Feeds

Adobe goes out of band to fix frightful Flash flaw

Company warns of active attacks on browsers

Protecting against web application threats using SSL

Adobe has issued an out-of-band fix to address what the company warns is an actively-targeted vulnerability in its Flash media plug-in.

The company said that the Flash 12.0.0.44 update would address a remote code execution vulnerability present in the Windows, OS X, and Linux versions of Flash Player. Users running Chrome and Internet Explorer will automatically download the update through their browsers, while other users can obtain the fix through Adobe's Download Center.

Adobe said that if targeted, the integer underflow vulnerability could cause a crash that would allow an attacker to remotely execute code and possibly take control of a targeted system.

According to the company, there have been reports of the flaw being actively targeted in the wild, prompting a high deployment priority on the Windows and OS X versions of the patch. Adobe considers the Linux update to be a lower priority at the moment.

That the company would release the update outside of its normal monthly security update schedule would indeed suggest that the flaw is a serious issue. Such out-of-band releases are fairly uncommon among companies with monthly updates, and are usually only issued when a serious vulnerability is being actively targeted.

According to security researcher and blogger Graham Cluley, the high-profile of Flash and the history of attackers targeting Adobe tools should motivate users and administrators to patch their systems quickly.

"Clearly Adobe thinks the issue is serious if it is taking the step to issue an out-of-band security patch," Cluley said in a blog post.

"In the past Adobe security flaws have been exploited widely by online criminals to infect unprotected computers, so internet users would be wise to take the threat seriously and patch their systems as appropriate." ®

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Jihadi terrorists DIDN'T encrypt their comms 'cos of Snowden leaks
Intel bods' analysis concludes 'no significant change' after whistle was blown
Home Depot: 56 million bank cards pwned by malware in our tills
That's about 50 per cent bigger than the Target tills mega-hack
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
China hacked US Army transport orgs TWENTY TIMES in ONE YEAR
FBI et al knew of nine hacks - but didn't tell TRANSCOM
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.