Adobe released today APSA10-05 advisory, which shows a 0-day vulnerability that can be exploited remotely for Adobe Flash Player, Adobe Reader and Acrobat. Adobe says the update will exist hopefully by the Nov 15 week. The following are the mitigation measures recommended by adobe: Adobe Reader and Acrobat 9.x - Windows The authplay.dll that ships with Adobe Reader and Acrobat 9.x for Windows is typically located at C:Program FilesAdobeReader 9.0Readerauthplay.dll for Adobe Reader or C:Program FilesAdobeAcrobat 9.0Acrobatauthplay.dll for Acrobat. Adobe Reader 9.x - Macintosh Acrobat Pro 9.x - Macintosh Adobe Reader 9.x - UNIX More information at http://contagiodump.blogspot.com/2010/10/potential-new-adobe-flash-player-zero.html -- Manuel Humberto Santander Peláez | http://twitter.com/manuelsantander | http://manuel.santander.name | msantand at isc dot sans dot org |
Manuel Humberto Santander Pelaacuteez 195 Posts ISC Handler Oct 28th 2010 |
Thread locked Subscribe |
Oct 28th 2010 1 decade ago |
The correct CVE identifier for this issue is CVE-2010-3654 (additionally, the format of CVE's is CVE-2010-xxxx, i.e. the hyphen before 2010). Diary's keyword entry needs also updating.
|
Juha-Matti 5 Posts |
Quote |
Oct 28th 2010 1 decade ago |
So, what's the reality on this vulnerability.
Flash Player gets mention as being vulnerable, but all the attention is on Acrobat Reader. Is it because the AuthPlay.dll library calls Flash Player functions in some insecure manner, or do we actually have to remove Flash Player and nobody's bothered mentioning that necessity? |
Juha-Matti 57 Posts |
Quote |
Oct 29th 2010 1 decade ago |
My 2 cents:
* Both Adobe Reader and Flash are vulnerable. Adobe Reader has an embedded Flash engine so that Flash content can be embedded in PDF files. Reader does not call Flash - the embedded Flash engine in Reader is independent of the Flash plugin for the browser. * Based on the Adobe bulletin, Adobe is aware of current exploits in the wild against Reader through the PDF vector. Adobe isn't aware of exploits against Flash, although the absence of evidence is not evidence of absence! * It is relatively easy to defend against the PDF vector by disabling access to authplay.dll (safest, IMHO, is to deny Everyone full control on the file, but keep in mind that reversing this can require taking ownership of the file because only the owner can modify perms on a file to which everyone is blocked). This also prevents the use of Flash in PDF files, but that isn't that widely used. * Defending against the Flash vector requires uninstalling Flash, which would break a number of websites. One other note. Adobe also released a security update for Shockwave today, so get that packaged and rolling out! |
Anonymous |
Quote |
Oct 29th 2010 1 decade ago |
Does anyone know if Microsoft EMET mitigates/prevents this vulnerability from being exploited if the corresponding Adobe .exe file is being protected by EMET?
|
Anonymous |
Quote |
Oct 29th 2010 1 decade ago |
Sign Up for Free or Log In to start participating in the conversation!