Critical Adobe Flash Vulnerability

Security Advisory (APSA11-01) has been issued regarding a critical vulnerability in multiple versions of Adobe Flash Player:

• Adobe Flash Player 10.2.152.33 and earlier versions for Windows, Macintosh, Linux and Solaris operating systems
• Adobe Flash Player 10.2.154.13 and earlier versions for Chrome users
• Adobe Flash Player 101.106.16 and earlier versions for Android
• The authplay.dll component that ships with Adobe Reader and Acrobat X (10.0.1) and earlier 10.x and 9.x versions for Windows and Macintosh operating systems

Although Adobe is currently not aware of attacks targeting Adobe Reader and Acrobat, there are reports that this vulnerability is being exploited in the wild in targeted attacks via a Flash (.swf) file embedded in a Microsoft Excel (.xls) file delivered as an email attachment.

An update to Adobe Flash Player is expected to be available during the week of March 21, 2011.  The Adobe Reader X Protected Mode is designed to prevent an exploit of this kind from executing.  As a result, an update to Adobe Reader is not expected to be released until the quarterly update scheduled for June 14, 2011. 


References:

• Adobe Security Advisory: APSA11-01 - Security Advisory for Adobe Flash Player, Adobe Reader and Acrobat
• Adobe ASSET Blog: Background on APSA11-01 Patch Schedule
• Adobe PSIRT Blog: Security Advisory for Adobe Flash Player, Adobe Reader and Acrobat (APSA11-01)

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...