Adobe confirms existence of new zero-day in Flash Player

Adobe has confirmed a new zero-day vulnerability exists in its Flash Player that can also affect Adobe Reader.

The critical vulnerability (CVE-2010-2884) could cause a crash and potentially allow an attacker to take control of the affected system. It exists in Adobe Flash Player 10.1.82.76 and earlier versions for Windows, Macintosh, Linux, Solaris and Adobe Flash Player 10.1.92.10 for Android.
This vulnerability also affects Adobe Reader 9.3.4 for Windows, Macintosh and Unix, and Adobe Acrobat 9.3.4 and earlier versions for Windows and Macintosh.

Adobe said that it is aware of the vulnerability being actively exploited in the wild against Flash and Windows, although it is not aware of any attacks exploiting this vulnerability against Adobe Reader or Acrobat to date.

Adobe said: “We are in the process of finalising a fix for the issue and expect to provide an update for Adobe Flash Player for Windows, Macintosh, Linux, Solaris and Android operating systems during the week of 27 September 2010.

“We expect to provide updates for Adobe Reader 9.3.4 for Windows, Macintosh and Unix, and Adobe Acrobat 9.3.4 for Windows and Macintosh during the week of 4 October 2010.”

A critical vulnerability in Adobe Reader and Acrobat remains unpatched, which SC Magazine reported on last week as being actively exploited in the wild.

Mac security firm Intego said that it has suggested multiple times to not use Adobe Reader because of the many security vulnerabilities, and to use Apple Preview, as it is much safer.

It said: “As for Flash, one strategy is to not load Flash on web pages, especially pages for sites you're not familiar with. If you use Apple's Safari web browser, you can install the free ‘Click To Flash' to block all Flash animations from loading (and you can click on the ones you want to view). If you use Firefox, try the ‘Flash block' add-on. If you use one of these Flash blockers, you may be surprised at the number of Flash items that exist on websites; these are often objects that you don't notice are Flash, but only see as graphics.”

See original article on scmagazineus.com