New flash player vulnerability (affects Adobe Reader as well)

[Jibz]

http://secunia.com/advisories/40026

http://secunia.com/advisories/40034

Impact  System access
Where From remote

NOTE: The vulnerability is currently being actively exploited.

Doesn't sound too good.

[Ehtyar]

'Bout time to whip out the NoScript, have ya the browser for it.

Ehtyar.

[Renegade]

Oh God... I can just hear the Apple fanboys and Jobs freaking out over this... I'm going to plug my ears now. blah blah blah I cannot hear you blah blah blah...

[mouser]

thanks for the heads up Jibz.

and this is a reminder to everyone:  the very best way to protect yourself against such things is to be prepared to revert your machine back to a stable safe state.
you can't anticipate everything that could go wrong, so back up your computer regularly, and keep older backups.  that's the best way to be safe.

[rxantos]

The vulnerability is caused due to an unspecified error. No more information is currently available.

followed by

NOTE: The vulnerability is reportedly being actively exploited.

How can you don't know what causes the vulnerability, yet know that is actively exploited?
Who reported that is was actively exploited?
Has anyone been able to duplicate the vulnerability? If so, who?

If none of this can be answer, then:
How do we know is is not a report paid for? It wouldn't be the first time happening.

[mouser]

Temporary fix here:
http://community.ca.com/blogs/securityadvisor/archive/2010/06/06/zero-day-attack-in-adobe-products.aspx

[Jibz]

How do we know is is not a report paid for? It wouldn't be the first time happening.

Original Advisory
Adobe:
http://www.adobe.com/support/security/advisories/apsa10-01.html

While I love a good conspiracy theory as much as the next guy, why would Adobe pay to get a false vulnerability warning on their own product?

Personally I interpreted it more like they didn't want to disclose what the problem was to avoid helping more people exploit it, but I have no idea of course .

[40hz]

'Bout time to whip out the NoScript, have ya the browser for it.

Ehtyar.

Aye! Thassa bes' way ta thwart yer wossname snitch.

NoScript. Learn it, load it, love it! 

[Lashiec]

Flash 10.1 out, which is reportedly not affected by this vulnerability. The new version has an unusual number of changes (PDF) for a point release, and among those are a bunch of new features that supposedly will make Flash behave as it should, and make Steve Jobs reconsider including Flash in Apple's iDevices (yeah, sure).

Meanwhile, Adobe Reader is waiting for a patch, so keep those authplay.dll renamed

EDIT: Some Flash animations (for example, the one running in the main Flash Player webpage) when right-clicked won't let the user close its corresponding tab or interact with other GUI elements afterwards. I've only encountered this bug on Opera, but it may affect other browsers as well.