The Members Forum

Adobe today confirmed that hackers are exploiting a critical unpatched bug in Flash Player, and promised to patch the vulnerability in two weeks.

The company issued a security advisory that also named Adobe Reader and Acrobat as vulnerable.

"There are reports that this vulnerability is being actively exploited in the wild against Adobe Reader and Acrobat," said Adobe in its warning. The company said it's seen no sign that hackers are also targeting Flash Player itself.

Those reports came from Mila Parkour, an independent security researcher who notified Adobe early today after spotting and then analyzing a malicious PDF file. According to Parkour, the rigged PDF document exploits the Flash bug in Reader, then drops a Trojan horse and other malware on the victimized machine.

Adobe said that all versions of Flash on Windows, Mac, Linux and Android harbored the bug, and that the "Authplay" component of Reader and Acrobat 9.x and earlier also contained the flaw. Authplay is the interpreter that renders Flash content embedded within PDF files.

Last month, Parkour uncovered a bug in Reader's font-rendering technology that was exploited by attack campaigns using bogus messages from renowned golf coach David Leadbetter as click bait.

Computerworld has the article HERE!