Critical Flash vuln under active attack, Adobe warns
Tale of two 0days
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
Adobe Systems on Monday warned of a critical vulnerability in the most recent version of its Flash Player that is being actively exploited in the wild.
The vulnerability affects Flash Player 10.1.82.76 for Windows, Macintosh, Linux, Solaris, and Android operating systems, Adobe said in an advisory. “There are reports that this vulnerability is being actively exploited in the wild against Adobe Flash Player on Windows,” the warning said, without elaborating. The latest versions of Adobe's Reader and Acrobat applications are vulnerable to the same flaw, but there's no evidence they are being exploited.
The advisory credited Steven Adair of the Shadowserver Foundation for working with Adobe's security team on the vulnerability. Members of Shadowserver weren't immediately available to respond to questions.
The disclosure means there are at least two unpatched flaws in widely used Adobe applications that are presently under attack by criminals. As reported on Wednesday, a separate flaw in Reader 9.3.4 for Windows is also being exploited in emails that try to trick recipients into clicking on an attached PDF file. Once opened, the booby-trapped document exploits a stack overflow flaw in Reader, causing machines to run malware.
While the vulnerability is in all versions of the PDF viewing software, it is being exploited only on Windows-based installations, Adobe has said.
Adobe said it plans to issue a patch for the Flash vulnerability during the week of September 27. An update fixing the Reader vulnerability is scheduled for the week of October 4. In the meantime, users should use an alternative PDF viewer such as Foxit, or if they must use Reader, use it alongside Microsoft's EMET tool.
Protecting against Flash-based exploits is going to be harder, since Flash is used by Gmail and other web-based email services, YouTube, and many other modern online technologies. The easiest way to guard against the attacks is to use the Firefox browser with the NoScript add on. It automatically blocks all Flash content and allows users to specify a list of trusted websites that are excepted. ®
COMMENTS
Then you see what Steve Jobs wants you to see
Which for me is not much.
Sent from any computer I like to own and control.
Web-based email services
>> since Flash is used by Gmail and other web-based email services
That statement is misleading since such services can USE Flash but they most certainly don't NEED Flash to function. An example would be a Gmail user being able to view a Youtube video that's part of a message they received. But outside of something like that Flash is not a necessary part of any webmail service I'm aware of. I just don't want to see people being spooked about some kind of vague distinction that webmail services are more or less vulnerable as that isn't the case.
How many times to we have to be reminded...
Flash is just an all around bad idea?
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
