Summary:
· This vulnerability affects: Adobe Flash Player 11.2.202.233 and earlier, running on all platforms (including Android)
· How an attacker exploits it: By enticing users to visit a website containing malicious Flash content
· Impact: In the worst case, an attacker can execute code on the user's computer, potentially gaining control of it
· What to do: Download and install the latest version of Adobe Flash Player (version 11.2.202.235 for computers)
Exposure:
Adobe Flash Player displays interactive, animated web content called Flash. Although Flash is optional, 99% of PC users download and install it to view multimedia web content. It runs on many operating systems, including mobile operating systems like Android.
In a security bulletin released today, Adobe announced a patch that fixes a critical vulnerability in Adobe Flash Player 11.2.202.233 and earlier, running on all platforms (including Android platforms).
Adobe's bulletin describes the serious flaw as an "object confusion" vulnerability (CVE-2012-0779), and warns that attackers are currently exploiting it in the wild. They don't describe the object confusion issue in detail, but they do describe its impact. If an attacker can entice one of your users to visit a malicious website, or into handling specially crafted Flash content, he could exploit this flaw to execute code on that user's computer, with that user's privileges. If your users have administrator privileges, the attacker could gain full control of their computers.
So far, Adobe has only seen attackers exploiting this vulnerability against Windows computers, which is why they rate this a "Priority 1" issue for Windows, and recommend you apply the updates as soon as possible (within 72 hours). However, the vulnerability technically affects other platforms as well, so I recommend you update any Flash capable device as soon as you can.
Solution Path
Adobe has released new versions of Flash Player (11.2.202.235 for computers and the latest 11.1.11x.x for Android) to fix these issues. If you allow Adobe Flash in your network, you should download and install the new versions immediately. If you've enabled Flash Player's recent "silent update" option, you will receive this update automatically.
· Download Flash Player for your computer:
· Download the latest Android Flash Player from Google Play [Visit from your Android device]
NOTE: Chrome ships with its own version of Flash, built-in. If you use Chrome as you web browser, you will also have to update it separately, though Chrome often receive its updates automatically.
