Adobe Struggles With Cross-Product Vulnerabilities

Adobe has continued to struggle with cross-product vulnerabilities in large part due to shared resources and product integration. So with little effort a vulnerability in Reader can be altered to affect Air or Flash. It is clear that Adobe is struggling with the same issues that Microsoft has recently got a handle on, namely risk managment across the complete product line. Administrators should consider an Adobe specific risk and response action plan that transverses the complete product line. Think in terms of the "Adobe Risk Trifecta."

Education is the primary tool that can deal with a host of vulnerabilities, especially if the attacks are carried out via user specific sufaces such as email. Preview.app should be set to handle PDF files, do not forget to disable auto opening in Safari. In addition Click to Flash or Flash Block are excellent tools to block flash content. For extreme cases PDF can be blocked completely at the gateway or Preview.app can run within a sand-box. Make sure that systems which are servers do not have any services or applications that are not needed before it becomes part of production deployment. Only run and load what meets the requirerments.

 Adobe has posted time table for the Reader update and will most likely update Flash and Air in the coming days. Please visit the reference links for more information. 

Update on Monday, September 20, 2010 at 07:59PM by drStrangeP0rk

Flash update released.

http://www.adobe.com/support/flashplayer/downloads.html

http://www.adobe.com/support/security/advisories/apsa10-03.html

APPLE-SA-2010-09-08-1 iOS 4.1 for iPhone and iPod touch

Apple has released an update to IOS 4 to address vulnerabilities in ImageIO, WebKit, VoiceOver (Accessibility) and FaceTime. Users should update their IOS devices as soon as possible. There are also reports that new jail breaks related to IOS4.1 are in the final stages. Apple recently changed the developer agreement which may allow developers to use Flash. This will represent new risk related to IOS devices and their use since Flash has been used as a excellent delivery tool for malware and exploits. 

APPLE-SA-2010-09-07-1 Safari 5.0.2 and Safari 4.1.2

Apple has released Safari 5.0.2 and Safari 4.1.2 to address vulnerabilities in WebKit. Users should apply these updates since they are both critical. There was an input validation issue related to floating point data types which could be exploited, this has been addressed by performing improved validation. 

The other major issue is related to run-in styling which a malicious site could tag advantage of a use after free event. Object pointers has been improved in WebKit handling of run-in styling. Both of these updates require a restart of the server and client versions of MacOSX. 

Google Updates Chrome

Google has released an update to Chrome on the stable channel for Mac OSX. The update addresses various speed and stability concerns in addition to the following security issues.

• [34414] Low Pop-up blocker bypass with blank frame target. Credit to Google Chrome Security Team (Inferno) and “ironfist99”.
• [37201] Medium URL bar visual spoofing with homographic sequences. Credit to Chris Weber of Casaba Security.
• [41654] Medium Apply more restrictions on setting clipboard content. Credit to Brook Novak.
• [45659] High Stale pointer with SVG filters. Credit to Tavis Ormandy of the Google Security Team.
• [45876] Medium Possible installed extension enumeration. Credit to Lostmon.
• [46750] [51846] Low Browser NULL crash with WebSockets. Credit to Google Chrome Security Team (SkyLined), Google Chrome Security Team (Justin Schuh) and Keith Campbell.
• [$1000] [50386] High Use-after-free in Notifications presenter. Credit to Sergey Glazunov.
• [50839] High Notification permissions memory corruption. Credit to Michal Zalewski of the Google Security Team and Google Chrome Security Team (SkyLined).
• [$1337] [51630] [51739] High Integer errors in WebSockets. Credit to Keith Campbell and Google Chrome Security Team (Cris Neckar).
• [$500] [51653] High Memory corruption with counter nodes. Credit to kuzzcc.
• [51727] Low Avoid storing excessive autocomplete entries. Credit to Google Chrome Security Team (Inferno).
• [52443] High Stale pointer in focus handling. Credit to VUPEN Vulnerability Research Team (VUPEN-SR-2010-249).
• [$1000] [52682] High Sandbox parameter deserialization error. Credit to Ashutosh Mehra and Vineet Batra of the Adobe Reader Sandbox Team.
• [$500] [53001] Medium Cross-origin image theft. Credit to Isaac Dawson.

APPLE-SA-2010-09-01-1 iTunes 10

Apple has released iTunes 10 SA-2010-09-01-1 which includes various updates including Ping introduced September 1, 2010. In addition the XSS vulnerabilities which also affected iTunes within WebKit has been patched. Users should install the iTunes update via Software Updater. No restart is required for this update.