Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2011.0319
Security updates available for Adobe Reader and Acrobat
22 March 2011
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Reader 9
Reader X (10.x)
Acrobat 9
Acrobat X (10.x)
Operating System: Windows
Mac OS X
Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2011-0609
Reference: ESB-2011.0295.2
Original Bulletin:
http://www.adobe.com/support/security/bulletins/apsb11-06.html
- --------------------------BEGIN INCLUDED TEXT--------------------
Security updates available for Adobe Reader and Acrobat
Release date: March 21, 2011
Vulnerability identifier: APSB11-06
CVE number: CVE-2011-0609
Platform: Windows and Macintosh
Summary
A critical vulnerability has been identified in the authplay.dll
component that ships with Adobe Reader and Acrobat X (10.0.1) and
earlier 10.x and 9.x versions for Windows and Macintosh operating
systems. This vulnerability (CVE-2011-0609), as referenced in
Security Advisory APSA11-01, could cause a crash and potentially
allow an attacker to take control of the affected system. There are
reports that this vulnerability is being exploited in the wild in
targeted attacks via a Flash (.swf) file embedded in a Microsoft Excel
(.xls) file delivered as an email attachment. At this time, Adobe is
not aware of attacks targeting Adobe Reader and Acrobat. Adobe Reader
X Protected Mode mitigations would prevent an exploit of this kind
from executing.
Adobe recommends users of Adobe Reader X (10.0.1) for Macintosh update
to Adobe Reader X (10.0.2). For users of Adobe Reader 9.4.2 for
Windows and Macintosh, Adobe has made available the update, Adobe
Reader 9.4.3. Adobe recommends users of Adobe Acrobat X (10.0.1) for
Windows and Macintosh update to Adobe Acrobat X (10.0.2). Adobe
recommends users of Adobe Acrobat 9.4.2 for Windows and Macintosh
update to Adobe Acrobat 9.4.3. Because Adobe Reader X Protected Mode
would prevent an exploit of this kind from executing, we are planning
to address this issue in Adobe Reader X for Windows with the next
quarterly security update for Adobe Reader, currently scheduled for
June 14, 2011.
(Note: Adobe Reader 9.x for UNIX, Adobe Reader for Android, and Adobe
Reader and Acrobat 8.x are not affected by this issue.)
The next quarterly security updates for Adobe Reader and Acrobat are
currently scheduled for June 14, 2011. Today's security updates are
out-of-cycle updates.
Affected software versions
The Authplay.dll component that ships with Adobe Reader and Acrobat X
(10.0.1) and earlier 10.x and 9.x versions for Windows and Macintosh
operating systems
NOTE: Adobe Reader 9.x for UNIX, Adobe Reader for Android, and Adobe
Reader and Acrobat 8.x are not affected by this issue.
Solution
Adobe recommends users update their software installations by
following the instructions below:
Adobe Reader
Users on Windows and Macintosh can utilize the product's update
mechanism. The default configuration is set to run automatic update
checks on a regular schedule. Update checks can be manually activated
by choosing Help > Check for Updates.
Adobe Reader 9.x users on Windows can also find the appropriate update
here:
http://www.adobe.com/support/downloads/product.jsp?product=10&platform=Windows.
Adobe Reader users on Macintosh can also find the appropriate update
here:
http://www.adobe.com/support/downloads/product.jsp?product=10&platform=Macintosh.
Because Adobe Reader X Protected Mode would prevent an exploit of this
kind from executing, we are planning to address this issue in Adobe
Reader X for Windows with the next quarterly security update for Adobe
Reader, currently scheduled for June 14, 2011
Adobe Acrobat
Users can utilize the product's update mechanism. The default
configuration is set to run automatic update checks on a regular
schedule. Update checks can be manually activated by choosing Help >
Check for Updates.
Acrobat Standard and Pro users on Windows can also find the
appropriate update here:
http://www.adobe.com/support/downloads/product.jsp?product=1&platform=Windows.
Acrobat Pro Extended users on Windows can also find the appropriate
update here:
http://www.adobe.com/support/downloads/product.jsp?product=158&platform=Windows.
Acrobat Pro users on Macintosh can also find the appropriate update
here:
http://www.adobe.com/support/downloads/product.jsp?product=1&platform=Macintosh.
Severity rating
Adobe categorizes these as critical updates and recommends that
users apply the latest updates for their product installations by
following the instructions in the "Solution" section above.
Details
A critical vulnerability has been identified in the authplay.dll
component that ships with Adobe Reader and Acrobat X (10.0.1) and
earlier 10.x and 9.x versions for Windows and Macintosh operating
systems. This vulnerability (CVE-2011-0609), as referenced in
Security Advisory APSA11-01, could cause a crash and potentially
allow an attacker to take control of the affected system. There are
reports that this vulnerability is being exploited in the wild in
targeted attacks via a Flash (.swf) file embedded in a Microsoft Excel
(.xls) file delivered as an email attachment. At this time, Adobe is
not aware of attacks targeting Adobe Reader and Acrobat. Adobe Reader
X Protected Mode mitigations would prevent an exploit of this kind
from executing.
Adobe recommends users of Adobe Reader X (10.0.1) for Macintosh update
to Adobe Reader X (10.0.2). For users of Adobe Reader 9.4.2 for
Windows and Macintosh, Adobe has made available the update, Adobe
Reader 9.4.3. Adobe recommends users of Adobe Acrobat X (10.0.1) for
Windows and Macintosh update to Adobe Acrobat X (10.0.2). Adobe
recommends users of Adobe Acrobat 9.4.2 for Windows and Macintosh
update to Adobe Acrobat 9.4.3. Because Adobe Reader X Protected Mode
would prevent an exploit of this kind from executing, we are planning
to address this issue in Adobe Reader X for Windows with the next
quarterly security update for Adobe Reader, currently scheduled for
June 14, 2011.
(Note: Adobe Reader 9.x for UNIX, Adobe Reader for Android, and Adobe
Reader and Acrobat 8.x are not affected by this issue.)
This update resolves a memory corruption vulnerability that could lead
to code execution (CVE-2011-0609).
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: https://www.auscert.org.au/1967
iD8DBQFNiBfn/iFOrG6YcBERAkJ4AKCiyynM3c73aFLIZ8v6Os/+eYb7QACgnH1j
QARVf7l0kEGsIRHrBCAbRvo=
=mWkk
-----END PGP SIGNATURE-----