They also warn of a zero day flaw in Illustrator CS3 and CS4

Severity: High

9 December, 2009

Summary:

§ This vulnerability affects: Adobe Flash Player 10.0.32.18 and earlier, running on all platforms. Some flaws also affect Adobe AIR 1.5.2

§ How an attacker exploits it: By enticing your users to visit a website containing malicious Flash content

§ Impact: In the worst case, an attacker can execute code on your computer, potentially gaining control of it

§ What to do: Download and install the latest version of Adobe Flash Player and Air

Exposure:

Adobe Flash Player displays interactive, animated web content called Flash, often formatted as a Shockwave (.SWF) file. Adobe’s Flash Player ships by default with many web browsers, including Internet Explorer (IE). It also runs on many operating systems.

In a security bulletin released on the same day as Microsoft Patch Day, Adobe warned of at least seven critical vulnerabilities that affect Adobe Flash Player 10.0.32.18 for Windows and Macintosh (as well as all earlier versions). Some of the flaws also affect Adobe Air 1.5.2 as well. Adobe’s bulletin refers to seven CVE numbers, which suggests that their update fixes seven security vulnerabilities. The bulletin doesn’t describe the flaws in much technical detail. However, it does warn that if an attacker can entice one of your users to visit a malicious website containing specially crafted Flash content, he could exploit many of these unspecified vulnerabilities to execute code on that user’s computer, with that user’s privileges. If your Windows users have local administrator privileges, an attacker could exploit this flaw to gain full control of their PC. If you use Adobe Flash Player in your network, we recommend you download and deploy the latest version throughout your network as soon as possible.
On a related note, the day before releasing the Flash update, Adobe also released an advisory about a critical buffer overflow vulnerability in Illustrator CS3 and CS4. The flaw has to do with Illustrator’s inability to properly parse specially crafted .EPS files. If an attacker can entice one of your Illustrator users into opening a malicious .EPS file, he can also exploit this flaw to execute code on that user’s computer, with the user’s privileges. There is no patch for this flaw yet. Adobe plans to release one in January.

Solution Path

Adobe has released a new version of Flash Player and Air. Specifically:

§ Flash Player 10.0.42.34

§ Air 1.5.3

If you use these products in your network, we recommend you download and deploy their updates as soon as possible.

Severity: High

5 November, 2009

Summary:

§ This vulnerability affects: Adobe Shockwave Player 11.5.1.601 and earlier, running on Windows and Macintosh computers

§ How an attacker exploits it: By enticing your users to visit a website containing a malicious Flash file

§ Impact: An attacker can execute code on your computer, potentially gaining control of it

§ What to do: Download and install the latest version of Adobe Shockwave Player

Exposure:

Adobe Shockwave Player displays interactive, animated web content called Shockwave (.SWF) files. According to Adobe, Shockwave Player is installed on some 450 million PCs.

In a security bulletin released late Tuesday, Adobe warned of critical vulnerabilities that affect Adobe Shockwave Player 11.5.1.601 for Windows and Macintosh (as well as all earlier versions). Adobe’s bulletin refers to five CVE numbers, which suggests that their update fixes five security vulnerabilities. The bulletin doesn’t describe the flaws in much technical detail. However, it does warn that if an attacker can entice one of your users to visit a malicious website containing specially crafted Shockwave (SWF) content, he could exploit this unspecified vulnerability to execute code on that user’s computer, with that user’s privileges. If your Windows users have local administrator privileges, an attacker could exploit this flaw to gain full control of their PC.

If you deploy Adobe Shockwave throughout your network, we recommend you download and install the latest version as soon as you can.

Solution Path

Adobe has released a new version of Shockwave Player, version 11.5.2.602. If you use Adobe Flash in your network, we recommend you download and deploy this updated player as soon as possible.

Status:

Adobe has released a Shockwave Player update to fix these vulnerabilities.

References:

§ Adobe Security Bulletin

This alert was researched and written by Corey Nachreiner, CISSP.