Several popular websites have shown malicious advertisements that abused a vulnerability in Adobe Flash Player for which no patch was available yet. Adobe released an emergency patch for the vulnerability yesterday.
Before the emergency patch was released, Firefox and Internet Explorer users with a vulnerable Flash Player were infected by advertisements on several websites. Users of Google Chrome aren't affected. Earlier it was already known that the very popular video site Dailymotion showed the malicious advertisements.
According to antivirus company Malwarebytes, the advertisements have also been shown on theblaze.com, nydailynews.com, tagged.com, webmail.earthlink.net, mail. twc.com and my.juno.com
The malicious advertisements ended up on the sites through a bidding process and they were shown for no more than $0.09. Although the advertising campaign was recently discovered, a security researchers from F-Secure recently stated the the specific vulnerability in Flash Player is likely already abused since the 20th of December last year.
The emergency patch is currently distributed by the automatic update feature of Flash Player. For Google Chrome and Internet Explorer 10 and 11 on Windows 8 en 8.1 which use an embedded Flash Player an update will be made available by Google and Microsoft. These updates are not available yet. In case of IE, users are therefore recommended to use another browser or to disable Flash Player.
