Assessment
Why it matters
CISA lists this vulnerability as known to be exploited; exploitation is confirmed; EPSS is 94.2%; technical severity is CVSS 8.8.
Adobe Flash Player before 10.2.154.27 on Windows, Mac OS X, Linux, and Solaris and 10.2.156.12 and earlier on Android; Adobe AIR before 2.6.19140; and Authplay.dll (aka AuthPlayLib.bundle) in Adobe Reader 9.x before 9.4.4 and 10.x through 10.0.1 on Windows, Adobe Reader 9.x before 9.4.4 and 10.x before 10.0.3 on Mac OS X, and Adobe Acrobat 9.x before 9.4.4 and 10.x before 10.0.3 on Windows and Mac OS X allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content; as demonstrated by a Microsoft Office document with an embedded .swf file that has a size inconsistency in a "group of included constants," object type confusion, ActionScript that adds custom functions to prototypes, and Date objects; and as exploited in the wild in April 2011.
Who should care
- Teams operating Acrobat, Acrobat Reader, Adobe Air +4 more
- Vulnerability and exposure management teams
- Security operations teams monitoring exploitation activity
Response plan
What I would do
- Confirm whether Acrobat, Acrobat Reader, Adobe Air +4 more is present in the environment.
- Identify affected versions and establish whether vulnerable services are exposed or reachable.
- Adobe Security advisory Apsa11 02
- Review relevant security telemetry for evidence of attempted or successful exploitation.
- Document the remediation decision and track it to verified completion.
Treatment intelligence
Remediation intelligence
Vendor sources are listed before government and third-party guidance. Confirm product applicability and change prerequisites before deployment.
Advisory
- Adobe Security advisory Apsa11 02Adobe · Vendor sourceVerification pending ↗
- Adobe Security advisory APSB11-07Adobe · Vendor sourceVerification pending ↗
- Adobe Security advisory APSB11-08Adobe · Vendor sourceVerification pending ↗
- Red Hat Security advisory RHSA 2011 0451Red Hat · Vendor sourceVerification pending ↗
Technical details
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CWE
- CWE-843
- Affected versions
- Adobe Acrobat (Start Including 9.0, End Excluding 9.4 | Start Including 10.0, End Excluding 10.0.3); Adobe Acrobat Reader (Start Including 9.0, End Excluding 9.4.4 | Start Including 10.0, End Including 10.0.1 | Start Including 9.0, End Excluding 9.4.4 | Start Including 10.0, End Excluding 10.0.3); Adobe Adobe Air (End Excluding 2.6.19140); Adobe Flash Player (End Excluding 10.2.154.27 | End Including 10.2.156.12); Google Chrome (End Excluding 10.0.648.205); Opensuse Opensuse (Version 11.2 | Version 11.3 | Version 11.4); Suse Linux Enterprise Desktop (Version 10 | Version 11)
- Fixed versions
- Adobe Acrobat (Fixed from 9.4, 10.0.3); Adobe Acrobat Reader (Fixed from 9.4.4, 10.0.3); Adobe Adobe Air (Fixed from 2.6.19140); Adobe Flash Player (Fixed from 10.2.154.27); Google Chrome (Fixed from 10.0.648.205)
- Published
- 13 April 2011
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
Signal timeline
- CVE published
- Added to CISA KEV
- Latest EPSS score: 94.2%
- Signal calculated at 83
External references
- CERT/CC Government advisory 230057
- CISA Government advisory CVE-2011-0611
- Blogs Technet Exploit information CVE-2011-0611
- Exploit information from bugix-security.blogspot.com
- Exploit information from contagiodump.blogspot.com
- Secunia Technical reference
- Secunia Technical reference
- Secunia Technical reference
- Secunia Technical reference
- Securityreason Third-party advisory
- Securityreason Third-party advisory
- Exploit information from www.exploit-db.com