Adobe has identified another “vulnerability” in Adobe Flash Player which could lead to unauthorized remote access if it is not properly patched.

Another Adobe Flash Vulnerability Found

On April 11, Adobe announced that malicious hackers had been taking advantage of the vulnerability through the use of Microsoft Word. Like the previous “Zero Day” exploit, the hackers utilized the Word document with the embedded exploit by emailing the file as an attachment to random targets. Then, if executed, the exploit systematically crashes the infected system and the hackers are free to take control.

Adobe has also confirmed that the same vulnerability exists in the Adobe Reader and Acrobat applications as well (its not exclusive to Adobe Flash) although there have been no recorded attempts by hackers to utilize these additional programs.

The aforementioned vulnerability is nearly identical to one taken advantage of in late March (with exception to its use of an Excel file), in which hackers used a similar exploit to attack RSA security. The hackers were targeting RSA’s SecurID authentication platform and were likely aiming to identify more vulnerabilities in their buffed up security. For more information check out our news article on the “Zero Day” exploit.

There has been no word yet of any serious issues with the latest Adobe Flash vulnerability besides the fact that it exists.

Keep in mind that the subject line in most viruses and exploits changes over time; but the particular email with the above exploit attached has been seen labeled “Disentangling Industrial Policy and Competition in China.” The idea is that the email and attached file (of the same name) would reveal important information on China’s Anti-monopoly law.

The Antitrust Source (a legal relevance news publication) recently released a similar article that is available via their site or email through a newsletter for subscribers. The original article is attributed to why anyone would fall prey to such an exploit; because they are mistaking the email for a legitimate publication.

Adobe is set to fix the vulnerabilities through the use of a sandbox feature which runs the native application in an external system emulation or “sandbox” that prevents such exploits from executing.

Affected Adobe Flash and Application Versions

According to Adobe the affected versions include Adobe Flash Player 10, Adobe Reader 9 and Adobe Reader X (Windows, Mac). All Adobe applications affected with the vulnerability will see a patch soon with exception to Adobe Reader X. The reason for X’s exclusion as detailed by Adobe is because “Adobe Reader X Protected Mode would prevent an exploit of this kind from executing, we are currently planning to address this issue in Adobe Reader X for Windows with the next quarterly security update for Adobe Reader, currently scheduled for June 14, 2011.”

Adobe software versions not affected by this vulnerability include Adobe Reader 9.x for UNIX, Adobe Reader for Android, and Adobe Reader and Acrobat 8.

All things considering Adobe has handled the recent security issues with Adobe Flash well by responding quickly with proper patches and updates.  Adobe has also identified all vulnerabilities and problems publicly which has ultimately helped reduce those affected by the attacks.

It should also be noted that since all attacks were taken advantage of using external applications and programs there is no immediate threat from the individual Adobe applications by themselves. In fact, if proper security protocol is used (which includes using extreme caution when opening ALL attachments in emails) there is little to no threat at all with any application.

It seems in most cases, especially in the case of RSA Security, educating employees on proper internet safety would do wonders. The “Zero Day” Adobe Flash vulnerability didn’t seem to be the most relevant issue.

Adobe Flash Vulnerabilities and Security Issues

How do you feel after reading news about the latest Adobe Flash and Adobe application vulnerabilities? Do you believe these security issues are overrated? Care to discuss the symantics of internet and computer based security? Please join the discussion and let us know your thoughts and opinions in the dedicated Adobe Vulnerability thread.