Security Advisory for Adobe Flash Player, Adobe Reader and Acrobat [Update]

[leofelix]

Update:

We are in the process of finalizing a fix for the issue and expect to provide an update for Flash Player 10.x for Windows, Macintosh, Linux and Solaris by November 4, 2010.

Security Advisory for Adobe Flash Player, Adobe Reader and Acrobat

Release date: October 28, 2010

Platform: All Platforms

Summary

A critical vulnerability exists in Adobe Flash Player 10.1.85.3 and earlier versions for Windows, Macintosh, Linux and Solaris operating systems; Adobe Flash Player 10.1.95.2 and earlier versions for Android; and the authplay.dll component that ships with Adobe Reader 9.4 and earlier 9.x versions for Windows, Macintosh and UNIX operating systems, and Adobe Acrobat 9.4 and earlier 9.x versions for Windows and Macintosh operating systems.

This vulnerability (CVE-2010-3654) could cause a crash and potentially allow an attacker to take control of the affected system. There are reports that this vulnerability is being actively exploited in the wild against Adobe Reader and Acrobat 9.x. Adobe is not currently aware of attacks targeting Adobe Flash Player.


We are in the process of finalizing a fix for the issue and expect to provide an update for Flash Player 10.x for Windows, Macintosh, Linux, and Android by November 9, 2010. We expect to make available an update for Adobe Reader and Acrobat 9.4 and earlier 9.x versions during the week of November 15, 2010.


Affected software versions

* Adobe Flash Player 10.1.85.3 and earlier versions for Windows, Macintosh, Linux and Solaris operating systems
* Adobe Flash Player 10.1.95.2 and earlier for Android
* Adobe Reader 9.4 and earlier 9.x versions for Windows, Macintosh and UNIX*
* Adobe Acrobat 9.4 and earlier 9.x versions for Windows and Macintosh


Mitigations

Adobe Reader and Acrobat 9.x - Windows
Deleting, renaming, or removing access to the authplay.dll file that ships with Adobe Reader and Acrobat 9.x mitigates the threat for those products, but users will experience a non-exploitable crash or error message when opening a PDF file that contains Flash (SWF) content.

The authplay.dll that ships with Adobe Reader and Acrobat 9.x for Windows is typically located at C:\Program Files\Adobe\Reader 9.0\Reader\authplay.dll for Adobe Reader or C:\Program Files\Adobe\Acrobat 9.0\Acrobat\authplay.dll for Acrobat.

Read more

[INDRANIL]

Thank you leo for the notification .

[johnshaw1917]

Thanks for the headsup Leo!

[Anakey]

Secunia also shows the Adobe Shockwave program to be insecure also, though this may be a different venerability

[Boyfriend]

Thanks leofelix for Security Advisory notification

[hellnoire]

Secunia also shows the Adobe Shockwave program to be insecure also, though this may be a different venerability

Isn't Shockwave... long dead?

[Anakey]

idk, you can still download it from adobe so there must be something out there that still uses it

[leofelix]

Secunia also shows the Adobe Shockwave program to be insecure also, though this may be a different venerability

Didn't they already fix it?

http://forum.raymond.cc/security-bulletin/24357-adobe-shockwave-player-11-5-9-615-a.html

[solin]

Acrobat does not exist on my computer. What needs to change only Reader. Apart from Flash, Shock and Air.

[leofelix]

Adobe security advisor has been updated


Update:

We are in the process of finalizing a fix for the issue and expect to provide an update for Flash Player 10.x for Windows, Macintosh, Linux and Solaris by November 4, 2010.