How to remediate – MS KB2929825: Update for Vulnerability in Adobe Flash Player i…

1. Introduction

The vulnerability MS KB2929825 addresses an issue in Adobe Flash Player’s ActiveX control. This affects systems running a vulnerable version of Flash Player, potentially allowing attackers to execute code on the affected machine. Successful exploitation could compromise confidentiality, integrity and availability.

2. Technical Explanation

The vulnerability is due to a missing security update for Adobe Flash Player. Without KB2929825 installed, the ActiveX control remains susceptible to remote code execution attacks. An attacker can exploit this by crafting a malicious document or webpage containing an exploitable Flash object. The CVE associated with this issue is CVE-2014-0497.

• Root cause: Missing security update KB2929825 for the Adobe Flash ActiveX control.
• Exploit mechanism: An attacker delivers a malicious document or webpage containing an exploitable Flash object to a vulnerable system, triggering code execution.
• Scope: Systems running affected versions of Adobe Flash Player with the ActiveX control enabled.

3. Detection and Assessment

Confirming vulnerability involves checking the installed version of KB2929825 and the Flash Player ActiveX control. A quick check can be done via Windows Update history.

• Quick checks: Check Windows Update History for successful installation of KB2929825.
• Scanning: Nessus plugin ID 65327 may detect this vulnerability. This is an example only.
• Logs and evidence: Review application event logs for errors related to Flash Player ActiveX control loading or execution.

reg query "HKLMSOFTWAREMicrosoftWindowsCurrentVersionComponent Based ServicingServicingStack" /v KB2929825

4. Solution / Remediation Steps

The solution is to install Microsoft KB2929825. Follow the steps below for a safe and effective remediation.

4.1 Preparation

• Dependencies: Ensure systems have access to Microsoft Update servers. Roll back plan: Uninstall KB2929825 via Windows Update history if issues occur.
• Change window needs: Standard change control procedures should be followed for patching. Approval from IT security may be required.

4.2 Implementation

1. Step 1: Download and install Microsoft KB2929825 via Windows Update.
2. Step 2: Restart the system if prompted to complete the installation.
3. Step 3: Verify successful installation of KB2929825 in Windows Update history.

4.3 Config or Code Example

Before

reg query "HKLMSOFTWAREMicrosoftWindowsCurrentVersionComponent Based ServicingServicingStack" /v KB2929825

After

reg query "HKLMSOFTWAREMicrosoftWindowsCurrentVersionComponent Based ServicingServicingStack" /v KB2929825 (should show the value present)

4.4 Security Practices Relevant to This Vulnerability

Practices that help mitigate this vulnerability include a regular patch cadence and least privilege principles.

• Practice 1: Implement a regular patch management process to ensure timely installation of security updates, reducing the window for exploitation.
• Practice 2: Apply least privilege principles by disabling or restricting the use of ActiveX controls where possible, limiting the attack surface.

4.5 Automation (Optional)

# PowerShell example to check for KB2929825 installation
Get-HotFix -ID KB2929825 | Select-Object HotfixName, InstalledOn

5. Verification / Validation

Confirm the fix by verifying that KB2929825 is installed and re-running detection methods. A simple service smoke test should also be performed.

• Post-fix check: Run `reg query “HKLMSOFTWAREMicrosoftWindowsCurrentVersionComponent Based ServicingServicingStack” /v KB2929825` and confirm the value is present.
• Re-test: Re-run the Windows Update history check to ensure KB2929825 remains installed.
• Monitoring: Monitor application event logs for Flash Player related errors, looking for any regressions introduced by the update.

reg query "HKLMSOFTWAREMicrosoftWindowsCurrentVersionComponent Based ServicingServicingStack" /v KB2929825 (should show a value)

6. Preventive Measures and Monitoring

Update security baselines to include this patch, and consider adding checks in your CI/CD pipelines.

• Baselines: Update your Windows security baseline or group policy settings to enforce the installation of KB2929825.
• Asset and patch process: Review and update your asset inventory and patch management processes to ensure timely patching of critical vulnerabilities like this one.

7. Risks, Side Effects, and Roll Back

Installing KB2929825 is generally safe, but potential risks include compatibility issues with older applications. A roll back plan involves uninstalling the update.

• Risk or side effect 1: Compatibility issues with legacy applications using Flash Player. Mitigation: Test in a non-production environment first.
• Risk or side effect 2: Temporary service disruption during restart. Mitigation: Schedule updates during off-peak hours.
• Roll back: Uninstall KB2929825 via Windows Update history and restart the system if necessary.

8. References and Resources

• Vendor advisory or bulletin: https://helpx.adobe.com/security/products/flash-player/apsb14-04.html
• NVD or CVE entry: CVE-2014-0497
• Product or platform documentation relevant to the fix: https://docs.microsoft.com/en-us/security-updates/SecurityAdvisories/2016/2755801