Adobe plugs critical Flash Player hole
More than 30 others patched too
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
Adobe Systems on Thursday made good on a promise to rid its ubiquitous Flash media player of a critical vulnerability that criminals are exploiting to install malware on end user machines.
The security update is available for versions 10.0.45.2 and earlier of Flash for Windows, Mac OS X, and Linux. Last week, Adobe warned that the vulnerability allows attackers to take complete control of vulnerable machines when they view websites that contained specially manipulated Flash content. A related vulnerability that's also being actively exploited in Adobe's Reader and Acrobat applications won't be available until June 29, the company said.
According to Websense and other security firms, the security bugs are being targeted in emails that prompt recipients to open booby-trapped websites and PDF documents. The malicious files used in the exploits weren't detected by a single one of the major anti-virus providers as of Wednesday, more than five days after Adobe first disclosed the attacks, Websense said.
Once the exploits are executed, end-user machines are infected with backdoor trojans and other malware, much of which also was not detected by anti-virus software.
With almost three weeks to go before a fix is issued for the Reader and Acrobat bugs, users should take steps to guard against attacks. The best safeguard is to shun the applications altogether and use an alternative one such as Foxit for Windows or Preview for the Mac. If that's not possible, the authplay.dll, AuthPlayLib.bundle or libauthplay.so.0.0.0 files should be deleted on Windows, Mac and Linux machines respectively.
Adobe has more detailed work-around instructions here. The US Computer Emergency Readiness Team has also said that disabling javascript in Reader and Acrobat will also prevent the attacks.
In all, Flash 10.1.53.64, which is available for download here, fixes more than 30 other security flaws. Not that Adobe is out of the woods yet. Shortly after it was released, security researcher Charlie Miller tweeted: "Yippee! My fav flash bug survived another adobe killing field." ®
COMMENTS
So Jobs was right
So Steve Jobs was right. Adobe Flash is a POS afer all, funny that.
More Flash bugs
When are they going to finally either fix or kill off this bugridden garbage .
Thank god for flash block
RE: So Jobs was right
I wonder if loading up the new version on my laptop will be a similar experience to loading up the version I currently have?
The fan goes wild and the machine heats up noticably.
The only other software I have that does that is some code I wrote myself to stress test the machine and use as much CPU time as possible. Maybe Adobe do this on purpose?
On the other hand, there's so much bloat there that maybe the code slipped through by accident, after all this newly-closed bug has been around forever but was only closed when hackers exploited it. Shows that Adobe didn't really think of the security implications, didn't care or didn't notice. Maybe a mixture of all three. So carelessness, ineptitude or just a lack of will. Whichever way you look at it, Adobe come out smelling like manure, not roses.
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
