Adobe patches critical vulnerabilities in Flash Player

Attacks are already seen in the wild

SOFTWARE MAKER ADOBE has released a security update for Flash Player in order to address several critical vulnerabilities, including one that is being exploited in the wild.

The Flash Player 10.3.183.10 for Windows, Mac and Linux, and Flash Player 10.3.186.7 for Android, contain patches for six security flaws.

One of them is a cross-site scripting (XSS) weakness that can be exploited to execute rogue actions on behalf of web sites or webmail providers if victims click on maliciously-crafted links.

"There are reports that this issue is being exploited in the wild in active targeted attacks designed to trick the user into clicking on a malicious link delivered in an email message," Adobe warns in its security advisory.

XSS vulnerabilities are the result of improper user input validation and allow attackers to execute rogue code in the context of the current web site. For example, they can be leveraged to extract session cookies or load rogue forms into legitimate pages, which makes for very credible phishing attacks.

Adobe credits Google for reporting this cross-site scripting vulnerability, which is identified as CVE-2011-2444. This means it might have been detected in attacks against Gmail users.

Two other patched vulnerabilities allow for arbitrary code execution and are located in the AVM stack. One of them can also lead to a denial of service condition. Two remote code execution logic errors and a Flash Player security control bypass have also been addressed.

Users should deploy the new update as soon as possible because browser plug-ins like Java, Adobe Reader or Flash Player are amongst the most attacked pieces of software one can have on a computer. However, unlike Adobe Reader X (10.0) which features sandboxing technology, Flash Player doesn't have any anti-exploitation mechanism built-in.

Adobe is working on a sandbox-like technology for Flash, but that could still be one year away from a public release. In the meantime, the company has improved its update mechanism so that users are prompted to install new versions more quickly.

Chrome users have it the easiest because Google bundles a special Flash plug-in version with its browser and handles the update in a silent manner. In addition, Flash Player already runs in a sandbox under Chrome, so it is much harder to attack.

Posted in: Press Releases