copyright | disclaimer | privacy | contact  
Australia's Leading Computer Emergency Response Team
 
Search this site

 
On this site

 > HOME
 > About AusCERT
 > Membership
 > Contact Us
 > PKI Services
 > Publications
 > Sec. Bulletins
 > Conferences
 > News & Media
 > Services
 > Web Log
 > Site Map
 > Site Help
 > Member login





 

ESB-2011.0522 - ALERT [Win][Linux][Solaris][Mac][OSX] Adobe Flash Player: Execute arbitrary code/commands - Remote with user interaction

Date: 13 May 2011
References: ESB-2011.0527  ESB-2011.0535  

Click here for printable version
Click here for PGP verifiable version
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2011.0522
             Security update available for Adobe Flash Player
                                13 May 2011

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           Adobe Flash Player
Publisher:         Adobe
Operating System:  Windows
                   Mac OS X
                   Linux variants
                   Solaris
                   Android
Impact/Access:     Execute Arbitrary Code/Commands -- Remote with User Interaction
Resolution:        Patch/Upgrade
CVE Names:         CVE-2011-0627 CVE-2011-0626 CVE-2011-0625
                   CVE-2011-0624 CVE-2011-0623 CVE-2011-0622
                   CVE-2011-0621 CVE-2011-0620 CVE-2011-0619
                   CVE-2011-0618 CVE-2011-0589 CVE-2011-0579

Original Bulletin: 
   http://www.adobe.com/support/security/bulletins/apsb11-12.html

- --------------------------BEGIN INCLUDED TEXT--------------------

Security update available for Adobe Flash Player

Release date: May 12, 2011

Vulnerability identifier: APSB11-12

CVE number: CVE-2011-0589, CVE-2011-0618, CVE-2011-0619, CVE-2011-0620,
CVE-2011-0621, CVE-2011-0622, CVE-2011-0623, CVE-2011-0624, CVE-2011-0625,
CVE-2011-0626, CVE-2011-0627

Platform: All Platforms

SUMMARY

Critical vulnerabilities have been identified in Adobe Flash Player
10.2.159.1 and earlier versions (Adobe Flash Player 10.2.154.28 and earlier
for Chrome users) for Windows, Macintosh, Linux and Solaris, and Adobe
Flash Player 10.2.157.51 and earlier versions for Android. These
vulnerabilities could cause the application to crash and could potentially
allow an attacker to take control of the affected system. There are reports
of malware attempting to exploit one of the vulnerabilities, CVE-2011-0627,
in the wild via a Flash (.swf) file embedded in a Microsoft Word (.doc)
or Microsoft Excel (.xls) file delivered as an email attachment targeting
the Windows platform. However, to date, Adobe has not obtained a sample
that successfully completes an attack.

Adobe recommends users of Adobe Flash Player 10.2.159.1 and earlier
versions (Adobe Flash Player 10.2.154.28 and earlier versions for Chrome
users) for Windows, Macintosh, Linux and Solaris update to Adobe Flash
Player 10.3.181.14. Adobe recommends users of Adobe Flash Player
10.2.157.51 and earlier versions for Android update to Adobe Flash Player
10.3.185.21.

AFFECTED SOFTWARE VERSIONS

Adobe Flash Player 10.2.159.1 and earlier versions for Windows, Macintosh,
                                       Linux and Solaris operating systems
Adobe Flash Player 10.2.154.28 and earlier versions for Chrome users
Adobe Flash Player 10.2.157.51 and earlier versions for Android

To verify the version of Adobe Flash Player installed on your system,
access the About Flash Player page, or right-click on content running in
Flash Player and select "About Adobe (or Macromedia) Flash Player" from
the menu. If you use multiple browsers, perform the check for each browser
you have installed on your system.

To verify the version of Adobe Flash Player for Android, go to Settings >
Applications > Manage Applications > Adobe Flash Player 10.x.

SOLUTION

Adobe recommends all users of Adobe Flash Player 10.2.159.1 and earlier
versions for Windows, Macintosh, Linux and Solaris upgrade to the newest
version 10.3.181.14 by downloading it from the Adobe Flash Player Download
Center. Windows users can install the update via the auto-update mechanism
within the product when prompted.

Google Chrome users can update to Chrome version 11.0.696.68 or later.

Users of Adobe Flash Player 10.2.157.51 and earlier for Android can update
to Adobe Flash Player 10.3.185.21 by browsing to the Android Marketplace
on an Android phone.

SEVERITY RATING

Adobe categorizes these as critical updates and recommends affected users
update their installations to the newest versions.

DETAILS

Critical vulnerabilities have been identified in Adobe Flash Player
10.2.159.1 and earlier versions (Adobe Flash Player 10.2.154.28 and earlier
for Chrome users) for Windows, Macintosh, Linux and Solaris, and Adobe
Flash Player 10.2.157.51 and earlier versions for Android. These
vulnerabilities could cause the application to crash and could potentially
allow an attacker to take control of the affected system. There are reports
of malware attempting to exploit one of the vulnerabilities, CVE-2011-0627,
in the wild via a Flash (.swf) file embedded in a Microsoft Word (.doc)
or Microsoft Excel (.xls) file delivered as an email attachment targeting
the Windows platform. However, to date, Adobe has not obtained a sample
that successfully completes an attack.

This update resolves a design flaw that could lead to information
disclosure (CVE-2011-0579).

This update resolves an integer overflow vulnerability that could lead to
code execution (CVE-2011-0618).

This update resolves a memory corruption vulnerability that could lead to
code execution (CVE-2011-0619).

This update resolves a memory corruption vulnerability that could lead to
code execution (CVE-2011-0620).

This update resolves a memory corruption vulnerability that could lead to
code execution (CVE-2011-0621).

This update resolves a memory corruption vulnerability that could lead to
code execution (CVE-2011-0622).

This update resolves a bounds checking vulnerability that could lead to
code execution (CVE-2011-0623).

This update resolves a bounds checking vulnerability that could lead to
code execution (CVE-2011-0624).

This update resolves a bounds checking vulnerability that could lead to
code execution (CVE-2011-0625).

This update resolves a bounds checking vulnerability that could lead to
code execution (CVE-2011-0626).

This update resolves a memory corruption vulnerability that could lead to
code execution (CVE-2011-0627).

Adobe recommends users of Adobe Flash Player 10.2.159.1 and earlier
versions (Adobe Flash Player 10.2.154.28 and earlier versions for Chrome
users) for Windows, Macintosh, Linux and Solaris update to Adobe Flash
Player 10.3.181.14. Adobe recommends users of Adobe Flash Player
10.2.157.51 and earlier versions for Android update to Adobe Flash Player
10.3.185.21.  

Affected software               Flash Player 10.2.159.1 and earlier 
Recommended player update       10.3.181.14
Availability                    Flash Player Download Center

Affected software               Flash Player 10.2.159.1 and earlier -
                                        network distribution
Recommended player update       10.3.181.14
Availability                    Flash Player Licensing

Affected software               Flash Player 10.2.154.28 and earlier 
                                        for Chrome users
Recommended player update       10.3.181.14
Availability                    Google Chrome Releases


Affected software               Flash Player 10.2.157.51 and earlier
                                        for Android
Recommended player update       10.3.185.21
Availability                    Android Marketplace
                                        (browse to on an Android phone)


Affected software               Flash Professional CS5,
                                        Flash CS4 Professional and Flex 4
Recommended player update       10.3.181.14
Availability                    Flash Player Support Center



ACKNOWLEDGMENTS

Adobe would like to thank the following individuals and organizations for
reporting the relevant issues and for working with Adobe to help protect
our customers:

binaryproof through iDefense's Vulnerability Contributor Program (CVE-2011-0618)
Marc Schoenefeld of Red Hat Security Response Team (CVE-2011-0619)
Vitaliy Toropov through iDefense's Vulnerability Contributor Program (CVE-2011-0620)
Bo Qu of Palo Alto Networks (CVE-2011-0621)
Honggang Ren of Fortinet's FortiGuard Labs (CVE-2011-0622)
Yamata Li of Palo Alto Networks (CVE-2011-0623)
Tavis Ormandy of the Google Security Team (CVE-2011-0624, CVE-2011-0625, CVE-2011-0626)
Will Dormann of CERT (CVE-2011-0625, CVE-2011-0626)

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iD8DBQFNzLBp/iFOrG6YcBERAkqlAJ0Shf1aMEn8Q1GNVTy7sp9lau3RNACgvh62
FDjc9+4tS7PqsnF6Fe64zBg=
=fzNm
-----END PGP SIGNATURE-----