Adobe patches exploited Flash bugs

Gregg Keizer
24 September, 2011
View more articles fromthe author

Adobe this week has patched six vulnerabilities in Flash Player, including one it admitted is already being exploited by attackers.

Adobe labeled CVE-2011-2444 as a cross-site scripting (XSS) vulnerability, a class of bugs often used by identity thieves to steal usernames and passwords from vulnerable browsers. In this case, browsers were not directly targeted; rather, attackers exploited the ubiquitous Flash Player browser plug-in.

Like the June Flash bug, CVE-2011-2444 was reported to Adobe by Google’s security team.

Adobe also used almost identical phrasing to describe both CVE-2011-2444 and the June vulnerability in its security advisories.

“There are reports that this vulnerability is being exploited in the wild in active targeted attacks designed to trick the user into clicking on a malicious link delivered in an email message,” said Adobe in the most recent advisory as well as the one it published in June. “This universal cross-site scripting issue could be used to take actions on a user’s behalf on any website or webmail provider, if the user visits a malicious website.”

Adobe declined to comment on how the CVE-2011-2444 vulnerability was being exploited and instead referred questions to Google. The latter did not immediately reply to an emailed query.

Four of the five other Flash bugs that Adobe patched could be exploited by attackers to run their malicious code on victimised computers, Adobe said in its advisory.

This week’s  Flash update was the first since Adobe patched 13 bugs on August 9. Adobe has fixed Flash eight times so far this year, including several emergency, or ‘out-of-band,’ updates rushed to users because attacks were under way.

The patched versions of Flash Player for Windows, Mac, Linux and Solaris can be downloaded from Adobe’s Web site. Alternately, users can run Flash’s update tool or wait for the software to prompt them that a new version is available.

Android users must browse to the Android Market to update Flash.

Google silently updated its Chrome browser on Tuesday to include the patched version of Flash Player. Google has been including Flash with Chrome since April 2010, and remains the only browser maker to bundle the plug-in with its own releases.

Leave a Comment

Please keep your comments friendly on the topic.

Contact us