Adobe warns of Flash Player zero-day attack

Summary:Malicious hackers are using rigged Microsoft Excel files to exploit a zero-day flaw in Adobe's ubiquitous Flash Player software.

Malicious hackers are using rigged Microsoft Excel files to exploit  a zero-day flaw in Adobe's ubiquitous Flash Player software.

A security advisory from Adobe says the "critical" vulnerability affects the latest versions of Adobe Flash Player for Windows, Mac OS X, Linux, Solaris and Chrome.   It also exists in the authplay.dll component that ships with Adobe Reader and Acrobat X.

"There are reports that this vulnerability is being exploited in the wild in very limited, targeted attacks via a Flash (.swf) file embedded in a Microsoft Excel (.xls) file and delivered as an email attachment," the company warned.

From Adobe's alert:

follow Ryan Naraine on twitter

This vulnerability (CVE-2011-0609) could cause a crash and potentially allow an attacker to take control of the affected system. There are reports that this vulnerability is being exploited in the wild in targeted attacks via a Flash (.swf) file embedded in a Microsoft Excel (.xls) file delivered as an email attachment. Adobe is not currently aware of attacks targeting Adobe Reader and Acrobat. Adobe Reader X Protected Mode mitigations would prevent an exploit of this kind from executing.

The company expects to ship a patch for Flash Player 10.x and earlier versions for Windows, Mac, Linux, Solaris and Android on March 21st.

On that date, a new version of Adobe Reader will also be released.

Because Adobe Reader X Protected Mode would prevent an exploit of this kind from executing, Adobe plans to fix the flaw in Adobe Reader X for Windows with the next quarterly security update for Adobe Reader, currently scheduled for June 14, 2011.

The user of embedded SWF (Flash) files in Microsoft Excel has prompted security experts to wonder why Microsoft's spreadsheet program needs to support Flash content.

Topics: Hardware, Browser, Enterprise Software, Linux, Open Source, Operating Systems, Security, Software, Windows

About

Ryan Naraine is a journalist and social media enthusiast specializing in Internet and computer security issues. He is currently security evangelist at Kaspersky Lab, an anti-malware company with operations around the globe. He is taking a leadership role in developing the company's online community initiative around secure content managem... Full Bio

zdnet_core.socialButton.googleLabel Contact Disclosure

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Related Stories

The best of ZDNet, delivered

You have been successfully signed up. To sign up for more newsletters or to manage your account, visit the Newsletter Subscription Center.
Subscription failed.