Summary:
$1· This vulnerability affects: Adobe Flash Player running on all platforms and Adobe Air
$1· How an attacker exploits it: By enticing users to visit a website containing malicious Flash content
· Impact: In the worst case, an attacker can execute code on the user's computer, potentially gaining control of it
· What to do: Download and install the latest version of Adobe Flash Player for your platform
Exposure:
Adobe Flash Player displays interactive, animated web content called Flash. Although Flash is optional, 99% of PC users download and install it to view multimedia web content. It runs on many operating systems, including mobile operating systems like Android.
This week, Adobe released a security bulletin describing four security vulnerabilities (based on CVE numbers) that affect Flash Player running on any platform. It doesn’t describe the flaws in much technical detail, other than saying they consist mostly of buffer overflow vulnerabilities and other types of memory corruption flaws (and a cross-site scripting issue). That said, Adobe does warn that if an attacker can entice one of your users to visit a malicious website containing specially crafted Flash content, he could exploit many of these unspecified vulnerabilities to execute code on that user’s computer, with that user’s privileges. If your Windows users have local administrator privileges, an attacker could exploit this flaw to gain full control of their PCs.
Though it doesn't look like attackers are exploiting these flaws in the wild yet, Adobe rates the flaws as a "Priority 1" issues for Windows and Macintosh users, and recommends you apply the updates within 72 hours. These vulnerabilities also affect other platforms as well, such as Internet Explorer (IE) 11 and Chrome. I recommend you update any Flash capable platform as soon as you can.
Solution Path
Adobe has released new versions of Flash Player to fix these issues. If you allow Adobe Flash in your network, you should download and install the new versions immediately. If you've enabled Flash Player's recent "silent update" option, you will receive this update automatically.
You can download Flash for your computer at the link provided below. See the bulletin's "Affected Software" section for more details on getting Flash updates for other platforms:
Keep in mind, if you use Google Chrome or IE 11, you'll have to update it seperately.
Status:
Adobe has released updates to fix these Flash vulnerabilities.
