# MA-255.102010: MyCERT Alert - Critical Vulnerability in Adobe Flash Player

**Date:** 29 Oct 2010  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-255.102010  
**Advisory ID:** MA-255.102010

---

**1.0 Introduction**
A critical vulnerability has been identified in Adobe Flash Player 10.1.85.3 and earlier versions for Windows, Macintosh, Linux and Solaris operating systems; Adobe Flash Player 10.1.95.2 and earlier versions for Android; and the authplay.dll component that ships with Adobe Reader 9.4 and earlier 9.x versions for Windows, Macintosh and UNIX operating systems, and Adobe Acrobat 9.4 and earlier 9.x versions for Windows and Macintosh operating systems.
This vulnerability allows a remote attacker to execute arbitrary code on a vulnerable version of Adobe Flash Player. User interaction is required where a user must visit a malicious web site, or opening a PDF file, which is embedded with a specially crafted SWF file. This vulnerability would cause the application to crash and could potentially allow an attacker to take control of the affected system.
**2.0 Impact**
By exploiting this vulnerability, an attacker could execute arbitrary code on vulnerable installations of Adobe Flash and gain the same privilege as the user. This vulnerability could be exploited to install malware on the user's computer.
**3.0 Affected Products**
Products listed below are vulnerable to this vulnerability:
- Adobe Flash Player 10.1.85.3 and prior for Windows, Mac OS X, Linux, and Solaris
- Adobe Flash Player 10.1.95.2 and prior for Android
- Adobe Reader 9.4 and prior for Windows, Mac OS X, and Unix
- Adobe Acrobat 9.4 and prior for Windows and Mac OS X
**4.0 Recommendation**
At the time of this writing, Adobe has not released any patches to address this vulnerability. However, users are recommended to disable Flash / Shockwave support in the web browsers and Acrobat Reader.
To disable the Adobe Flash / Shockwave Player support in the browser:
- For Internet Explorer user, download and install Toggle Flash plugin [http://flash.melameth.com](http://flash.melameth.com/) and allow or unblock Flash content only trusted site.
- For Mozilla Firefox user, download and install FlashBlock plugin from <http://flashblock.mozdev.org/> and allow or unblock Flash content only trusted site.
To disable the Adobe Flash / Shockwave Player support in the browser:
- Adobe Reader and Acrobat 9.x - Windows
Deleting, renaming, or removing access to the authplay.dll file that ships with Adobe Reader and Acrobat 9.x mitigates the threat for those products, but users will experience a non-exploitable crash or error message when opening a PDF file that contains Flash (SWF) content.
The authplay.dll that ships with Adobe Reader and Acrobat 9.x for Windows is typically located at C:\Program Files\Adobe\Reader 9.0\Reader\authplay.dll for Adobe Reader or C:\Program Files\Adobe\Acrobat 9.0\Acrobat\authplay.dll for Acrobat.
- Adobe Reader 9.x - Macintosh
1) Go to the Applications->Adobe Reader 9 folder.
2) Right Click on Adobe Reader.
3) Select Show Package Contents.
4) Go to the Contents->Frameworks folder.
5) Delete or move the AuthPlayLib.bundle file.
- Acrobat Pro 9.x - Macintosh
1) Go to the Applications->Adobe Acrobat 9 Pro folder.
2) Right Click on Adobe Acrobat Pro.
3) Select Show Package Contents.
4) Go to the Contents->Frameworks folder.
5) Delete or move the AuthPlayLib.bundle file.
- Adobe Reader 9.x - UNIX
1) Go to installation location of Reader (typically a folder named Adobe).
2) Within it browse to Reader9/Reader/intellinux/lib/ (for Linux) or Reader9/Reader/intelsolaris/lib/ (for Solaris).
3) Remove the library named "libauthplay.so.0.0.0."
Users are also recommended to browse the Internet with least privilege user to limit the execution of the malicious file and do not open attachment or browse to unknown website received via email from unknown person.
MyCERT generally advise users of this product to keep themselves updated with the latest security announcements by the vendor. In case the public receives any suspicious URL, .PDF file or .SWF file, and requires our further analysis, please reach us through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#2944504a4c5b5d6944504a4c5b5d07465b4e074450)
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT <EMAIL> <COMPLAINT> to 15888
Business Hours : Mon - Fri 08:30 -17:30 MYT
Web: [https://www.mycert.org.my](https://www.mycert.org.my/)
**5.0 References**
- <http://www.adobe.com/support/security/advisories/apsa10-05.html>
- <http://www.securityfocus.com/bid/44504/info>