Adobe warns of Flash Player zero-day attack

Malicious hackers are using rigged Microsoft Excel files to exploit  a zero-day flaw in Adobe's ubiquitous Flash Player software.

A security advisory from Adobe says the "critical" vulnerability affects the latest versions of Adobe Flash Player for Windows, Mac OS X, Linux, Solaris and Chrome.   It also exists in the authplay.dll component that ships with Adobe Reader and Acrobat X.

"There are reports that this vulnerability is being exploited in the wild in very limited, targeted attacks via a Flash (.swf) file embedded in a Microsoft Excel (.xls) file and delivered as an email attachment," the company warned.

From Adobe's alert:

This vulnerability (CVE-2011-0609) could cause a crash and potentially allow an attacker to take control of the affected system. There are reports that this vulnerability is being exploited in the wild in targeted attacks via a Flash (.swf) file embedded in a Microsoft Excel (.xls) file delivered as an email attachment. Adobe is not currently aware of attacks targeting Adobe Reader and Acrobat. Adobe Reader X Protected Mode mitigations would prevent an exploit of this kind from executing.

The company expects to ship a patch for Flash Player 10.x and earlier versions for Windows, Mac, Linux, Solaris and Android on March 21st.

On that date, a new version of Adobe Reader will also be released.

Because Adobe Reader X Protected Mode would prevent an exploit of this kind from executing, Adobe plans to fix the flaw in Adobe Reader X for Windows with the next quarterly security update for Adobe Reader, currently scheduled for June 14, 2011.

The user of embedded SWF (Flash) files in Microsoft Excel has prompted security experts to wonder why Microsoft's spreadsheet program needs to support Flash content.