1. Home
  2. Web App Vulnerabilities
  3. How to remediate – MS KB2966072: Update for Vulnerabilities in Adobe Flash Player…
Searching...

How to remediate – MS KB2966072: Update for Vulnerabilities in Adobe Flash Player…

Contents

1. Introduction

MS KB2966072 addresses vulnerabilities in Adobe Flash Player, an ActiveX control installed on many Windows systems. These flaws could allow attackers to run malicious code on affected machines via cross-site scripting and security bypass attacks. Successful exploitation may lead to data theft or system compromise. This affects systems running vulnerable versions of Adobe Flash Player with the relevant Microsoft update missing. Impact is likely to be high on confidentiality, integrity, and availability if exploited.

2. Technical Explanation

The vulnerability stems from multiple unspecified errors within the Adobe Flash Player ActiveX control. Without KB2966072 installed, these errors can be triggered by a specially crafted web page or document containing malicious code. An attacker could exploit this to execute arbitrary code on the victim’s machine. The CVE entries detail specific flaws related to cross-site scripting (CVE-2014-0531, CVE-2014-0532, CVE-2014-0533), security bypasses (CVE-2014-0534, CVE-2014-0535) and memory corruption (CVE-2014-0536).

  • Root cause: Multiple unspecified errors exist within the Adobe Flash Player ActiveX control.
  • Exploit mechanism: An attacker crafts a malicious web page or document containing code that exploits these errors, typically delivered via a browser.
  • Scope: Windows systems running vulnerable versions of Adobe Flash Player without KB2966072 installed.

3. Detection and Assessment

Confirming the presence of this vulnerability involves checking for the missing KB update. A quick check can be done via system information, while a thorough assessment requires reviewing installed updates or using a vulnerability scanner.

  • Quick checks: Use the System Information tool (msinfo32) and search for “KB2966072” in the Hotfix list. If it’s not present, the system is vulnerable.
  • Scanning: Nessus plugin ID 84851 or Rapid7 InsightVM vulnerability ID CVE-2014-0531 can detect missing KB2966072. These are examples only and may require updates to be effective.
  • Logs and evidence: Windows Update logs may show failed attempts to install KB2966072, but this is not a reliable indicator of vulnerability.
msinfo32

4. Solution / Remediation Steps

The solution is to install Microsoft KB2966072 on affected systems. This update patches the vulnerabilities in Adobe Flash Player.

4.1 Preparation

  • No services need to be stopped, but close all open applications during installation.
  • A standard change window may be required depending on your organisation’s policies. Approval from the IT security team is recommended.

4.2 Implementation

  1. Step 1: Download KB2966072 from the Microsoft Update Catalog or via Windows Server Update Services (WSUS).
  2. Step 2: Run the downloaded installer file (.msu) to install the update.
  3. Step 3: Restart the system if prompted by the installer.

4.3 Config or Code Example

There is no configuration change required, this is a patch installation.

Before

KB2966072 not installed

After

KB2966072 installed (check msinfo32)

4.4 Security Practices Relevant to This Vulnerability

Several security practices can help mitigate the risk of vulnerabilities like this one. Keeping software up-to-date is essential, as is limiting user privileges and employing a robust patch management process.

  • Practice 1: Patch cadence – Regularly apply security updates to all software, including Adobe Flash Player and Windows components.
  • Practice 2: Least privilege – Limit the permissions of users and applications to reduce the impact if exploited.

4.5 Automation (Optional)

PowerShell can be used to automate patch deployment via WSUS or SCCM. Be cautious when automating updates, as unexpected issues may occur.

# Example PowerShell script (requires appropriate permissions and WSUS configuration)
# Get-WUInstall -KBNumber 2966072 -AcceptAll

5. Verification / Validation

Verify the fix by confirming KB2966072 is installed and re-running the initial detection methods. A simple smoke test should confirm normal system functionality.

  • Post-fix check: Run msinfo32 again and verify that “KB2966072” appears in the Hotfix list.
  • Re-test: Re-run the initial quick check (msinfo32 search) to confirm KB2966072 is now present.
  • Smoke test: Verify web browsing functionality and access to common websites.
  • Monitoring: Monitor Windows Update logs for successful installation of KB2966072 across the estate.
msinfo32 (verify KB2966072 is listed)

6. Preventive Measures and Monitoring

Update security baselines to include this patch, add checks in deployment pipelines, and maintain a regular asset and patch review cycle. For example, ensure your CIS benchmarks reflect the need for this update.

  • Baselines: Update your Windows baseline or Group Policy settings to enforce KB2966072 installation.
  • Asset and patch process: Review installed software regularly and apply security updates within a defined timeframe (e.g., 30 days).

7. Risks, Side Effects, and Roll Back

Installing KB2966072 is generally safe, but compatibility issues with older applications are possible. A system restore point or backup can be used to roll back the changes if necessary.

  • Risk or side effect 1: Potential compatibility issues with legacy applications that rely on specific Flash Player versions.
  • Risk or side effect 2: Rare installation failures due to corrupted update files.
  • Roll back: Restore the system from a pre-update backup or use System Restore to revert to the previous state.

8. References and Resources

Refer to official Microsoft advisories for detailed information about KB2966072 and related vulnerabilities.

Was this article helpful?

Yes No

Related Articles