Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2010.0524
Security update available for Adobe Flash Player
11 June 2010
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Adobe Flash Player
Adobe AIR
Publisher: Adobe
Operating System: Windows
Linux variants
Mac OS X
Solaris
Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction
Denial of Service -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2010-2189 CVE-2010-2188 CVE-2010-2187
CVE-2010-2186 CVE-2010-2185 CVE-2010-2184
CVE-2010-2183 CVE-2010-2182 CVE-2010-2181
CVE-2010-2180 CVE-2010-2179 CVE-2010-2178
CVE-2010-2177 CVE-2010-2176 CVE-2010-2175
CVE-2010-2174 CVE-2010-2173 CVE-2010-2172
CVE-2010-2171 CVE-2010-2170 CVE-2010-2169
CVE-2010-2167 CVE-2010-2166 CVE-2010-2165
CVE-2010-2164 CVE-2010-2163 CVE-2010-2162
CVE-2010-2161 CVE-2010-2160 CVE-2010-1297
CVE-2009-3793 CVE-2008-4546
Reference: ASB-2010.0139
Original Bulletin:
http://www.adobe.com/support/security/bulletins/apsb10-14.html
- --------------------------BEGIN INCLUDED TEXT--------------------
Security update available for Adobe Flash Player
Release date: June 10, 2010
Vulnerability identifier: APSB10-14
CVE number: CVE-2008-4546, CVE-2009-3793, CVE-2010-1297, CVE-2010-2160,
CVE-2010-2161, CVE-2010-2162, CVE-2010-2163, CVE-2010-2164, CVE-2010-2165,
CVE-2010-2166, CVE-2010-2167, CVE-2010-2169, CVE-2010-2170, CVE-2010-2171,
CVE-2010-2172, CVE-2010-2173, CVE-2010-2174, CVE-2010-2175, CVE-2010-2176,
CVE-2010-2177, CVE-2010-2178, CVE-2010-2179, CVE-2010-2180, CVE-2010-2181,
CVE-2010-2182, CVE-2010-2183, CVE-2010-2184, CVE-2010-2185, CVE-2010-2186,
CVE-2010-2187, CVE-2010-2188, CVE-2010-2189
Platform: All Platforms Summary
Critical vulnerabilities have been identified in Adobe Flash Player version
10.0.45.2 and earlier. These vulnerabilities could cause the application to
crash and could potentially allow an attacker to take control of the affected
system.
Adobe recommends users of Adobe Flash Player 10.0.45.2 and earlier versions
update to Adobe Flash Player 10.1.53.64. Adobe recommends users of Adobe AIR
1.5.3.9130 and earlier versions update to Adobe AIR 2.0.2.12610. Affected
software versions
Adobe Flash Player 10.0.45.2 and earlier versions for Windows, Macintosh,
Linux and Solaris Adobe AIR 1.5.3.9130 and earlier versions for Windows,
Macintosh and Linux
To verify the Adobe Flash Player version number installed on your system,
access the About Flash Player page, or right-click on content running in Flash
Player and select "About Adobe (or Macromedia) Flash Player" from the menu. If
you use multiple browsers, perform the check for each browser you have
installed on your system.
To verify the Adobe AIR version number installed on your system, access the
Adobe AIR TechNote for instructions. Solution
Adobe Flash Player Adobe recommends all users of Adobe Flash Player 10.0.45.2
and earlier versions upgrade to the newest version 10.1.53.64 by downloading
it from the Adobe Flash Player Download Center or by using the auto-update
mechanism within the product when prompted.
To address the vulnerabilities described in this Security Bulletin, a
prerelease version of Flash Player 10.1 for Solaris platforms is available
from Adobe Labs.
For users who cannot update to Flash Player 10.1.53.64, Adobe has developed a
patched version of Flash Player 9, Flash Player 9.0.277.0, which can be
downloaded from the following link.
Adobe AIR Adobe recommends all users of Adobe AIR 1.5.3.9130 and earlier
versions update to the newest version 2.0.2.12610 by downloading it from the
Adobe AIR Download Center. Severity rating
Adobe categorizes this as a critical update and recommends affected users
update their installations to the newest versions. Details
Critical vulnerabilities have been identified in Adobe Flash Player version
10.0.45.2 and earlier. These vulnerabilities could cause the application to
crash and could potentially allow an attacker to take control of the affected
system.
This update resolves a memory corruption vulnerability that could lead to code
execution (CVE-2010-1297). Note: There are reports that this issue is being
actively exploited in the wild.
This update resolves a memory exhaustion vulnerability that could lead to code
execution (CVE-2009-3793).
This update resolves a memory corruption vulnerability that could lead to code
execution (CVE-2010-2160).
This update resolves an indexing vulnerability that could lead to code
execution (CVE-2010-2161).
This update resolves a heap corruption vulnerability that could lead to code
execution (CVE-2010-2162).
This update resolves multiple vulnerabilities that could lead to code
execution (CVE-2010-2163).
This update resolves a use after free vulnerability that could lead to code
execution (CVE-2010-2164).
This update resolves a memory corruption vulnerability that could lead to code
execution (CVE-2010-2165).
This update resolves a memory corruption vulnerability that could lead to code
execution (CVE-2010-2166).
This update resolves multiple heap overflow vulnerabilities that could lead to
code execution (CVE-2010-2167).
This update resolves a pointer memory corruption that could lead to code
execution (CVE-2010-2169).
This update resolves an integer overflow vulnerability that could lead to code
execution (CVE-2010-2170).
This update resolves a memory corruption vulnerability that could lead to code
execution (CVE-2010-2171).
This update resolves a denial of service issue on some UNIX platforms (Flash
Player 9 only) (CVE-2010-2172).
This update resolves an invalid pointer vulnerability that could lead to code
execution (CVE-2010-2173).
This update resolves an invalid pointer vulnerability that could lead to code
execution (CVE-2010-2174).
This update resolves a memory corruption vulnerability that could lead to code
execution (CVE-2010-2175).
This update resolves a memory corruption vulnerability that could lead to code
execution (CVE-2010-2176).
This update resolves a memory corruption vulnerability that could lead to code
execution (CVE-2010-2177).
This update resolves a memory corruption vulnerability that could lead to code
execution (CVE-2010-2178).
This update resolves a URL parsing vulnerability that could lead to cross-site
scripting (Firefox and Chrome browsers only) (CVE-2010-2179).
This update resolves a memory corruption vulnerability that could lead to code
execution (CVE-2010-2180).
This update resolves an integer overflow vulnerability that could lead to code
execution (CVE-2010-2181).
This update resolves a memory corruption vulnerability that could lead to code
execution (CVE-2010-2182).
This update resolves a integer overflow vulnerability that could lead to code
execution (CVE-2010-2183).
This update resolves a memory corruption vulnerability that could lead to code
execution (CVE-2010-2184).
This update resolves a buffer overflow vulnerability that could lead to code
execution (CVE-2010-2185).
This update resolves a denial of service vulnerability that can cause the
application to crash. Arbitrary code execution has not been demonstrated, but
may be possible. (CVE-2010-2186).
This update resolves a memory corruption vulnerability that could lead to code
execution (CVE-2010-2187).
This update resolves a memory corruption vulnerability that could lead to code
execution (CVE-2010-2188).
This update resolves a memory corruption vulnerability that could lead to code
execution (CVE-2010-2189). Note: This issue occurs only on VMWare systems with
VMWare Tools enabled.
This update resolves a denial of service issue (CVE-2008-4546).
Adobe recommends users of Adobe Flash Player 10.0.45.2 and earlier versions
update to Adobe Flash Player 10.1.53.64. Adobe recommends users of Adobe AIR
1.5.3.9130 and earlier versions update to Adobe AIR 2.0.2.12610.
Affected software
Recommended player update
Availability
Flash Player 10.0.45.2 and earlier
10.1.53.64
Flash Player Download Center
Flash Player 10.0.45.2 and earlier - network distribution
10.1.53.64
Flash Player Licensing
AIR 1.5.3.9130
AIR 2.0.2.12610
AIR Download Center
Flash Professional CS5, Flash CS4 Professional and Flex 4
10.1.53.64
Flash Player Support Center
Flash CS3 Professional and Flex 3
9.0.277.0
Flash Player Support Center
Note: The Adobe Flash Player 10.1.53.64 release will be the last version to
support Macintosh PowerPC-based G3 computers. Adobe will be discontinuing
support of PowerPC-based G3 computers and will no longer provide security
updates after the Flash Player 10.1.53.64 release. This unavailability is due
to performance enhancements that cannot be supported on the older PowerPC
architecture. Acknowledgments
Adobe would like to thank the following individuals and organizations for
reporting the relevant issues and for working with Adobe to help protect our
customers:
* Will Dormann of CERT (CVE-2010-1297, CVE-2010-2163)
* Ralph Loader of Innaworks Development Limited (CVE-2009-3793)
* An Anonymous Researcher and Dionysus Blazakis through TippingPoint's Zero
Day Initiative (CVE-2010-2160)
* An Anonymous Researcher reported through iDefense's Vulnerability
Contributor Program (CVE-2010-2161)
* Damian Put through TippingPoint's Zero Day Initiative (CVE-2010-2162,
CVE-2010-2188) * An Anonymous Researcher reported through iDefense's
Vulnerability Contributor Program (CVE-2010-2164)
* Megumi Yanagishita of Palo Alto Networks Inc. (CVE-2010-2165)
* Bing Liu of Fortinet's FortiGuard Labs (CVE-2010-2163, CVE-2010-2166)
* Nicolas Joly of VUPEN Vulnerability Research Team (CVE-2010-2167,
CVE-2010-2173, CVE-2010-2174)
* Manuel Caballero and Microsoft Vulnerability Research (MSVR)
(CVE-2010-2169)
* Tielei Wang from ICST-ERCIS (Engineering Research Center of
Info Security, Institute of Computer Science & Technology, Peking
University / China) (CVE-2010-2170)
* An Anonymous Researcher and Tielei Wang, from ICST-ERCIS, Peking University,
through TippingPoint's Zero Day Initiative (CVE-2010-2171)
* Report submitted by Red Hat Security Response Team (CVE-2010-2172)
* Bo Qu of Palo Alto Networks (CVE-2010-2175, CVE-2010-2176, CVE-2010-2177,
CVE-2010-2178) * Ezio Anselmo Mazarim Fernandes (CVE-2010-2179)
* Haifei Li of Fortinet's FortiGuard Labs (CVE-2010-2189)
* Tavis Ormandy of the Google Security Team (CVE-2010-2163, CVE-2010-2180,
CVE-2010-2181, CVE-2010-2182, CVE-2010-2183, CVE-2010-2184, CVE-2010-2185,
CVE-2010-2186, CVE-2010-2187).
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
If you believe that your computer system has been compromised or attacked in
any way, we encourage you to let us know by completing the secure National IT
Incident Reporting Form at:
http://www.auscert.org.au/render.html?it=3192
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iD8DBQFMEWpZ/iFOrG6YcBERAhObAKDWEZseJStjU8cZWJWAC49rJepf2wCffxsB
nw0XegA6h81jWLtUpHwv5WY=
=H7IQ
-----END PGP SIGNATURE-----