Critical.
Authoritative.
Strategic.
Subscribe to CIO Magazine »

Adobe issues update for Flash, warning for Reader

Adobe was busy this week -- releasing an update for a Flash flaw and posting news of a security vulnerability in Adobe Reader

Yesterday was sort of a busy day for Adobe security. Of course, that doesn't seem like such an uncommon occurrence these days. Adobe issued an update to address a security flaw in Flash, and followed up with a new security advisory about a vulnerability impacting Adobe Reader.

The Adobe security bulletin for the Flash vulnerability provides details about the issue. "Critical vulnerabilities have been identified in Adobe Flash Player 10.1.85.3 and earlier versions for Windows, Macintosh, Linux, and Solaris, and Adobe Flash Player 10.1.95.1 for Android. These vulnerabilities, including CVE-2010-3654 referenced in Security Advisory APSA10-05, could cause the application to crash and could potentially allow an attacker to take control of the affected system."

Adobe has developed an updated version of Flash -- version 10.1.102.64 -- to address the problem. All users of affected versions of Adobe Flash are urged to upgrade to the newest version. Adobe has also developed a patched version of Flash Player 9 -- version 9.0.289.0 -- for those who can't move up to Flash Player 10. There is no fix yet for Adobe Flash Player for Android, but Adobe expects to have that update available on November 9, 2010.

Adobe also published a blog post describing a potential security threat affecting Adobe Reader. "Adobe is aware of a potential issue in Adobe Reader posted publicly today on the Full Disclosure list. A proof-of-concept file demonstrating a Denial of Service was published. Arbitrary code execution has not been demonstrated, but may be possible. We are currently investigating this issue."

Adobe stresses that the issue does not affect Adobe Acrobat, and that it is not currently aware of any attacks exploiting the Adobe Reader issue. Still, pending an actual patch or update, Adobe provides guidance to use the JavaScript Blacklist Framework to protect vulnerable systems.

The JavaScript Blacklist Framework is a mechanism for blocking vulnerable APIs rather than disabling JavaScript altogether. The blacklist is maintained in the Windows registry and the Macintosh OS X FeatureLockdown file. The Adobe blog post about the Reader issue includes step by step instructions to use the framework.

Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.

More about: Adobe, Linux, PSA
References show all

Comments

Post new comment

The content of this field is kept private and will not be shown publicly.
Users posting comments agree to the CIO comments policy.
Login or register to link comments to your user profile, or you may also post a comment without being logged in.
Related Coverage
Related Whitepapers
Latest Stories
Community Comments
Tags: Adobe Systems, Flash, online security, security
Latest Blog Posts
Whitepapers
  • So Long, Silos: Why Multi-Domain MDM Is Better For Your Business
    Say “so long” to silos. This white paper explains why a multi-domain MDM solution is far better than single-domain, single-focused point solutions. You’ll learn what to look for in a multi-domain solution so you don’t outgrow it or are forced to purchase multiple products down the road. You’ll also get tips on how to select a multi-domain solution that can lead to multiple benefits over many years. The age of multi-domain MDM is here. See why you should say “hello” to it!
    Learn more »
  • Why Encrypt? Securing Email without compromising communications.
    Encryption is a vital component of any DLP strategy. It allows businesses to exchange sensitive information without compromising on security; even if data is intercepted, encryption makes it unreadable and renders it tamper-proof. Read on.
    Learn more »
  • HP ePrint Enterprise mobile printing solution
    The merger of mobile devices and cloud services has become one of the most significant enablers of business productivity and innovation in the past decade. We now hold the power of communicating and computing in the palms of our hands, nearly anywhere business or life takes us. However, one key business process has eluded the mobility movement: printing. Even the most technically enabled business travelers find themselves hunting down print services while on the road and interrupting IT managers when visiting a branch office simply to print a document. But finally, a truly mobile print experience is available—helping enterprises to drive business productivity further. Read more.
    Learn more »
All whitepapers
rhs_login_lockGet exclusive access to Invitation only events CIO, reports & analysis.
Recent comments