Two Critical Vulnerabilities In Adobe Software

September 16, 2010

Within the space of a week, Adobe has come out with two separate security vulnerabilities that it has labeled "critical." The first affects Reader and Acrobat, while the second affects Flash Player.

The first vulnerability (CVE-2010-2883) affects Reader 9.3.4 and earlier on Windows, Macintosh, and UNIX, and also affects Acrobat 9.3.4 and earlier on Windows and Macintosh. The other vulnerability (CVE-2010-2884) affects the same systems listed above as well as Flash Player 10.1.82.76 and earlier on Windows, Macintosh, Linux, and Solaris, and Flash Player 10.1.92.10 for Android Mobile Operating System. According to the advisories, these programs can crash and give control of the system to an attacker. There are currently reports of both exploits being taken advantage of in the wild, but only against Windows machines at this time. The flash patch would be limited to the Flash Player, if not for the fact that flash content can be played in both Reader and Acrobat. Because of this, all three programs must receive the patch.

Adobe is currently working on patches for both of these vulnerabilities and has already announced when they should be available. CVE-2010-2883 will have a patch that will be ready for release in three weeks, while the patch for CVE-2010-2883 will be ready in two weeks. Adobe's quarterly security updates were scheduled to be released on October 12, but since that is only a few weeks after the release of both of these patches, they have announced that there will be no further updates released on that date.

While we wait for these patches to come along, Adobe recommends Microsoft's Enhanced Mitigation Evaluation Toolkit to help prevent exploitation. They also recommend keeping anti-virus and anti-malware software up to date, as they have been actively sharing information with their partners in the security community.

View more news