Adobe promises patch for seven-month old Flash and Reader flaw

From InfoWorld: Adobe Systems Inc. late Wednesday admitted its Flash and Reader software have a critical vulnerability and promised it would patch both next week.

One security researcher, however, said Adobe's own bug-tracking database shows that the company has known of the vulnerability for nearly seven months.

In a security advisory posted around 10 p.m. Eastern time Wednesday, Adobe acknowledged that earlier reports were on target. "A critical vulnerability exists in the current versions of Flash Player (v9.0.159.0 and v10.0.22.87) for Windows, Macintosh and Linux operating systems, and the authplay.dll component that ships with Adobe Reader and Acrobat v9.x for Windows, Macintosh and UNIX operating systems," the company said.

The "authplay.dll" mentioned in the advisory is the interpreter that handles Flash content embedded within PDF files, and is present on any machine equipped with Reader and Acrobat.

Adobe said it would patch all versions of Flash by July 30, and Reader and Acrobat for Windows and Mac no later than July 31. Until a patch is available, Adobe said users could delete or rename authplay.dll, or disable Flash rendering to stymie attacks within malformed PDF files. Adobe did not offer any similar workaround for Flash and could only recommend that "users should exercise caution in browsing untrusted websites."

View: Article @ Source Site