TACERT台灣學術網路危機處理中心

※安全通報資訊

安全通報類型	微軟安全通報
發佈日期	2010-06-18
標題	Flash Player，Adobe Reader和Acrobat的安全通報
CVE	CVE-2010-1297
BID
影響平台	Adobe Flash Player 10.0.45.2, 9.0.262, 及 10.0.x 和 9.0.x 之前的版本 (for Windows, Macintosh, Linux and Solaris 作業系統) Adobe Reader 和 Acrobat 9.3.2 ，及 9.x 之前的版本 ( for Windows, Macintosh和UNIX 作業系統) Note: Adobe Reader和Acrobat 8.x 已確認不受影響。
說明	A critical vulnerability exists in Adobe Flash Player 10.0.45.2 and earlier versions for Windows, Macintosh, Linux and Solaris operating systems, and the authplay.dll component that ships with Adobe Reader and Acrobat 9.x for Windows, Macintosh and UNIX operating systems. This vulnerability (CVE-2010-1297) could cause a crash and potentially allow an attacker to take control of the affected system. There are reports that this vulnerability is being actively exploited in the wild against both Adobe Flash Player, and Adobe Reader and Acrobat.
解決方式	Adobe Flash Player Adobe has released a product update to Adobe Flash Player to resolve the relevant security issue. For more information, please refer to Security Bulletin APSB10-14. Adobe Reader and Acrobat - Windows Deleting, renaming, or removing access to the authplay.dll file that ships with Adobe Reader 9.x and Acrobat 9.x mitigates the threat for those products, but users will experience a non-exploitable crash or error message when opening a PDF file that contains SWF content. The authplay.dll that ships with Adobe Reader 9.x and Acrobat 9.x for Windows is typically located at C:\Program Files\Adobe\Reader 9.0\Reader\authplay.dll for Adobe Reader or C:\Program Files\Adobe\Acrobat 9.0\Acrobat\authplay.dll for Acrobat. Adobe Reader 9.x - Macintosh 1) Go to the Applications->Adobe Reader 9 folder. 2) Right Click on Adobe Reader 3) Select Show Package Contents 4) Go to the Contents->Frameworks folder 5) Delete or move the AuthPlayLib.bundle file Acrobat Pro 9.x - Macintosh 1) Go to the Applications->Adobe Acrobat 9 Pro folder. 2) Right Click on Adobe Acrobat Pro 3) Select Show Package Contents 4) Go to the Contents->Frameworks folder 5) Delete or move the AuthPlayLib.bundle file Adobe Reader 9.x- UNIX 1) Go to installation location of Reader (typically a folder named Adobe) 2) Within it browse to Reader9/Reader/intellinux/lib/ (for Linux) or Reader9/Reader/intelsolaris/lib/ (for Solaris) 3) Remove the library named "libauthplay.so.0.0.0"
相關資訊連結	http://www.google.com.tw/search?sourceid=navclient&aq=hts&oq=&hl=zh-TW&ie=UTF-8&rlz=1T4GGLL_zh-TWTW353TW353&q=CVE-2010-1297
相關修正資訊連結	http://get.adobe.com/flashplayer/