Topic: Adobe warns, Critical vulnerability in Flash Player

[Samker]

Adobe Systems on Monday warned of a critical vulnerability in the most recent version of its Flash Player that is being actively exploited in the wild.

The vulnerability affects Flash Player 10.1.82.76 for Windows, Macintosh, Linux, Solaris, and Android operating systems, Adobe said in an advisory. “There are reports that this vulnerability is being actively exploited in the wild against Adobe Flash Player on Windows,” the warning said, without elaborating: http://www.adobe.com/support/security/advisories/apsa10-03.html
The latest versions of Adobe's Reader and Acrobat applications are vulnerable to the same flaw, but there's no evidence they are being exploited.

The advisory credited Steven Adair of the Shadowserver Foundation for working with Adobe's security team on the vulnerability. Members of Shadowserver weren't immediately available to respond to questions.

The disclosure means there are at least two unpatched flaws in widely used Adobe applications that are presently under attack by criminals. As reported on Wednesday, a separate flaw in Reader 9.3.4 for Windows is also being exploited in emails that try to trick recipients into clicking on an attached PDF file. Once opened, the booby-trapped document exploits a stack overflow flaw in Reader, causing machines to run malware.

While the vulnerability is in all versions of the PDF viewing software, it is being exploited only on Windows-based installations, Adobe has said.

Adobe said it plans to issue a patch for the Flash vulnerability during the week of September 27. An update fixing the Reader vulnerability is scheduled for the week of October 4. In the meantime, users should use an alternative PDF viewer such as Foxit, or if they must use Reader, use it alongside Microsoft's EMET tool: http://scforum.info/index.php/topic,4502.0.html

Protecting against Flash-based exploits is going to be harder, since Flash is used by Gmail and other web-based email services, YouTube, and many other modern online technologies. The easiest way to guard against the attacks is to use the Firefox browser with the NoScript add on: http://noscript.net/
It automatically blocks all Flash content and allows users to specify a list of trusted websites that are excepted.

(ElReg)

[Samker]

Adobe patches critical Flash Player vuln under attack

Adobe Systems has patched a critical vulnerability in its ubiquitous Flash Player that has been under active attack for at least a week.

The company on Monday issued an update for Flash Player 10.1.82.76 and earlier versions for Windows, Macintosh, Linux, and Solaris, and Adobe Flash Player 10.1.92.10 for Android handsets: http://www.adobe.com/support/security/bulletins/apsb10-22.html
Adobe has disclosed few details about the threat other than to say it allows attackers to take complete control of computers running the application and that there are reports that it is being “actively exploited in the wild against Adobe Flash Player on Windows.”

The vulnerability also affects fully patched installations of Adobe Reader and earlier versions, for Windows, Macintosh, and Unix, and Adobe Acrobat 9.3.4 and earlier versions for Windows and Macintosh. Adobe has no reports the vulnerability in those programs is being exploited.

Monday's patch closes one of two known zero-day vulnerabilities being used to attack Adobe users. As previously reported, a highly sophisticated attack spreading by email attempts to install malware on Windows machines by tricking recipients into opening a booby-trapped PDF file. The underlying stack overflow vulnerability affects non-Windows versions of Reader as well.

Adobe has said a patch for that bug will be released the week of October 4.

As usual, Windows-based Flash users who surf the web with Firefox or another browser other than Internet Explorer will have to install the patch at least twice to be fully protected. Users are reminded to uncheck the box hawking free software such as McAfee Security Scan when updating.

(ElReg)

[bugmenot]

it was secured by updates