Gladiator Research and Security

GSA Reference Number: AD110412-01

Simply Put: Adobe has released a new security advisory regarding a critical vulnerability in Adobe Flash Player, Reader, and Acrobat.  The vulnerability could cause the programs to crash and possibly allow remote code execution.  These vulnerabilities are reportedly being exploited by malware authors at this time.  The attacks are being delivered in Word documents as email attachments.  No patch is available at this time.  Gladiator recommends that institutions inform their users of this threat and tell them not to open any Word document attachments without checking with their information security officer.

GSA Reference Number: AD101117-01

Simply Put: Adobe has released an update for Adobe Acrobat and Reader versions 9.4 and earlier. This update fixes a publicly disclosed vulnerability that is currently being used to attack systems on the Internet.  This is a critical issue, and the patch should be applied as soon as possible.

GSA Reference Number: AD100607-01

Simply Put: Adobe has released an advisory for a critical vulnerability in Adobe Flash.  Adobe Reader and Acrobat are also exploitable through the authplay.dll component included with Adobe Reader and Acrobat 9.x.  This vulnerability can lead to remote code execution and are already the target of malware authors.  No patch is available at this time.  However, Adobe has provided workarounds in its advisory.

GSA Reference Number: AD091209-01

Simply Put: Adobe has released a critical patch to address seven security vulnerabilities regarding its Flash Player and Adobe Air products. Flash is used on most websites for active content, such as animated or interactive menus and images, and movies.  Adobe Air allows users to run active web content outside of a browser.  These vulnerabilities have been rated Critical and could lead to remote code execution or information disclosure.  Flash versions older than 10.0.42.34 and Air versions older than 1.5.3 are affected by these issues.  Gladiator recommends that these patches are applied to all workstations as soon as possible. Users running Flash Player 9 should upgrade to version 10 at this time.

GSA Reference Number: AD080528-01

Simply Put: Adobe’s Flash Player has a new, zero-day vulnerability. Zero-day means the attack is being actively exploited on the internet and there is not a patch available. Adobe Flash Player is used to display flash files (.swf) in web pages – these files are normally seen as movies or animations. The vulnerability can be used to run malicious code on a user’s machine without notification or permission. Gladiator feels this issue is extremely critical.