Security Advisory SA41434 - Adobe Flash Player / AIR Code Execution Vulnerability

Secunia

Blog

Secunia Advisory SA41434

Adobe Flash Player / AIR Code Execution Vulnerability

Secunia Advisory

SA41434

Release Date

2010-09-14

Last Update

2010-10-06

Popularity

86,731 views

Comments

4 comments

Criticality level

Extremely critical

Impact

System access

Where

From remote

Authentication level

This information is available to Secunia VIM customers

Report reliability

This information is available to Secunia VIM customers

Solution Status

Vendor Patch

Systems affected

This information is available to Secunia VIM customers

Approve distribution

This information is available to Secunia VIM customers

Remediation status

Secunia CSI, Secunia PSI

Automated scanning

Secunia CSI, Secunia PSI

Software:

Adobe AIR 2.x

Adobe Flash Player 10.x

Adobe Flash Player 9.x

Secunia CVSS Score

This information is available to Secunia VIM Customers

CVE Reference(s)

CVE-2010-2884 CVSS score available to Secunia VIM customers

Description

A vulnerability has been discovered in Adobe Flash Player and Adobe AIR, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to an error in the authplay.dll component when parsing Flash content and can be exploited to corrupt memory.

Successful exploitation allows execution of arbitrary code.

The vulnerability is reported in the following products:
* Adobe Flash Player 10.1.82.76 (confirmed) and prior.
* Adobe Flash Player 9.x
* Adobe AIR 2.0.3 and prior.

NOTE: The vulnerability is currently being actively exploited.

Solution
Update Adobe Flash Player to version 9.0.283 or 10.1.85.3 and Adobe AIR to version 2.0.4.
Further details available to Secunia VIM customers

Provided and/or discovered by
Reported as a 0-day.

The vendor also credits Bo Qu, Palo Alto Networks.

Changelog
Further details available to Secunia VIM customers

Original Advisory
Adobe:
http://www.adobe.com/support/security/advisories/apsa10-03.html
http://www.adobe.com/support/security/bulletins/apsb10-22.html

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers

Do you have additional information related to this advisory?

Please provide information about patches, mitigating factors, new versions, exploits, faulty patches, links, and other relevant data by posting comments to this Advisory. You can also send this information to vuln@secunia.com

Subject: Adobe Flash Player / AIR Code Execution Vulnerability

User

Message

jan.killian

RE: Adobe Flash Player Unspecified Code Execution Vulnerability

21st Sep, 2010 08:54

Score: 10
Posts: 12
User Since: 11th Sep 2010
System Score: N/A
Location: CZ
Last edited on 21st Sep, 2010 08:56

The fixed version 10.1.95.1 is released. I'm eager to see how PSI 2 beta will handle the auto update...
http://www.adobe.com/support/security/bulletins/ap...

Was this reply relevant?

-0

jan.killian

RE: Adobe Flash Player Unspecified Code Execution Vulnerability

21st Sep, 2010 08:56

Score: 10
Posts: 12
User Since: 11th Sep 2010
System Score: N/A
Location: CZ
Last edited on 21st Sep, 2010 10:06

oops, 10.1.95.1 is the fixed version for Android, on other platforms it's 10.1.85.3

Was this reply relevant?

-0

jan.killian

RE: Adobe Flash Player Unspecified Code Execution Vulnerability

21st Sep, 2010 16:23

Score: 10
Posts: 12
User Since: 11th Sep 2010
System Score: N/A
Location: CZ
Last edited on 21st Sep, 2010 16:23

Btw, the autoupdate of with PSI 2 beta worked OK using non-IE version of Flash for Opera/Firefox/Safari.

After starting PSI, it apparently downloaded the updated advisories, marked flash as insecure, started downloading the 10.1.85.3 update for it, and because Opera was started, it just scheduled it to run later. Few mins after quitting Opera, the update was installed. Good job! Thanks!

Was this reply relevant?

-0

Anthony Wells

RE: Adobe Flash Player Unspecified Code Execution Vulnerability

21st Sep, 2010 18:22

Score: 2324
Posts: 3,205
User Since: 19th Dec 2007
System Score: N/A
Location: N/A

Hello@jan.killian ,

Just to inform you , as a new member of the Community Forum , that this thread in the sub-forum "vulnerabilities" in which you are posting was created by your initial post in the comments section under a specific Secunia Advisory - SA#41434 in this case .

The comments section under a Secunia Advisory is reserved for technical discussions on the vulnerability described in the SA . Your comments are about the auto-update in the PSI Beta which are not actually relevant to the SA .

In future you will get better help/comments if you create your own thread in the relevant sub-forum - see the left hand column of this webpage .

Take care

Anthony

--

It always seems impossible until its done.
Nelson Mandela

Was this reply relevant?

-0

Secunia Advisory SA41434

Adobe Flash Player / AIR Code Execution Vulnerability

Do you have additional information related to this advisory?

You must be logged in to post a comment.

Secunia Customer Login

Not a customer already?