# MA-250.092010: MyCERT Alert - Critical Vulnerability in Adobe Flash Player

**Date:** 14 Sep 2010  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-250.092010  
**Advisory ID:** MA-250.092010

---

**1.0 Introduction**
A critical vulnerability (CVE-2010-2884) has been identified in the Adobe Flash Player 10.1.82.76 and earlier versions for Windows, Macintosh, Linux, Solaris, and Adobe Flash Player 10.1.92.10 for Android. [1]
These vulnerabilities allow a remote attacker to execute arbitrary code on a vulnerable version of Adobe Flash Player. User interaction is required where a user must visit a malicious web site, which is embedded with a specially crafted SWF file. This vulnerability would cause the application to crash and could potentially allow an attacker to take control of the affected system.
**2.0 Impact**
By exploiting this vulnerability, an attacker could execute arbitrary code on vulnerable installations of Adobe Flash and gain the same privilege as the user. This vulnerability could be exploited to install malware on the user's computer.
**3.0 Affected Products**
Products listed below are vulnerable to this vulnerability:
- Adobe Flash Player 10.1.82.76 and earlier versions for Windows, Macintosh, Linux, Solaris, and Adobe Flash Player 10.1.92.10 for Android
- Adobe Reader 9.3.4 and earlier versions for Windows, Macintosh and UNIX
- Adobe Acrobat 9.3.4 and earlier versions for Windows and Macintosh
**4.0 Recommendation**
At the time of this writing, Adobe has not released any patches to address this vulnerability. However, MyCERT highly recommend to disable or block the flash content in the browser:
- For Internet Explorer user, download and install Toggle Flash plugin [http://flash.melameth.com](http://flash.melameth.com/) and allow or unblock Flash content only trusted site.
- For Mozilla Firefox user, download and install FlashBlock plugin from <http://flashblock.mozdev.org/> and allow or unblock Flash content only trusted site.
MyCERT generally advise users of this product to keep themselves updated with the latest security announcements by the vendor. MyCERT also advises the users to update with the latest security update and virus definition. In case the public receives any suspicious URL or SWF and requires our further analysis, please reach us through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#deb3a7bdbbacaa9eb3a7bdbbacaaf0b1acb9f0b3a7)
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT <EMAIL> <COMPLAINT> to 15888
Business Hours : Mon - Fri 08:30 -17:30 MYT
Web: [https://www.mycert.org.my](https://www.mycert.org.my/)
**5.0 References**
- <http://www.adobe.com/support/security/advisories/apsa10-03.html>
- <http://blogs.adobe.com/psirt/2010/09/security-advisory-for-adobe-flash-player-apsa10-03.html>