation.

4.3 Config or Code Example

Before

(No KB2758994 listed in installed updates)

After

KB2758994 is listed as a successfully installed update.

4.4 Security Practices Relevant to This Vulnerability

Several security practices can help mitigate this vulnerability type. Least privilege reduces the impact of successful exploitation, while keeping software up-to-date prevents known flaws from being exploited. Patch cadence is important for timely application of security fixes.

• Practice 1: Implement least privilege to limit user and service account permissions.
• Practice 2: Maintain a regular patch cadence for all software, including Adobe Flash Player and Internet Explorer.

4.5 Automation (Optional)

# PowerShell example to check for KB2758994 installation
Get-HotFix -Id KB2758994 | Select-Object HotFixID, InstalledOn

5. Verification / Validation

Confirm the fix by checking that KB2758994 is installed and re-running the initial detection method. Perform a basic service smoke test to ensure functionality remains intact.

• Post-fix check: Run wmic qfe list | find "KB2758994" in a command prompt; output should show KB2758994 as installed.
• Re-test: Re-run the initial detection method (wmic qfe list | find "KB2758994") to confirm it is no longer missing.
• Smoke test: Verify that Internet Explorer can still load trusted websites without issues.
• Monitoring: Monitor Windows Event Logs for Adobe Flash Player errors, but note this may not directly indicate a regression of the vulnerability fix.

wmic qfe list | find "KB2758994"

6. Preventive Measures and Monitoring

Update security baselines to include KB2758994 as a required patch. Implement automated patching pipelines to ensure timely updates. Establish a regular asset inventory process to identify vulnerable systems quickly.

• Baselines: Update your Windows baseline configuration to require installation of KB2758994.
• Pipelines: Integrate patch management into your CI/CD pipeline for automated deployment.
• Asset and patch process: Review system configurations regularly to ensure compliance with security policies.

7. Risks, Side Effects, and Roll Back

Installing KB2758994 may cause compatibility issues with some older websites or applications that rely on specific Flash Player features. The roll back procedure involves uninstalling the patch through Windows Update history.

• Risk or side effect 1: Potential compatibility issues with legacy web applications using Adobe Flash Player.
• Risk or side effect 2: Restart required which may disrupt services.
• Roll back: 1. Open Windows Update History. 2. Uninstall KB2758994. 3. Restart the system.

8. References and Resources

• Vendor advisory or bulletin: http://www.adobe.com/support/security/bulletins/apsb12-22.html
• NVD or CVE entry: N/A
• Product or platform documentation relevant to the fix: https://docs.microsoft.com/en-us/security-updates/SecurityAdvisories/2016/2755801