Critical Security Updates to Adobe Products

Patch Tuesday was hit hard with not only Microsoft security updates but also critical updates released by Adobe for Adobe Reader/Acrobat, Adobe Flash Player and Adobe Shockwave Player.  Also released were important updates for Adobe's ColdFusion product.

The updates are for all platforms and are for remote code execution and cross-site scripting (XSS).  Details are in the respective security bulletins.


Security updates available for Adobe Reader and Acrobat

Release date: February 8, 2011
Vulnerability identifier: APSB11-03
CVE Numbers: CVE-2010-4091, CVE-2011-0562, CVE-2011-0563, CVE-2011-0564, CVE-2011-0565, CVE-2011-0566, CVE-2011-0567, CVE-2011-0568, CVE-2011-0570, CVE-2011-0585, CVE-2011-0586, CVE-2011-0587, CVE-2011-0588, CVE-2011-0589, CVE-2011-0590, CVE-2011-0591, CVE-2011-0592, CVE-2011-0593, CVE-2011-0594, CVE-2011-0595, CVE-2011-0596, CVE-2011-0598, CVE-2011-0599, CVE-2011-0600, CVE-2011-0602, CVE-2011-0603, CVE-2011-0604, CVE-2011-0605, CVE-2011-0606

Summary

Critical vulnerabilities have been identified in Adobe Reader X (10.0) for Windows and Macintosh; Adobe Reader 9.4.1 and earlier versions for Windows, Macintosh and UNIX; and Adobe Acrobat X (10.0) and earlier versions for Windows and Macintosh. These vulnerabilities could cause the application to crash and potentially allow an attacker to take control of the affected system. Risk for Adobe Reader X users is significantly lower, as none of these issues bypass Protected Mode mitigations.

Acrobat and Reader users can update to the latest version using the built-in updater, by clicking “Help” and then “Check for Updates.” The Adobe Reader update for Windows is available from here.

Direct link for the 10.1 update:  http://www.adobe.com/support/downloads/thankyou.jsp?ftpID=4943&fileID=4617

FTP Links for supported versions:

http://ftp://ftp.adobe.com/pub/adobe/reader/win/8.x/8.2.6/misc/AdbeRdrUpd826_all_incr.msp
http://ftp://ftp.adobe.com/pub/adobe/reader/win/9.x/9.4.2/misc/AdbeRdrUpd942_all_incr.msp
http://ftp://ftp.adobe.com/pub/adobe/reader/win/10.x/10.0.1/misc/AdbeRdrUpd1001_Tier1.msp

As usual, the caution to UNCHECK the box shown below. It is not needed for the update!

Free McAfee® Security Scan Plus (optional)

Free Google Toolbar (optional)

Search Google from any web page, block pop-ups
Learn more | Privacy policy | License

Free McAfee® Security Scan Plus (optional)

The next quarterly security updates for Adobe Reader and Acrobat is scheduled for June 14, 2011.




Security update available for Adobe Flash Player

Release date: February 8, 2011
Vulnerability identifier: APSB11-02
CVE Numbers: CVE-2011-0558, CVE-2011-0559, CVE-2011-0560, CVE-2011-0561, CVE-2011-0571, CVE-2011-0572, CVE-2011-0573, CVE-2011-0574, CVE-2011-0575, CVE-2011-0577, CVE-2011-0578, CVE-2011-0607, CVE-2011-0608

Summary

Critical vulnerabilities have been identified in Adobe Flash Player 10.1.102.64 and earlier versions for Windows, Macintosh, Linux, and Solaris. These vulnerabilities could cause the application to crash and could potentially allow an attacker to take control of the affected system.

Adobe recommends users of Adobe Flash Player 10.1.102.64 and earlier versions for Windows, Macintosh, Linux, and Solaris update to Adobe Flash Player 10.2.152.26.

Edit Note:  As of this update, Adobe is discontinuing support for Flash Player version 9.  See Flash Player 9 no longer supported.


Although Adobe suggests downloading the update from the Adobe Flash Player Download Center or by using the auto-update mechanism within the product when prompted, if you prefer, the direct download links are as follows:

• IE: http://fpdownload.adobe.com/get/flashplayer/current/install_flash_player_ax.exe
• Non-IE (Opera, Firefox etc) http://fpdownload.adobe.com/get/flashplayer/current/install_flash_player.exe

If you use the Adobe Flash Player Download Center, be careful to UNCHECK the box shown below. It is not needed for the Flash Player update. 

1 MB

Free McAfee® Security Scan Plus (optional) 

In addition, any toolbar offered with Adobe products can be unchecked if not wanted.


Verify Installation:
To verify the Adobe Flash Player version number installed on your computer, go to the About Flash Player page, or right-click on content running in Flash Player and select "About Adobe Flash Player" from the menu.

Do this for each browser installed on your computer.

You may also want to verify the version of Adobe AIR installed on your system in the Adobe AIR TechNote.

Security update available for Shockwave Player

Release date: February 8, 2011
Vulnerability identifier: APSB11-01
CVE number: CVE-2010-2587, CVE-2010-2588, CVE-2010-2589, CVE-2010-4092,
CVE-2010-4093, CVE-2010-4187, CVE-2010-4188, CVE-2010-4189, CVE-2010-4190,
CVE-2010-4191, CVE-2010-4192, CVE-2010-4193, CVE-2010-4194, CVE-2010-4195,
CVE-2010-4196, CVE-2010-4306, CVE-2010-4307, CVE-2011-0555, CVE-2011-0556,
CVE-2011-0557, CVE-2011-0569

Summary

Critical vulnerabilities have been identified in Adobe Shockwave Player 11.5.9.615 and earlier
versions on the Windows and Macintosh operating systems. These vulnerabilities could allow an
attacker, who successfully exploits these vulnerabilities, to run malicious code on the affected
system.

Download for Windows:  http://www.adobe.com/shockwave/download/


Note:  Please remember to uncheck any unwanted 3rd party toolbars/programs during installation. Also please do not confuse this with Adobe Flash Player which is a different program.

How to disable the auto-update setting in Shockwave:  http://kb2.adobe.com/cps/166/tn_16683.html
(This must be set every time Shockwave Player is updated if you do not want auto-updating.)


References:

• Adobe Reader/Acrobat:  Security Bulletin (APSB11-03)
• Adobe Flash Player:  Security Bulletin (APSB11-02)
• Adobe Shockwave Player:  Security Bulletin (APSB11-01)

Clubhouse Tags: Clubhouse, Microsoft, Windows, Security, Updates, Vulnerabilities, Information,

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...