MA-185.072009: MyCERT Alert - Multiple Critical Vulnerabilities in Adobe Flash Player and Adobe AIR 1.0 Introduction Multiple critical vulnerabilities have been identified in the current versions of Adobe AIR and (v1.5.2) Adobe Flash Player (v9.0.159.0 and v10.0.22.87) for Windows, Macintosh and Linux operating systems. These vulnerabilities allow remote attacker to execute arbitrary code on vulnerable version of Adobe AIR and Adobe Flash Player. User interaction is required in that a user must visit a malicious web site that embedded with a specially crafted Flash (SWF) file. This vulnerability would cause the application to crash and could potentially allow an attacker to take control of the affected system. 2.0 Impact By exploiting this vulnerability, an attacker could execute arbitrary code on vulnerable installations of Adobe AIR and Adobe Flash Player and gain the same privilege as the user. This vulnerability could be exploited to install malware on the user's computer. 3.0 Affected Products Products listed below are vulnerable to this vulnerability: - Adobe Flash Player 10.0.22.87 and earlier version
- Adobe Flash Player 9.0.159.0 and earlier version
- Adobe Acrobat 9.1.2 and earlier version
4.0 Recommendation MyCERT recommends users of Adobe Flash Player 10.0.22.87 and earlier versions to upgrade to the newest version 10.0.32.18 by downloading it from the following URL: http://www.adobe.com/go/getflashplayer For users who cannot update to Adobe Flash Player 10, patch for version of Adobe Flash Player 9 is available at the following link: http://www.adobe.com/products/flashplayer/fp_distribution3.html For Adobe AIR, users can update to the newest version 1.5.2 by downloading it from the the following link: http://get.adobe.com/air MyCERT generally advise users of this product to keep themselves updated with the latest security announcements by the vendor. In case of public received any suspicious URL or SWF and required our further analysis, please reach us at information below: E-mail : mycert@mycert.org.my
Phone : +603 89926969 or 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : +60 19 2813801 (24x7 SMS reporting)
Business Hours : Mon - Fri 08:30 -17:30 MYT
Web: http://www.mycert.org.my 5.0 References |
