Adobe Releases Critical Security Advisory

Adobe has revealed that there is a critical zero day bug in its Flash Player, Acrobat and Adobe Reader applications. As well as potentially causing a crash, the bug could allow an attacker to remotely take control of a computer.

A zero day bug means big trouble for a software developer. It occurs where hackers have discovered a security hole in a program and are actively sharing ways to exploit it before developers know it exists. The term "Zero day" refers to the start of the period during which hackers are able to exploit the bug before the developers produce and distribute a fix, similar to critical patches distributed by Microsoft on Patch Tuesdays.

At the moment there is evidence hackers are exploiting the problem on Adobe Reader and Acrobat, but have not yet found a way to target the Flash Player. (Source: computerworld.com)

The bug is primarily associated with Flash. In Acrobat (which produces PDF files, or Portable Document Format files) and Adobe Reader (which reads PDF files), the problem only occurs where the PDF document contains some form of Flash content. Thankfully, this situation is rare.

PCs And Macs Both Affected by Security Hole

The problem appears on multiple operating machines:

• Adobe Flash Player 10.1.85.3 and earlier versions for Windows, Macintosh, Linux and Solaris operating systems.
   
• Adobe Flash Player 10.1.95.2 and earlier for Android.
   
• Adobe Reader 9.4 and earlier 9.x versions for Windows, Macintosh and UNIX (Those versions starting with an 8 are not affected. Neither is Adobe Reader for Android).
   
• Adobe Acrobat 9.4 and earlier 9.x versions for Windows and Macintosh (Those versions starting with an 8 are not affected).

Adobe is working on a fix and expects to have one ready for the Flash Player by November 9th and for Adobe Reader and Acrobat by the following week.

Temporary Workaround Available

In the meantime, Adobe has issued a simple fix that will block the problem from being exploited through Flash content in PDF files, though this may cause a crash or error message when those files are opened.

In Windows, users need to move, rename or delete a file titled authplay.dll, typically located in C:\ Program Files\ Adobe\ Reader 9.0\ Reader\ authplay.dll. Mac users need to delete or move a file named AuthPlayLib.bundle, while Linux system users should remove a library named libauthplay.so.0.0.0. (Source: adobe.com)