Adobe issues patch for 'critical' Flash vulnerability
Connecting state and local government leaders
A security update from the company fixes seven Flash Player vulnerabilities, including a zero-day cross-site scripting flaw reportedly being exploited in the wild.
Adobe has released a fix for a critical zero-day flaw in Flash Player that repoptedly has been exploited in the wild, and issued updates addressing six other vulnerabilities.
The vulnerability Adobe classified as "critical," a zero-day cross-site scripting (XSS) flaw found by Google researchers, could allow an attacker to gain access to a user's computer via a malicious e-mail or website. Adobe has reported that systems have already been compromised using this flaw.
"There are reports that this vulnerability is being exploited in the wild in active targeted attacks designed to trick the user into clicking on a malicious link delivered in an e-mail message," Adobe said in a security bulletin.
Adobe said it had tried to replicate the flaw in Reader and Acrobat version 9.x. (and later), and found that the flaws do not affect either.
As for the remaining flaws fixed, four related to memory corruption and two were general security vulnerabilities. No other details on the holes were given.
Wednesday's out-of-band update comes on the heels of Tuesday's Shockwave Player update that fixed nine critical holes that could lead to a system being remotely loaded with malware.
"These vulnerabilities could allow an attacker, who successfully exploits these vulnerabilities, to run malicious code on the affected system. Adobe recommends users of Adobe Shockwave Player 11.6.3.633 and earlier versions update to Adobe Shockwave Player 11.6.4.634," sad the company.
While Adobe addressed the zero-day with a fix quickly, releasing it a day after its Shockwave rollout is rubbing some in IT the wrong way, including Andrew Storms, director of security operations for nCircle.
"I'll bet IT security teams everywhere are cursing under their breath while they rethink their patch strategies," said Storms, in an e-mail response to Adobe's patch. "It sure would have been nice if Adobe bundled all their patches together. In a perfect world, it would have been nice to get a little advance communication about the zero-day in Flash. And since we’re already wasting time fantasizing about how Adobe could make IT teams lives easier instead of harder, we should ask for a little mitigation information."
Google's Chrome Web browser, which directly integrates Flash into its software (unlike competing browsers) also received an update to reflect Adobe's patch update.
Adobe's Flash security update can be downloaded here.