Chris Mosby at myITforum.com

CVE-2010-3654 - New dangerous 0-day authplay library adobe products vulnerability

Share |

Published: 2010-10-28,
Last Updated: 2010-10-28 21:51:01 UTC
by Manuel Humberto Santander Pelaez (Version: 1)

4 comment(s)

Adobe released today APSA10-05 advisory, which shows a 0-day vulnerability that can be exploited remotely for Adobe Flash Player, Adobe Reader and Acrobat. Adobe says the update will exist hopefully by the Nov 15 week.

The following are the mitigation measures recommended by adobe:

Adobe Reader and Acrobat 9.x - Windows
Deleting, renaming, or removing access to the authplay.dll file that ships with Adobe Reader and Acrobat 9.x mitigates the threat for those products, but users will experience a non-exploitable crash or error message when opening a PDF file that contains Flash (SWF) content.

The authplay.dll that ships with Adobe Reader and Acrobat 9.x for Windows is typically located at C:Program FilesAdobeReader 9.0Readerauthplay.dll for Adobe Reader or C:Program FilesAdobeAcrobat 9.0Acrobatauthplay.dll for Acrobat.

Adobe Reader 9.x - Macintosh
1) Go to the Applications->Adobe Reader 9 folder.
2) Right Click on Adobe Reader.
3) Select Show Package Contents.
4) Go to the Contents->Frameworks folder.
5) Delete or move the AuthPlayLib.bundle file.

Acrobat Pro 9.x - Macintosh
1) Go to the Applications->Adobe Acrobat 9 Pro folder.
2) Right Click on Adobe Acrobat Pro.
3) Select Show Package Contents.
4) Go to the Contents->Frameworks folder.
5) Delete or move the AuthPlayLib.bundle file.

Adobe Reader 9.x - UNIX
1) Go to installation location of Reader (typically a folder named Adobe).
2) Within it browse to Reader9/Reader/intellinux/lib/ (for Linux) or Reader9/Reader/intelsolaris/lib/ (for Solaris).
3) Remove the library named "libauthplay.so.0.0.0."

More information at http://contagiodump.blogspot.com/2010/10/potential-new-adobe-flash-player-zero.html

-- Manuel Humberto Santander Peláez | http://twitter.com/manuelsantander | http://manuel.santander.name | msantand at isc dot sans dot org

********************************************************************

Title: Microsoft Security Bulletin Minor Revisions

Issued: October 13, 2010

********************************************************************

Summary

=======

The following bulletins have undergone a minor revision increment.

Please see the appropriate bulletin for more details.

  * MS10-082 - Important

  * MS10-079 - Important

  * MS10-077 - Critical

  * MS10-072 - Important

  * MS10-071 - Critical

  * MS10-070 - Important

Bulletin Information:

=====================

* MS10-082 - Important

  - http://www.microsoft.com/technet/security/bulletin/ms10-082.mspx

  - Reason for Revision: V1.1 (October 13, 2010): Corrected the

    download link in the Affected Software table for Windows

    Media Player 11 on Windows XP Professional x64 Edition

    Service Pack 2. 

  - Originally posted: October 12, 2010

  - Updated: October 13, 2010

  - Bulletin Severity Rating: Important

  - Version: 1.1

* MS10-079 - Important

  - http://www.microsoft.com/technet/security/bulletin/ms10-079.mspx

  - Reason for Revision: V1.1 (October 13, 2010): Corrected the

    package name for the Microsoft Office Compatibility Pack

    (KB2345043) update. This is an informational change only.

    Customers who have already successfully updated their systems

    do not need to take any action. 

  - Originally posted: October 12, 2010

  - Updated: October 13, 2010

  - Bulletin Severity Rating: Important

  - Version: 1.1

* MS10-077 - Critical

  - http://www.microsoft.com/technet/security/bulletin/ms10-077.mspx

  - Reason for Revision: V1.1 (October 13, 2010): Changed the

    vulnerability severity rating for Windows Server 2008 and

    Windows Server 2008 R2 to Important. Also added a link to

    Microsoft Knowledge Base Article 2160841 under Known Issues

    in the Executive Summary, and revised the vulnerability mitigations. 

  - Originally posted: October 12, 2010

  - Updated: October 13, 2010

  - Bulletin Severity Rating: Critical

  - Version: 1.1

* MS10-072 - Important

  - http://www.microsoft.com/technet/security/bulletin/ms10-072.mspx

  - Reason for Revision: V1.1 (October 13, 2010): Added a link to

    Microsoft Knowledge Base Article 2412048 under Known Issues

    in the Executive Summary. 

  - Originally posted: October 12, 2010

  - Updated: October 13, 2010

  - Bulletin Severity Rating: Important

  - Version: 1.1

* MS10-071 - Critical

  - http://www.microsoft.com/technet/security/bulletin/ms10-071.mspx

  - Reason for Revision: V1.1 (October 13, 2010): Corrected the

    update package names for Internet Explorer in the Windows

    Server 2008 deployment reference table. This is an

    informational change only. Customers who have already

    successfully updated their systems do not need to take any action. 

  - Originally posted: October 12, 2010

  - Updated: October 13, 2010

  - Bulletin Severity Rating: Critical

  - Version: 1.1

* MS10-070 - Important

  - http://www.microsoft.com/technet/security/bulletin/ms10-070.mspx

  - Reason for Revision: V2.1 (October 13, 2010): Added three update

    FAQs to clarify affected software. 

  - Originally posted: September 28, 2010

  - Updated: October 13, 2010

  - Bulletin Severity Rating: Important

  - Version: 2.1

oooo now this should be fun!  16 patches out next week…

On October 12, 2010, Microsoft is planning to release sixteen (16) new security bulletins. Below is a summary.

New Bulletin Summary

Although we do not anticipate any changes, the number of bulletins, products affected, restart information, and severities are subject to change until released.

Advance Notification Webpage: The full version of the Microsoft Security Bulletin Advance Notification for this month can be found at http://www.microsoft.com/technet/security/bulletin/ms10-oct.mspx.

Microsoft Windows Malicious Software Removal Tool: Microsoft will release an updated version of the Microsoft Windows Malicious Software Removal Tool on Windows Update, Microsoft Update, Windows Server Update Services, and the Download Center.

Monthly Security Bulletin Webcast: To address customer questions on these bulletins Microsoft will host a webcast next Wednesday, October 13, 2010, at 11:00 A.M. Pacific Time (U.S. and Canada). Registration for this event and other details can be found at http://www.microsoft.com/technet/security/bulletin/summary.mspx.

Adobe Product Security Incident Response Team (PSIRT) Blog /

Security updates released for Adobe Reader and Acrobat

by David Lenoe

Created

October 5, 2010

Today, a Security Bulletin has been posted in regards to this quarter’s security updates for Adobe Reader and Acrobat. The updates address critical security issues in the products, including CVE-2010-2883 referenced in Security Advisory APSA10-02 and CVE-2010-2884 referenced in the Adobe Flash Player Security Bulletin APSB10-22. Adobe recommends that users apply the updates for their product installations.

Note that today’s updates represent an accelerated release of the quarterly security update originally scheduled for October 12, 2010. With this accelerated schedule, Adobe will not release additional updates for Adobe Reader and Acrobat on October 12, 2010. The next quarterly security updates for Adobe Reader and Acrobat are scheduled for February 8, 2011.

This posting is provided “AS IS” with no warranties and confers no rights.

Adobe Product Security Incident Response Team (PSIRT) Blog /

Prenotification: Quarterly Security Updates for Adobe Reader and Acrobat

by Wendy Poland

Created

September 30, 2010

A prenotification Security Advisory has been posted in regards to the upcoming quarterly Adobe Reader and Acrobat updates scheduled for October 5, 2010. The updates will address critical security issues in the products, including CVE-2010-2883 referenced in Security Advisory APSA10-02 and CVE-2010-2884 referenced in the Adobe Flash Player Security Bulletin APSB10-22. These security updates will be made available for Windows, Macintosh and UNIX.

Note that the October 5, 2010 updates represent an accelerated release of the next quarterly security update originally scheduled for October 12, 2010. With this accelerated schedule, Adobe will not release additional updates for Adobe Reader and Acrobat on October 12, 2010.

We will continue to provide updates on the upcoming release via the Security Advisory section of the Adobe website as well as the Adobe PSIRT blog.

This posting is provided “AS IS” with no warranties and confers no rights.