Adobe Readies Fix for Vulnerability as Attacks Continue

Adobe Systems will issue a patch later this week for a zero-day security vulnerability bug that it is currently being exploited by hackers

In an advisory 4 June, Adobe warned users that a vulnerability affecting Adobe Reader, Flash Player and Acrobat was actively being exploited by attackers. The bug exists in Flash Player 10.0.45.2 and earlier versions for Windows, Macintosh, Linux and Solaris as well as the authplay.dll component that ships with Adobe Reader and Acrobat 9.x for Windows, Mac and Unix operating systems.

Update On The Way

“We are in the process of finalising a fix for the issue, and expect to provide an update for Flash Player 10.x for Windows, Macintosh, and Linux by June 10, 2010,” according to Adobe. “The patch date for Flash Player 10.x for Solaris is still to be determined. We expect to provide an update for Adobe Reader and Acrobat 9.3.2 for Windows, Macintosh and UNIX by June 29, 2010.”

Exploiting the bug (CVE-2010-1297) could cause systems to crash and potentially allow attackers to execute code and take control of the affected system.

“We have confirmed that the attack involves Trojan.Pidief.J, which is a PDF file that drops a back door Trojan onto the compromised computer if an affected product is already installed,” blogged Joji Hamada, a researcher with Symantec Security Response. “We have also come across an attack using a malicious SWF file (detected as Trojan Horse) in conjunction with an HTML file (detected as Downloader) to download another malware (detected as Backdoor.Trojan) from the web.”

Brad Arkin, Adobe’s director of security and privacy, blogged that the company considered issuing a “one-off 0-day fix followed a couple of weeks later by the 13 July quarterly update” but decided against it due to concerns about causing churn and patch management overhead problems for Adobe customers.

Reader Safe

As a mitigation, users can delete, rename or remove access to the authplay.dll file in Adobe Reader and Acrobat 9.x, but doing so means they will experience a non-exploitable crash or error message when opening a PDF file that contains SWF content. The file is typically located at C:\Program Files\Adobe\Reader 9.0\Reader\authplay.dll for Adobe Reader or C:\Program Files\Adobe\Acrobat 9.0\Acrobat\authplay.dll for Acrobat, according to Adobe.

The Flash Player 10.1 Release Candidate does not appear to be vulnerable, and Adobe Reader and Acrobat 8.x have been confirmed to be unaffected.

Brian Prince eWEEK USA 2014. Ziff Davis Enterprise Inc. All Rights Reserved

Recent Posts

Australia Rejects Elon Musk Claim About Social Media Ban For Under-16s

Government minister flatly rejects Elon Musk's “unsurprising” allegation that Australian government seeks control of Internet…

2 hours ago

Northvolt Files For Bankruptcy Protection In US

Northvolt files for Chapter 11 bankruptcy protection in the United States, and CEO and co-founder…

4 hours ago

UK’s CMA Readies Cloud Sector “Behavioural” Remedies – Report

Targetting AWS, Microsoft? British competition regulator soon to announce “behavioural” remedies for cloud sector

19 hours ago

Former Policy Boss At X Nick Pickles, Joins Sam Altman Venture

Move to Elon Musk rival. Former senior executive at X joins Sam Altman's venture formerly…

22 hours ago

Bitcoin Rises Above $96,000 Amid Trump Optimism

Bitcoin price rises towards $100,000, amid investor optimism of friendlier US regulatory landscape under Donald…

23 hours ago

FTX Co-Founder Gary Wang Spared Prison

Judge Kaplan praises former FTX CTO Gary Wang for his co-operation against Sam Bankman-Fried during…

24 hours ago