Adobe Patches Multiple Security Holes in Adobe Flash Player & AIR (CVE-2012-5274 to 5280)

Critical Buffer Overflow, Memory Corruption & Security bypass Vulnerability in Adobe Flash Player & AIR Patched

Adobe- American multinational computer software company has released new versions of its Flash Player to eliminate a number of critical vulnerabilities  in Flash Player that could lead to system crashes or remote attackers controlling computers running compromised software. All the flaws were discovered by members of the Google Security Team are associated with several CVE numbers; CVE-2012-5274, CVE-2012-5275, CVE-2012-5276, CVE-2012-5277, CVE-2012-5280 are buffer overflows, CVE-2012-5279 is a memory corruption issue and CVE-2012-5278 is a security bypass; all of which are listed as potentially allowing an attacker to inject malicious code into the system. Google said it will update Flash Player installed with Google Chrome, and Microsoft will do the same with Internet Explorer 10. In the security bulletin Adobe said that it has released security updates for Adobe Flash Player 11.4.402.287 and earlier versions for Windows and Macintosh, Adobe Flash Player 11.2.202.243 and earlier versions for Linux, Adobe Flash Player 11.1.115.20 and earlier versions for Android 4.x, and Adobe Flash Player 11.1.111.19 and earlier versions for Android 3.x and 2.x. These updates address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system. 

Adobe recommends users update their product installations to the latest versions:-

• Users of Adobe Flash Player 11.4.402.287 and earlier versions for Windows and Macintosh should update to Adobe Flash Player 11.5.502.110.
• Users of Adobe Flash Player 11.2.202.243 and earlier versions for Linux should update to Adobe Flash Player 11.2.202.251.
• Flash Player installed with Google Chrome will automatically be updated to the latest Google Chrome version, which will include Adobe Flash Player 11.5.31.2 for Windows, Macintosh and Linux.
• Flash Player installed with Internet Explorer 10 will automatically be updated to the latest Internet Explorer 10 version, which will include Adobe Flash Player 11.3.376.12 for Windows.
• Users of Adobe Flash Player 11.1.115.20 and earlier versions on Android 4.x devices should update to Adobe Flash Player 11.1.115.27.
• Users of Adobe Flash Player 11.1.111.19 and earlier versions for Android 3.x and earlier versions should update to Flash Player 11.1.111.24.
• Users of Adobe AIR 3.4.0.2710 and earlier versions for Windows and Macintosh, SDK (including AIR for iOS) and Android should update to Adobe AIR 3.5.0.600.

AFFECTED SOFTWARE VERSIONS:- 

• Adobe Flash Player 11.4.402.287 and earlier versions for Windows and Macintosh
• Adobe Flash Player 11.2.202.243 and earlier versions for Linux
• Adobe Flash Player 11.1.115.20 and earlier versions for Android 4.x
• Adobe Flash Player 11.1.111.19 and earlier versions for Android 3.x and 2.x
• Adobe AIR 3.4.0.2710 and earlier versions for Windows and Macintosh, SDK (includes AIR for iOS) and Android

To verify the version of Adobe Flash Player installed on your system, access the About Flash Player page, or right-click on content running in Flash Player and select "About Adobe (or Macromedia) Flash Player" from the menu. If you use multiple browsers, perform the check for each browser you have installed on your system. To verify the version of Adobe Flash Player for Android, go to Settings > Applications > Manage Applications > Adobe Flash Player x.x.  To verify the version of Adobe AIR installed on your system, follow the instructions in the Adobe AIR TechNote. Adobe also recommended its Adobe AIR users to update  to 3.5.0.600.
While talking about security patches in Adobe product, we want to give to reminder that just couple of weeks ago Adobe also plugged buffer overflow vulnerability in its Shockwave Player. Also in late September, Adobe disclosed that it had been attacked and hackers were using a valid Adobe certificate to sign two malicious utilities used most often in targeted attacks. Adobe revoked the certificate Oct. 4.

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Adobe Patches Multiple Security Holes in Adobe Flash Player & AIR (CVE-2012-5274 to 5280)"https://www.voiceofgreyhat.com/2012/11/Adobe-Patches-Security-Holes-in-Flash-Player-AIR.html</a>

Adobe Released Security Bulletin to Patch Multiple Vulnerable Products

Adobe released a security bulletin to patch their multiple vulnerable products. Here are the list with detail information of those products.

• APSB11-19 – Security update available for Adobe Shockwave Player (Critical)
• APSB11-20 – Security update available for Adobe Flash Media Server (Critical)
• APSB11-21 – Security update available for Adobe Flash Player (Critical)
• APSB11-22 – Security update available for Adobe Photoshop CS5 (Critical)
• APSB11-23 – Security updates available for RoboHelp (Important)

Security update available for Adobe Shockwave Player:-

 
Critical vulnerabilities have been identified in Adobe Shockwave Player 11.6.0.626 and earlier versions on the Windows and Macintosh operating systems. These vulnerabilities could allow an attacker, who successfully exploits these vulnerabilities, to run malicious code on the affected system.
Adobe recommends users of Adobe Shockwave Player 11.6.0.626 and earlier versions update to Adobe Shockwave Player 11.6.1.629.

Security update available for Adobe Flash Media Server :-

A critical vulnerability has been identified in Adobe Flash Media Server (FMS) 4.0.2 and earlier versions, and Adobe Flash Media Server (FMS) 3.5.6 and earlier versions for Windows and Linux.
This vulnerability could allow an attacker, who successfully exploits the vulnerability, to cause a denial of service on the affected system. Adobe has provided an update to address the reported vulnerability and recommends that users update their installations to Flash Media Server 4.0.3 or 3.5.7 respectively.

Security update available for Adobe Flash Player :-

Critical vulnerabilities have been identified in Adobe Flash Player 10.3.181.36 and earlier versions for Windows, Macintosh, Linux and Solaris, and Adobe Flash Player 10.3.185.25 and earlier versions for Android. These vulnerabilities could cause a crash and potentially allow an attacker to take control of the affected system.
Adobe recommends users of Adobe Flash Player 10.3.181.36 and earlier versions for Windows, Macintosh, Linux and Solaris update to Adobe Flash Player 10.3.183.5. Users of Adobe Flash Player for Android 10.3.185.25 and earlier versions should update to Adobe Flash Player for Android 10.3.186.3. Users of Adobe AIR 2.7 for Windows and Macintosh, should update to 2.7.1 and users of AIR 2.7 for Android should update to Adobe AIR 2.7.1.1961.

Security update available for Adobe Photoshop CS5 :-

A critical vulnerability has been identified in Photoshop CS5 and CS5.1 (12.0 and 12.1) and earlier for Windows and Macintosh that could allow an attacker who successfully exploits this vulnerability to take control of the affected system. To successfully exploit this vulnerability, an attacker would have to convince a user to open a malicious .GIF file in Photoshop CS5.

Security updates available for RoboHelp :-

An important vulnerability has been identified in RoboHelp 9 (versions 9.0.1.232 and earlier), RoboHelp 8, RoboHelp Server 9 and RoboHelp Server 8. A specially crafted URL could be used to create a cross-site scripting attack on RoboHelp installations. 

-News Source (Adobe & Help Security)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Adobe Released Security Bulletin to Patch Multiple Vulnerable Products"https://www.voiceofgreyhat.com/2011/08/adobe-released-security-bulletin-to.html</a>

Hackers Breached Adobe Server in Order to Compromise Certificate to Sign malware

Hackers Breached Adobe Server in Order to Compromise Certificate to Sign malware

Few advanced hackers have managed to break into an internal server at Adobe to compromise a digital certificate that allowed them to create at least two files that appear to be legitimately signed by the software maker, but actually contain malware. This security breach took place on Thursday and the software giant Adobe confirmed that the attackers signed at least two malicious utility programs with the valid Adobe certificate. The company traced the problem to a compromised build server that had the ability to get code approved from the company’s code-signing system. As a result of the breach, which appears to date back to early July, Adobe on Oct. 4 expects to revoke the compromised certificate that was used to sign the malicious files. According to Brad Arkin, senior director of product security and privacy for Adobe “This only affects the Adobe software signed with the impacted certificate that runs on the Windows platform and three Adobe AIR applications that run on both Windows and Macintosh,” 

Arkin wrote. “The revocation does not impact any other Adobe software for Macintosh or other platforms.” The company uncovered the breach after coming across two malicious "utilities" that appeared to be digitally signed with a valid Adobe cert. It is unclear how or whether those files were used in the wild to target anyone. "Sophisticated threat actors use malicious utilities like the signed samples during highly targeted attacks for privilege escalation and lateral movement within an environment following an initial machine compromise," Arkin wrote

In another blog posted by Arkin, he said that, generally speaking, most Adobe users won't be affected. "Is your Adobe software vulnerable because of this issue?" he wrote. "No". This issue has no impact on the security of your genuine Adobe software. Are there other security risks to you? We have strong reason to believe that this issue does not present a general security risk. The evidence we have seen has been limited to a single isolated discovery of two malicious utilities signed using the certificate and indicates that the certificate was not used to sign widespread malware."

The "build" server that was compromised was not configured according to Adobe's corporate standards, but that shortfall wasn't caught during the provisioning process, Arkin said. He added that the affected server did not provide the adversaries with access to any source code for other products, such as the popular Flash Player and Adobe Reader and Acrobat software. 

Here we would like to give you reminder that in the last few months we have been a slew of attacks against the following sites: Guild Wars 2, Gamigo, Blizzard, Yahoo, LinkedIn, eHarmony, Formspring, Android Forums, Gamigo,  Nvidia,Blizzard and  Philips. And after this breach Adobe also enlisted its name among those who was fallen victim to cyber criminals in this year. For all the latest on cyber security and hacking related stories; stay tuned with VOGH. 

UPDATE: Recently we got an update, where Adobe denies the breach. In their later press release an Adobe spokeswoman said the certificate was not actually stolen: "Adobe has stringent security measures in place to protect its code signing infrastructure. The private keys associated with the Adobe code signing certificates were stored in Hardware Security Modules (HSMs) kept in physically secure facilities. We confirmed that the private key associated with the Adobe code signing certificate was not extracted from the HSM."

-Source (Adobe, SC Magazine, WIRED)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Hackers Breached Adobe Server in Order to Compromise Certificate to Sign malware"https://www.voiceofgreyhat.com/2012/09/Adobe-Server-Breached-Certificate-Stolen.html</a>

Zero-Day Vulnerability In Flash Patched By Adobe

Zero-Day Vulnerability In Flash Patched By Adobe 

Yet another Zero day vulnerability found in Adobe Flash Player. Earlier hackers found zero-day exploit in flash player which can allow an attacker to hack you web-cam remotely later Adobe patched that. Before releasing Flash Player 11 Adobe issued new privacy policy and security update but now it seems that those are of zero use. 11.1.102.55 and earlier versions for Windows, Macintosh, Linux and Solaris, Adobe Flash Player 11.1.112.61 and earlier versions for Android 4.x, and Adobe Flash Player 11.1.111.5 and earlier versions for Android 3.x and 2.x. These vulnerabilities could cause a crash and potentially allow an attacker to take control of the affected system.

Affected Version:- 

• Adobe Flash Player 11.1.102.55 and earlier versions for Windows, Macintosh, Linux and Solaris operating systems

• Adobe Flash Player 11.1.112.61 and earlier versions for Android 4.x, and Adobe Flash Player 11.1.111.5 and earlier versions for Android 3.x and 2.x

Later Adobe confirmed that and immediately released a patch to close the security hole. Through this security release Adobe also resolves a universal cross-site scripting vulnerability that could be used to take actions on a user's behalf on any website or webmail provider, if the user visits a malicious website. There are reports that this vulnerability (CVE-2012-0767) is being exploited in the wild in active targeted attacks designed to trick the user into clicking on a malicious link delivered in an email message (Internet Explorer on Windows only). Google's Chrome Web browser, which directly integrates Flash into its software (unlike competing browsers) also received an update to reflect Adobe's patch update. 

Recommendation From Adobe:-

Adobe recommends users of Adobe Flash Player 11.1.102.55 and earlier versions for Windows, Macintosh, Linux and Solaris update to Adobe Flash Player 11.1.102.62. Users of Adobe Flash Player 11.1.112.61 and earlier versions on Android 4.x devices should update to Adobe Flash Player 11.1.115.6. Users of Adobe Flash Player 11.1.111.5 and earlier versions for Android 3.x and earlier versions should update to Flash Player 11.1.111.6. For further details click here.

Earlier in 2011 another Flash Player bug found in Blackberry OS & later fixed by the developer and also last year adobe closes serious security hole in Acrobat 9X & Adobe Reader.

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Zero-Day Vulnerability In Flash Patched By Adobe"https://www.voiceofgreyhat.com/2012/02/zero-day-vulnerability-in-flash-patched.html</a>

Adobe Closes Security Holes In Adobe Reader & Acrobat 9.x

Zero day vulnerability in Adobe Acrobat Reader has been fixed. There have been reports of two critical vulnerabilities being actively exploited in limited, targeted attacks in the wild against Adobe Reader 9.x on Windows. These vulnerabilities (CVE-2011-2462, referenced in Security Advisory APSA11-04, and CVE-2011-4369) could cause a crash and potentially allow an attacker to take control of the affected system. 

While these vulnerabilities exist in Adobe Reader X (10.1.1) and earlier versions for Windows and Macintosh, Adobe Reader 9.4.6 and earlier 9.x versions for UNIX, and Adobe Acrobat X (10.1.1) and earlier versions for Windows and Macintosh, there is no immediate risk to users of Adobe Reader and Acrobat X for Windows (with Protected Mode/Protected View enabled), Adobe Reader and Acrobat X or earlier versions for Macintosh, and Adobe Reader 9.x for UNIX based on the current exploits and historical attack patterns.

Adobe recommends users of Adobe Acrobat 9.4.6 and earlier 9.x versions for Windows update to Adobe Acrobat 9.4.7. Because Adobe Reader X Protected Mode and Adobe Acrobat X Protected View would prevent an exploit of the type currently targeting these vulnerabilities (CVE-2011-2462 and CVE-2011-4369) from executing, we are planning to address these issues in Adobe Reader and Acrobat X for Windows with the next quarterly security update for Adobe Reader and Acrobat, scheduled for January 10, 2012. We are planning to address these issues in Adobe Reader and Acrobat X and earlier versions for Macintosh as part of the next quarterly update scheduled for January 10, 2012. An update to address these issues in Adobe Reader 9.x for UNIX is planned for January 10, 2012.

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Adobe Closes Security Holes In Adobe Reader & Acrobat 9.x"https://www.voiceofgreyhat.com/2011/12/adobe-closes-security-holes-in-adobe.html</a>

Adobe Closes Several Critical Security Hole in Shockwave Player

Adobe Closes Several Critical Security Hole in Shockwave Player

If you are a fan or regular user of  Adobe Shockwave Player on your Windows or Mac computer then it's time for you to update your systems. Adobe has released a security update for Adobe Shockwave Player 11.6.7.637 and earlier versions on the Windows and Macintosh operating systems. This update addresses vulnerabilities that could allow an attacker, who successfully exploits these vulnerabilities, to run malicious code on the affected system. Adobe recommends users of Adobe Shockwave Player 11.6.7.637 and earlier versions update to Adobe Shockwave Player 11.6.8.638 using the instructions provided below.

This update resolves buffer overflow vulnerabilities that could lead to code execution (CVE-2012-4172, CVE-2012-4173, CVE-2012-4174, CVE-2012-4175, CVE-2012-5273). 

• AFFECTED SOFTWARE VERSIONS:-

Adobe Shockwave Player 11.6.7.637 and earlier versions for Windows and Macintosh

• SOLUTION:-

Adobe recommends users of Adobe Shockwave Player 11.6.7.637 and earlier versions update to the newest version 11.6.8.638, available here: http://get.adobe.com/shockwave/.

This update resolves an array out of bounds vulnerability that could lead to code execution (CVE-2012-4176). Adobe has said that the update is a priority 2 issue. The company recommends users update their installations as soon as is possible, but notes there are no known Shockware exploits in the wild for these flaws.

If you dig the recent past, then you will found the security of Adobe products has been under the microscope the last four weeks. Most recently, Adobe upgraded its Reader and Acrobat products with enhancements to its sandbox functionality and a new feature that forces any DLL loaded by either application to use Address Space Layout Randomization (ASLR). Also we want to remind you that in late September, Adobe disclosed that it had been attacked and hackers were using a valid Adobe certificate to sign two malicious utilities used most often in targeted attacks. Adobe revoked the certificate Oct. 4.

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Adobe Closes Several Critical Security Hole in Shockwave Player"https://www.voiceofgreyhat.com/2012/10/Adobe-Closes-Critical-SecurityHole-in-Shockwave-Player.html</a>

Adobe Plugged Newly Found Zero-day Hole In Flash Player

Adobe Plugged Newly Found Zero-day Hole In Flash Player

Adobe warned that hackers are exploiting a critical vulnerability in its popular Flash Player program, and issued an emergency update to patch the bug. The vulnerability allows an attacker to crash the player or take control of an affected system. Adobe says that there are reports of this vulnerability being exploited in the wild as part of targeted email-based attacks which trick the user into clicking on a malicious file. Adobe released security updates for Adobe Flash Player 11.2.202.233 and earlier versions for Windows, Macintosh and Linux, Adobe Flash Player 11.1.115.7 and earlier versions for Android 4.x, and Adobe Flash Player 11.1.111.8 and earlier versions for Android 3.x and 2.x. These updates address an object confusion vulnerability (CVE-2012-0779) that could cause the application to crash and potentially allow an attacker to take control of the affected system.
There are reports that the vulnerability is being exploited in the wild in active targeted attacks designed to trick the user into clicking on a malicious file delivered in an email message. The exploit targets Flash Player on Internet Explorer for Windows only. 

Affected Software Version :- 

• Adobe Flash Player 11.2.202.233 and earlier versions for Windows, Macintosh and Linux operating systems
• Adobe Flash Player 11.1.115.7 and earlier versions for Android 4.x, and Adobe Flash Player 11.1.111.8 and earlier versions for Android 3.x and 2.x

Adobe recommends users of Adobe Flash Player 11.2.202.233 and earlier versions for Windows, Macintosh and Linux update to Adobe Flash Player 11.2.202.235. Flash Player installed with Google Chrome was updated automatically, so no user action is required. Users of Adobe Flash Player 11.1.115.7 and earlier versions on Android 4.x devices should update to Adobe Flash Player 11.1.115.8. Users of Adobe Flash Player 11.1.111.8 and earlier versions for Android 3.x and earlier versions should update to Flash Player 11.1.111.9. For detailed information and to see the security bulletin of Adobe click here.

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Adobe Plugged Newly Found Zero-day Hole In Flash Player"https://www.voiceofgreyhat.com/2012/05/adobe-plugged-newly-found-zero-day-hole.html</a>

Adobe Confirms Data Breach, Hacker Leaked More Than 150,000 Customer Details

Adobe Confirms Data Breach, Hacker Leaked More Than 150,000 Customer Details 

Yet again Adobe, the American multinational computer software company had fallen victim of cyber attack. In September Adobe faced what it called a sophisticated cyber attack where hackers have breached Adobe server in order to compromise certificate to sign malware. As a move Adobe revoked those certificates on October 4th. After that massacre, here again one of Adobe's databases has been breached by a hacker and that it has temporarily taken offline the affected Connectusers.com website. The attacker who claimed responsibility for the attack, told that he used a SQL injection exploit in the breach. Adobe confirmed the breach and said that the hacker indeed managed to break into an Adobe server and copy the private credentials of approximately 150,000 users – including their names, email addresses and password hashes. Those affected accounts include Adobe customers, Adobe employees and partners along with U.S. military users including U.S. Air Force users, and users from Google, NASA, universities, and other companies. To prove the attack, the intruder, who goes by the name of "ViruS_HimA" and claims to be from Egypt, has released extracts from his haul on the Pastebin text hosting service. 

"It was an SQL Injection vulnerability -- somehow I was able to dump the database in less requests than normal people do," said ViruS_HimA. Users passwords for the Adobe Connect users site were stored and hashed with MD5, says the hacker, which made them "easy to crack" with freely available tools. And Adobe wasn't using WAFs on the servers, the hacker notes. "I just want to be clear that I'm not going against Adobe or any other company. I just want to see the biggest vendors safer than this," he told the press. "Every day we see attacks targeting big companies using Exploits in Adobe, Microsoft, etc. So why don't such companies take the right security procedures to protect them customers and even themselves?"

"Adobe is a very big company but they don't really take care of them security issues, When someone report vulnerability to them, It take 5-7 days for the notification that they've received your report!!" he wrote. "It even takes 3-4 months to patch the vulnerabilities!" 

While talking about such big cyber attacks, here we would like to give you reminder that in the last few months we have been a slew of attacks against the following sites: Guild Wars 2, Gamigo, Blizzard, Yahoo, LinkedIn, eHarmony, Formspring, Android Forums, Gamigo,  Nvidia,Blizzard, Philips, Zynga, VMWare, & so on. For all the latest on cyber security and hacking related stories; stay tuned with VOGH. 

-Source (Dark Reading, The-H)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Adobe Confirms Data Breach, Hacker Leaked More Than 150,000 Customer Details"https://www.voiceofgreyhat.com/2012/11/Hacker-Leaked-150000-Customer-Details-of-Adobe.html</a>

Adobe fixes serious security flaws in Acrobat, Reader

You might not be aware of it, but online criminals frequently exploit bugs in Adobe's PDF-viewing programs on your computer to launch crafty cyberattacks that give them access to your sensitive information.

Case in point: hackers have recently been embedding rigged Adobe Flash files inside legitimate Microsoft Word and Excel documents. When you open what you think is an ordinary Microsoft document, you also let in the corrupt — and hidden — Flash file that grants the criminals entry into your computer.

The Adobe Flash flaw first came to light last month, and was patched April 15.

But the same serious security bug was also found to exist in Adobe Reader and Acrobat. Adobe said it would address these problems during the week of April 25, but thankfully, they've sprung into action early.

Adobe Thursday issued security updates for Reader and Acrobat. Adobe Reader X 10.0.3 is the newest version; Acrobat has been updated to 10.0.3 as well.

Adobe programs are set up on most computers to update automatically, but to update to the newest Adobe versions yourself, Adobe recommends selecting "Software Updates" and then "Check for Updates" under your computer's "System Preferences" or "Help" tab.

Users can also visit Adobe.com for instructions on how to manually update the programs.

Adobe Flash, Reader and Acrobat are such highly prized targets because they are so widely used, and often come preinstalled on computers. Security experts advise users to frequently check for updates to all programs, and to never open unsolicited attachments or ones that seem suspicious.

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Adobe fixes serious security flaws in Acrobat, Reader"https://www.voiceofgreyhat.com/2011/04/adobe-fixes-serious-security-flaws-in.html</a>

Finally Flash 11 beta 64-bit Support For Linux is Now Available

Adobe has released the first beta of Flash 11, a major update of the rich media browser plug-in. A significant change in this version of Flash is the availability of 64-bit builds for Windows, Linux, and Mac OS X.
The long-overdue delivery of 64-bit support is a major milestone for Adobe. The company first demonstrated an experimental 64-bit Flash plug-in prototype in 2008 and vowed to eventually deliver support for the x64 architecture across all of the major desktop operating systems. The plan had to take a backseat, however, as Adobe's focus shifted to other priorities. Improving Flash's performance and reliability on mobile devices has consumed much of the company's attention over the past year.
Adobe dropped its previous experimental 64-bit Flash plug-in roughly a year ago, citing the need for significant architectural changes. At the time, we joked that Flash's 64-bit support might finally land at about the same time as Duke Nukem Forever. It's sort of funny how that worked out. Unlike Duke's less-than-triumphant return, however, the new 64-bit Flash plugin actually lives up to its promise.
Linux users have typically had to rely on frameworks like nspluginwrapper to use the 32-bit Flash plug-in in a 64-bit browser. Due to native 64-bit support, the new beta version of the Flash plug-in can be used without a shim. We briefly tested it on Ubuntu 11.04 in the Firefox Web browser. In light of Adobe's controversial decision to discontinue Adobe AIR on the Linux platform, it's a bit surprising that it is treating the operating system as a first-class citizen with 64-bit support in Flash 11.

In addition to 64-bit support, the new plug-in also introduces the new Stage3D APIs—Adobe's Molehill project—which provides hardware-accelerated 3D rendering capabilities in the same vein as WebGL. The runtime has also gained improved JSON handling and some technical improvements that make garbage collection less intrusive. Another nice addition is support for H.264 encoding of real-time video streams captured from the user's camera—offering better compression for video chat and other similar kinds of applications.

The plug-in is available for download from Adobe's website in 32-bit and 64-bit flavors. Adobe warns, however, that the beta is still a work in progress and not intended for serious day-to-day use. I didn't encounter any serious problems during my brief test of the plugin.

To see the official Announcement of Adobe Click Here 

-News Source (ARS & Adobe)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Finally Flash 11 beta 64-bit Support For Linux is Now Available"https://www.voiceofgreyhat.com/2011/07/finally-flash-11-beta-64-bit-support.html</a>

Adobe Says Windows 8 Users are Vulnerable to Active Flash Exploits (Microsoft Will not Patch the Bug Until October)

Adobe Says Windows 8 Users are Vulnerable to Active Flash Exploits (Microsoft Will not Patch the Bug Until October 26)

Adobe confirmed a serious security hole in Windows 8, hackers have been aiming at  Microsoft's Windows 8 PCs for several weeks as it is vulnerable to attack by exploits. Its very unfortunate for those who runs all the four (consumer preview, developer preview, release preview & enterprise) pre-release version of Windows 8, because the Redmond based software giant Microsoft said it will not patch the bug in Flash Player until what it called "GA," for "general availability." That would be Oct. 26, when Windows 8 hits retail and PCs powered by the new operating system go on sale. 

"We will update Flash in Windows 8 via Windows Update as needed," a spokeswoman said in a reply to questions. "The current version of Flash in the Windows 8 RTM build does not have the latest fix, but we will have a security update coming through Windows Update in the GA timeframe."
Microsoft, not Adobe, is responsible for patching Flash Player in Windows 8 because the company took a page from Google's playbook and integrated the popular media software with Internet Explorer 10 (IE10), the new operating system's browser. Last month, Adobe issued two updates for Flash Player that patched eight vulnerabilities, some of which were ranked as "1" by the company, its highest threat warning. One of the vulnerabilities, tagged as CVE-2012-1535, was patched Aug. 14, but had been exploited for an indeterminate time before that.
In fact, CVE-2012-1535 was one of four "zero-days," or unpatched vulnerabilities, exploited in a 16-week stretch by an elite hacker gang revealed by Symantec researchers on Friday. Microsoft has not updated the Flash in IE10 within Windows 8 to accommodate those two sets of patches, Adobe confirmed Friday. "Flash Player 11.3.372.94 does not incorporate the fixes released in APSB12-18 and APSB12-19," said Wiebke Lips, a spokeswoman for Adobe, referring to the Aug. 14 and Aug. 21 Flash updates.
Windows 8 RTM's IE10 identifies the integrated Flash Player as version 11.3.372.94, a more recent build than the one in Windows 8 Release Preview, but older than the most-up-to-date version for Windows, 11.4.402.265, which Adobe delivered on Aug. 21.

Adobe actually told some users about Windows 8's Flash situation two weeks ago. On an Adobe support forum, a company representative announced on Aug. 23 that there would be no Flash update for Windows 8 and IE10 until late October. "Since Windows 8 has not yet been released for general availability, the update channel is not active," said Chris Campbell, identified as an Adobe employee. "Once this goes live, you'll start getting updates to Flash Player."

-Source (Computer World)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Adobe Says Windows 8 Users are Vulnerable to Active Flash Exploits (Microsoft Will not Patch the Bug Until October)"https://www.voiceofgreyhat.com/2012/09/Windows8-Users-are-Vulnerable-to-Active-Flash-Exploits.html</a>

Kaspersky Vulnerability Underscores Users' Poor Updating Habits

Over the past year, Adobe has taken a lot of heat for vulnerabilities in its products -- specifically the Flash plug-in and Adobe Reader. Now, however, there's a fresh new round of finger-pointing in the wake of Kaspersky's first quarter 2011 threat analysis, in which Adobe apps accounted for the top three of the ten most prevalent vulnerabilities on consumer computers.

As is the case with so many reports like this, however, the numbers don't tell the whole story. The top vulnerability, which was in Adobe Reader, wasoriginally posted by Adobe on September 8, 2010 -- and a patch has been available since October 5, 2010. While I'm not impressed that it took a full month for Adobe to issue a critical patch, I'm less impressed that millions of users still hadn't bothered to update by the end of this quarter -- especially when the vastly superior Adode Reader X is available to replace infinitely less-secure 9.X versions.

In fact, only two of the vulnerabilities Kaspersky lists actually surfaced in Q1 2011 -- one in Java and one in Flash. As for the other two Adobe listings, are we to blame the company when end users opt out of an update? In my years as a technician, I've seen countless systems with Adobe Reader, Flash, and Java update icons resting in the tray and periodically tossing out system notifications that an update is available. Much as I would like it to be the case, Adobe and Sun can't make a user follow good security practices.

Should Microsoft take the blame for a flaw in OneNote which was revealed in2007 and has long since been patched? Certainly not. Yes, vendors implementing a transparent, auto-update system like the one in Google Chrome would help, but end users also need to take responsibility for their own security.

Since Kaspersky's list doesn't specify the actual Adobe IDs connected with the flaws, I decided to dig a bit deeper into the report. That process was complicated by the fact that Kaspersky's links point to the wrong vulnerabilities -- and the Secunia IDs provided don't match up either. The top vulnerability, for example, is listed as an Adobe Reader flaw. Clicking through on the link took me to a report about Axigen Mail Server and the Secunia ID (38805) points to one for Microsoft Office. Number three, a Flash vulnerability, links to Fedora update for TexMacs.

For a security vendor to call out another company's products for security shortcomings and not bother to error-check prior to publishing is unacceptable. Such missteps show a disdainful lack of care and cast doubts upon the report's veracity and value.

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Kaspersky Vulnerability Underscores Users' Poor Updating Habits"https://www.voiceofgreyhat.com/2011/05/kaspersky-vulnerability-underscores.html</a>

Multiple Vulnerability Found on Adobe and Their Sub-domains

Serious vulnerability found on Adobe. Multiple link of adobe.com and their sub-domains are vulnerable to XSS. Though adobe authority was reported continuously about those flaws but still the status those vulnerabilities are Un-patched.

Vulnerable Site:-
http://www.adobe.com/

Vulnerable Links:- 
http://groups.adobe.com/index.cfm?event=people.login&redirect=%27%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Ealert%28%27XSS%27%29%3C/script%3E

https://tv.adobe.com/login/login?redirect=%27%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Ealert%28%27XSS%27%29%3C/script%3E

http://www.adobe.com/products/creativesuite/mastercollection/buying-guide.html/%22%3E%3Cscript%3Ealert%28%27XSS%27%29%3C/script%3E


http://www.adobe.com/cfusion/type/search.cfm?category_type=All&term=%27%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Ealert%28%27XSS%27%29%3C/script%3E

http://www.adobe.com/cfusion/tdrc/modal/signin.cfm?product=%27%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Ealert%28%27XSS%27%29%3C/script%3E&loc=en_us

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Multiple Vulnerability Found on Adobe and Their Sub-domains"https://www.voiceofgreyhat.com/2011/09/multiple-vulnerability-found-on-adobe.html</a>

Adobe SWF Investigator: A Tool To Analyze Flash Files For Security Researcher & Developers

Adobe SWF Investigator: A Tool To Analyze Flash Files For Security Researcher, Engineers & Developers

Adobe Labs officially announced Adobe SWF Investigator for analyzing Flash files in details. Whether a security expert wants to look into a Flash exploit or a developer wants to debug their own project, the tool collection can be used, among other things, to decompile SWF files in order to then examine the ActionScript source code.

Brief About Adobe SWF Investigator:- 

Adobe® SWF Investigator is the only comprehensive, cross-platform, GUI-based set of tools, which enables quality engineers, developers and security researchers to quickly analyze SWF files to improve the quality and security of their applications. With SWF Investigator, you can perform both static and dynamic analysis of SWF applications with just one toolset. SWF Investigator lets you quickly inspect every aspect of a SWF file from viewing the individual bits all the way through to dynamically interacting with a running SWF.

SWF Investigator Features:-

• From a static perspective, you can disassemble ActionScript 2 (AS2) and ActionScript 3 (AS3) SWFs, view SWF tags and make binary changes to SWF files. SWF Investigator also lets you view associated information, including local shared objects (LSOs) and per site settings.

• From a dynamic perspective, you can call functions within the SWF, load the SWF in various contexts, communicate via local connections and send messages to Action Message Format (AMF) endpoints in order to test more effectively.

• SWF Investigator contains an extensible fuzzer for SWF applications and AMF services, so you can search for common Web application attacks. This toolset also provides a variety of utilities including encoders and decoders for SWF data, as well as a basic compiler for testing small pieces of ActionScript code.

Additional Benefits:-

• SWF Investigator is the only application of its kind that's built on Adobe AIR – a versatile runtime that supports ActionScript, the language used to create SWF applications.  This allows for native interaction between the SWF Investigator and the SWF application. Using ActionScript also makes the source code of the tool more intuitive for SWF developers.

• SWF Investigator has the ability to auto-update, so you don't need to worry about whether or not you have the most current version.

• Since it's an open source AIR application, SWF Investigator can be modified to fit your environment, and it is cross-platform.

To Download Adobe SWF Investigator Preview Version Click Here

-Source (Adobe)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Adobe SWF Investigator: A Tool To Analyze Flash Files For Security Researcher & Developers"https://www.voiceofgreyhat.com/2012/03/adobe-swf-investigator-tool-to-analyze.html</a>

Adobe Flash Zero-day Exploit Which Allowing Others To Use Your Webcam Has Been Patched

A Stanford University student recently discovered a security flaw with Adobe’s Flash Player that allowed malicious users to activate your webcam and microphone without your knowledge. They could then tap into the video and audio to watch and listen to your every move. OK, that sounded a lot less sensationalist in my head. Unfortunately, up until a few days ago, this exploit very much existed and Adobe was working feverishly on a fix. Feross Aboukhadijeh, the aforementioned Stanford student, wrote about the flaw on October 18.
According to Feross Aboukhadijeh:-

"I discovered a vulnerability in Adobe Flash that allows any website to turn on your webcam and microphone without your knowledge or consent to spy on you. It works in all versions of Adobe Flash that I tested. I’ve confirmed that it works in the Firefox and Safari for Mac browsers. Use one of those if you check out the live demo. There’s a weird CSS opacity bug in most other browsers (Chrome for Mac and most browsers on Windows/Linux)."

Video Demo:-

Later Adobe issued a critical update for its Flash Player software. The patch fixes six security vulnerabilities, at least one of which is a zero-day vulnerability being actively exploited in the wild. The details of the Adobe security bulletin explain, "This update resolves a universal cross-site scripting issue that could be used to take actions on a user's behalf on any website or webmail provider if the user visits a malicious website (CVE-2011-2444)," adding, 

"Note: There are reports that this issue is being exploited in the wild in active targeted attacks designed to trick the user into clicking on a malicious link delivered in an email message."
The zero-day bug fixed today is similar to a flaw in Flash that was patched in June. Coincidentally, both the June vulnerability, and this one patched today were reported to Adobe by Google.

To download the Patch and more about Adobe Security Bulletin Click Here 

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Adobe Flash Zero-day Exploit Which Allowing Others To Use Your Webcam Has Been Patched"https://www.voiceofgreyhat.com/2011/10/adobe-flash-zero-day-exploit-which.html</a>

Security Bulletin for Photoshop, Adobe Recommended to Buy CS6 To Addresses Those Vulnerabilities

Security Bulletin for Photoshop, Adobe Recommended to Buy CS6 To Addresses Those Vulnerabilities

It seems Adobe remained very busy while issuing security updates in their products. Few days ago Adobe closed a newly found Zero-day hole in its popular Flash Player program. Now it comes the time for Photoshop, Adobe released a security upgrade for Adobe Photoshop CS5 and earlier for Windows and Macintosh. This upgrade addresses vulnerabilities that could allow an attacker who successfully exploits these vulnerabilities to take control of the affected system. In the case of the Windows and Mac versions of Adobe Photoshop, a vulnerability exists in version CS5 and earlier that could be exploited by a malicious attacker who tricks you into opening a boobytrapped .TIF file in order to take control of your computer.

Adobe has released Adobe Photoshop CS6 (paid upgrade), which addresses these vulnerabilities. This upgrade resolves a use-after-free TIFF vulnerability that could lead to code execution (CVE-2012-2027, Bugtraq ID 52634, which references: www.securityfocus.com/bid/52634/).

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Security Bulletin for Photoshop, Adobe Recommended to Buy CS6 To Addresses Those Vulnerabilities"https://www.voiceofgreyhat.com/2012/05/security-bulletin-for-photoshop-adobe.html</a>

New Privacy & Security Updates of Adobe Flash Player 11

Adobe announced this week that it's putting the finishing touches on a new version of Flash Player that will provide new security and privacy enhancements on both the desktop and mobile versions of its application. Notably, Flash Player 11--set to debut in early October--adds desktop support for SSL socket connections, as well as a secure, random number generator, both of which should help developers to better secure users' information. "Flash Player previously provided a basic, random number generator through Math.random. This was good enough for games and other lighter-weight use cases, but it didn't meet the complete cryptographic standards for random number generation," said Adobe

New Security Features in Flash Player 11:-

On the security front, Adobe is introducing several new features that will allow developers to better protect customer data. The first major new feature being added by Adobe is support for SSL socket connections, which will make it easier for developers to protect the data they stream over the Flash Player raw socket connections.
Adobe is  also adding a secure random number generator. Flash Player previously provided a basic, random number generator through Math.random. This was good enough for games and other lighter-weight use cases, but it didn’t meet the complete cryptographic standards for random number generation. The new random number generator API hooks the cryptographic provider of the host device, such as the CryptGenRandom function in Microsoft CAPI on Windows, for generating the random number. The native OS cryptographic providers have better sources of entropy and have been peer reviewed by industry experts.

Lastly, the introduction of 64-bit support in Flash Player 11 brings with it some security side-benefits: If you are using a 64-bit browser that supports address space layout randomization (ASLR) in conjunction with the 64-bit version of Flash Player, you will be protected by 64-bit ASLR. Traditional 32-bit ASLR only has a small number of bits available in the memory address for randomizing locations. Memory addresses based on 64-bit registers have a wider range of free bits for randomization, increasing the effectiveness of ASLR.
Overall, Adobe security and privacy roadmap still has much more to come, and Adobe is already working on the next generation of features for upcoming releases. To take a look at the many new features in Flash Player 11—whether it be the advancements for gaming, media and data-driven applications, the security enhancements or the new mobile privacy features—check out the release candidate of Flash Player 11 for desktops now available on Adobe Labs or watch for an announcement once Flash Player 11 for desktops and Android devices becomes available in early October.

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">New Privacy & Security Updates of Adobe Flash Player 11"https://www.voiceofgreyhat.com/2011/09/new-privacy-security-updates-of-adobe.html</a>

BlackBerry PlayBook OS v1.07.3312 Updated & Fixed Adobe Flash Vulnerability

A new version of the BlackBerry® Tablet OS is now available to all BlackBerry® PlayBook™ tablet users. BlackBerry Tablet OS v1.07.3312 contains an updated version of Adobe® Flash® Player. This free update can be downloaded over-the-air from your BlackBerry PlayBook tablet.

On September 21st, Adobe issued an update for Adobe Flash Player, as noted in Adobe Security BulletinsAPSB-11-26, which addresses issues that can potentially affect any PC, tablet, or other device with an operating system that supports Adobe Flash. 

While there are no known reports of any BlackBerry PlayBook tablet users being affected by these Adobe Flash issues, we (as always) encourage all BlackBerry PlayBook users to update to the newest version of the BlackBerry Tablet OS. For more information about what these security updates mean to the BlackBerry PlayBook, please see our security advisory.

How to update your BlackBerry PlayBook tablet :-

Existing BlackBerry PlayBook tablet users will automatically receive a software update notification on the BlackBerry PlayBook status ribbon, or they can check for the software update at any time in the settings menu under Software Updates. Users who purchase and activate a BlackBerry PlayBook tablet on or after Thursday October 6th will automatically be updated to 1.07.3312 or later as part of the BlackBerry PlayBook tablet setup process.

For users who are already running BlackBerry PlayBook v1.0.7.2942 or higher, the update to this new version (v1.07.3312) will include only the Adobe Flash update and is expected to take only a few minutes to install.

-News Source (BlackBerry) 

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">BlackBerry PlayBook OS v1.07.3312 Updated & Fixed Adobe Flash Vulnerability"https://www.voiceofgreyhat.com/2011/10/blackberry-playbook-os-v1073312-updated.html</a>

Adobe release patch for Flash Player to prevent XSS

Adobe has released an out-of-cycle security update for Flash Player just days after learning of a new zero-day vulnerability. The vulnerability affected Flash Player 10.3.181.16 and earlier versions on Windows, Macintosh, Linux and Solaris, and Android version 10.3.185.22 and earlier. Despite the speed of the patch release, the vulnerability did not get the top "critical" rating, but is still rated "important". The "important" status denotes a vulnerability which could compromise data security, allowing hackers access to confidential data, or could compromise processing resources in a user's computer. "This universal cross-site scripting vulnerability (CVE-2011-2107) could be used to take actions on a user's behalf on any website or webmail provider, if the user visits a malicious website," Adobe said in a security bulletin. According to Adobe, the vulnerability is being exploited in the wild, in active, targeted attacks tricking the user into clicking on a malicious link delivered in an e-mail message. Adobe recommends users of the affected versions for Windows, Macintosh, Linux and Solaris update to Adobe Flash Player 10.3.181.22 or 10.3.181.23 for ActiveX. The firm expects to release an update for Flash Player 10.3.185.22 for Android later this week.
Adobe investigated the flaw in Adobe Reader and Acrobat versions 10.x and 9.x for Windows and Macintosh, but said it was unaware of zero-day attacks against those platforms.
Google has updated its Chrome web browser, also affected by the vulnerability.

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Adobe release patch for Flash Player to prevent XSS"https://www.voiceofgreyhat.com/2011/06/adobe-release-path-for-flash-player-to.html</a>

GIF Vulnerability Patch For Photoshop Mac Users

The folks at Adobe have been keeping themselves busy this week patching several security holes in their software, including one affecting Photoshop Mac users.
According to a recent technical note on Adobe's site, those using the company’s professional photo editing software on a Mac are advised to patch immediately using Photoshop Standard Multiplugin CS5/CS5.1.
Adobe has recently learned that opening a GIF image of unknown origin may have a negative outcome. Here’s the situation in the Flash maker’s own words:
“The standard multiplugin update addresses a security vulnerability in the GIF file format, where opening a malicious GIF file would cause the application to crash.”

“This update is recommended for anyone who opens GIF files in Photoshop,” Adobe says.

Surely those editing multiple pictures at the same time would hate to see Photoshop crash before them simply because they opened a GIF image.

It works on systems running Mac OS X 10.5.7 (Leopard) and Mac OS X 10.6 (Snow Leopard) and it applies to one of the following language versions of Photoshop CS5 or Photoshop CS5.1: English, French, Spanish, Portuguese, German, Italian, Dutch, Swedish, Danish, Finnish, Norwegian, Chinese Simplified, Chinese Traditional, Korean, Japanese, Czech, Polish, Russian, Turkish, Hungarian, Ukrainian, or Romanian.

After downloading the ".zip" file containing the Photoshop CS5/CS5.1 Standard Multiplugin Update, Mac users must decompress the contained file and drag it to a specific location where Photoshop is installed.

The full set of instructions, as posted on Adobe’s web site, follows below:
1. Download plugin update
2. Unzip plugin update
3. Open Unzipped plugin folder
4. Drag and drop (or copy and paste) Standard Multiplugin.plugin to Applications\Adobe Photoshop CS5 (or CS5.1)\Plug-ins\Filters
5. Replace the existing file(s) when prompted
6. Relaunch PS

To download the 4MB patch click Here

-News Source (Adobe & Softpedia)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">GIF Vulnerability Patch For Photoshop Mac Users"https://www.voiceofgreyhat.com/2011/08/gif-vulnerability-patch-for-photoshop.html</a>