Adobe Patch is out

Published: 2009-07-31. Last Updated: 2009-07-31 21:22:30 UTC
by Deborah Hale (Version: 2)
3 comment(s)

It looks like today will be patch day for a lot of folks.  It appears that  Adobe has released the patch for the Adobe Reader vulnerability is out.   Thanks to all of our readers that Abobe Bulletins that Handler Mark posted yesterday and Handler Bojan posted on July 23rd.

isc.sans.org/diary.html

isc.sans.org/diary.html

The patches can be downloaded from Adobe's update site.

Thanks to all of our reader's that have notified us of the availability of the patch.

 

Update:  Here is some more information about the Adobe Updates that are available.  It appears that this update is for Adobe Flash Player.  According to the Adobe Security Advisory this is a critical vulnerability in the current versions of Flash Player and affects Windows, MAC and Linux OS's.  The information indicates that the vulnerability could crash and potentially allow an attacker to take control of the affected system.  The information provided by Adobe says that the vulnerability is currently being exploited in the wild.

www.adobe.com/support/security/advisories/apsa09-03.html

So bottom line... PATCH NOW.

Deb Hale Long Lines, LLC

Keywords: Adobe
3 comment(s)

Comments

The Adobe patches fix the problem in each product. But wouldn't the defense in depth changes in Internet Explorer in KB972260 block the exploits? My googling is failing to find where somebody has actually tested this and published their findings.
There are two separate issues here.

First is the Microsoft ATL issue. Not sure if the defense in depth in KB972260 blocks attacks or not. The ATL issue affects Shockwave and Flash. My personal opinion is that you fix everything - belt and suspenders is best! Maybe someone finds a workaround for 972260, but if you have Flash and Shockwave patched then you're at least fine on those two. Note that, according to Adobe, Reader and Acrobat were unaffected by ATL.

Second issue is the Authplay.dll vulnerability, which is a zero-day that's been known for almost two weeks. This is present in both Flash and Adobe Reader/Acrobat and is, AFAIK, independent of the ATL issue.

Releases: Shockwave was updated on Tuesday (addressing ATL), Flash was updated (addressing both ATL and Authplay) on Thursday, and Reader/Acrobat were updated today (addressing Authplay).

Short answer? GET PATCHING!
One more note - if you have Firefox deployed en masse, according to https://wiki.mozilla.org/Releases/Firefox_3.5.2 it appears that 3.5.2 will be a chemspill release due sometime on Monday!

Diary Archives