Adobe Flash Vulnerability Advisory Appears Alongside Shockwave Patch - eWeek

Call it a good news, bad news situation for Adobe Systems. On the one hand, the company patched a number of vulnerabilities today in Shockwave Player; on the other, it issued a new advisory on a zero-day bug in Adobe Flash Player.

The Flash Player vulnerability affects versions 10.1.85.3 and earlier versions on Windows, Macintosh, Linux and Solaris operating systems, as well as Flash Player 10.1.95.2 and earlier versions for Android. It also impacts the authplay.dll component that ships with Adobe Reader 9.4 and earlier 9.x versions for Windows, Macintosh and UNIX systems, as well as Adobe Acrobat 9.4 and earlier 9.x versions for Windows and Macintosh.

?This vulnerability (CVE-2010-3654) could cause a crash and potentially allow an attacker to take control of the affected system,? Adobe warned. ?There are reports that this vulnerability is being actively exploited in the wild against Adobe Reader and Acrobat 9.x. Adobe is not currently aware of attacks targeting Adobe Flash Player.?

?We are in the process of finalizing a fix for the issue and expect to provide an update for Flash Player 10.x for Windows, Macintosh, Linux, and Android by November 9, 2010,? the company continued. ?We expect to make available an update for Adobe Reader and Acrobat 9.4 and earlier 9.x versions during the week of November 15, 2010.?

At the same time the company issued an advisory, it tucked a fix for a zero-day bug in Shockwave Player into a massive update that plugged 10 other vulnerabilities as well. On Oct. 21, Adobe warned a memory corruption vulnerability (CVE-2010-3653) in Shockwave Player versions 11.5.8.612 and earlier on Windows and Mac had been discovered. Six days later, the company warned the issue was under attack.

While users wait for a patch for the Flash Player vulnerability, users can delete, rename or remove access to the authplay.dll file that ships with Adobe Reader and Acrobat, Adobe advised. Doing so however will cause a non-exploitable crash or error message when opening a PDF file that contains Flash content. Instructions for doing this can be found in the advisory linked to above.

View the original article here

Microsoft plans colossal Patch Tuesday next week - Computerworld

Computerworld - Microsoft today said it will deliver a record 16 security updates next week to patch a whopping 49 vulnerabilities in Windows, Internet Explorer (IE), Office and SharePoint.

Andrew Storms, director of security operations for nCircle Security, called the massive update "daunting, again."

Four of the 16 updates were tagged with Microsoft's "critical" label, the highest threat ranking in its four-step scoring system. Another 10 were marked "important," the second-highest rating, while the remaining pair were labeled as "moderate."

Nine of the updates could be exploited by attackers to inject malicious code into vulnerable PCs, Microsoft said in its usual bare-bones advance notification of the updates scheduled for release Oct. 12. Microsoft often labels remote code executable bugs -- the most dangerous -- as important when the vulnerable components are not switched on by default or when other mitigating factors, such as defensive measures like ASLR and DEP, may protect some users.

Next week's Patch Tuesday is a record on almost every count.

The 16 updates -- Microsoft dubs them "bulletins" -- are a record, beating the count from August 2010 by two. The 49 individual patches easily exceeds the single-month record of 34, which was first set in October 2009 and repeated in this past June and August.

Microsoft has been shipping alternating large and small batches of fixes, with the larger-sized updates landing in even-numbered months, so October's big numbers shouldn't come as a shock. In August, for example, the company issued 14 bulletins patching 34 vulnerabilities. September's batch, however, included 9 bulletins that fixed 11 flaws.

"I have a theory about the large October updates," said Storms, pointing out that Microsoft released 13 bulletins and patched 34 vulnerabilities in the month last year, and issued 12 updates and fixed 21 flaws in October 2008. "It's the year-end financial and retail push by most companies, which go into lockdown mode the last two months of the year, when they don't update their systems," he said.

Twelve of the 16 bulletins are aimed at Windows, either the desktop or server editions, or in some cases both. Two from next week's slate affect Office -- Word and Excel, specifically -- and are likely patches for one or more file format vulnerabilities in those applications, said Storms.

One of the bulletins will address a problem in SharePoint, Microsoft's enterprise-grade collaboration server software. According to the advance notification, the SharePoint update will be related in some way to Office Web Apps, the online editions of Microsoft's Word, Excel, PowerPoint and OneNote applications.

Other than the sheer number of updates users will have to apply, Storms also noted that several apply to the newest versions of Microsoft's operating system, Windows 7 on the desktop and Windows Server 2008 R2 on the server side.

View the original article here