Feeds

Adobe goes out of band to fix frightful Flash flaw

Company warns of active attacks on browsers

Providing a secure and efficient Helpdesk

Adobe has issued an out-of-band fix to address what the company warns is an actively-targeted vulnerability in its Flash media plug-in.

The company said that the Flash 12.0.0.44 update would address a remote code execution vulnerability present in the Windows, OS X, and Linux versions of Flash Player. Users running Chrome and Internet Explorer will automatically download the update through their browsers, while other users can obtain the fix through Adobe's Download Center.

Adobe said that if targeted, the integer underflow vulnerability could cause a crash that would allow an attacker to remotely execute code and possibly take control of a targeted system.

According to the company, there have been reports of the flaw being actively targeted in the wild, prompting a high deployment priority on the Windows and OS X versions of the patch. Adobe considers the Linux update to be a lower priority at the moment.

That the company would release the update outside of its normal monthly security update schedule would indeed suggest that the flaw is a serious issue. Such out-of-band releases are fairly uncommon among companies with monthly updates, and are usually only issued when a serious vulnerability is being actively targeted.

According to security researcher and blogger Graham Cluley, the high-profile of Flash and the history of attackers targeting Adobe tools should motivate users and administrators to patch their systems quickly.

"Clearly Adobe thinks the issue is serious if it is taking the step to issue an out-of-band security patch," Cluley said in a blog post.

"In the past Adobe security flaws have been exploited widely by online criminals to infect unprotected computers, so internet users would be wise to take the threat seriously and patch their systems as appropriate." ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
PEAK IPV4? Global IPv6 traffic is growing, DDoS dying, says Akamai
First time the cache network has seen drop in use of 32-bit-wide IP addresses
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
prev story

Whitepapers

A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.