National Cyber Alert System
Cyber Security Alert SA10-012B
Microsoft Windows and Adobe Flash Player 6 Vulnerabilities
Systems Affected
* Microsoft Windows and Internet Explorer
* Adobe (Macromedia) Flash Player 6
Overview
Microsoft has released updates to address a vulnerability in Microsoft Windows. Microsoft has also published an Advisory about multiple vulnerabilities in Adobe Flash Player 6 that is included with Windows XP.
Solution
The updates to address the Windows font vulnerability are available on the Microsoft Update site (requires Internet Explorer). We recommend enabling Automatic Updates.
Upgrade or Remove Adobe Flash Player 6
To address the Flash Player 6 vulnerabilitites, upgrade to a current version or remove Flash Player using the uninstaller.
Description
Microsoft Security Bulletin MS10-001 describes a vulnerability in the Embedded Open Type (EOT) font engine in Windows. Microsoft Security Advisory (979267) notes multiple vulnerabilities in Adobe Flash Player 6 (formerly Macromedia Flash Player) that is included with Windows XP. The Advisory recommends that Windows XP users upgrade or remove Flash Player
These vulnerabilities may allow an attacker to gain control of your computer or cause it to crash.
References
* Microsoft Security Bulletin Summary for January 2010 -
<http://www.microsoft.com/technet/security/bulletin/ms10-jan.mspx>
* CVE-2010-0018 -
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0018>
* Vulnerabilities in Adobe Flash Player 6 Provided in Windows XP
Could Allow Remote Code Execution -
<http://www.microsoft.com/technet/security/advisory/979267.mspx>
* Vulnerability Note VU#204889 -
<http://www.kb.cert.org/vuls/id/204889>
* Adobe Flash Player - <http://get.adobe.com/flashplayer/>
* How to uninstall the Adobe Flash Player plug-in and ActiveX control
-
<http://kb2.adobe.com/cps/141/tn_14157.html>
____________________________________________________________________
The most recent version of this document can be found at:
<http://www.us-cert.gov/cas/alerts/SA10-012B.html>
____________________________________________________________________
Feedback can be directed to US-CERT Technical Staff. Please send
email to <
cert@cert.org> with "SA10-012B Feedback VU#552113" in
the subject.
____________________________________________________________________
For instructions on subscribing to or unsubscribing from this
mailing list, visit <http://www.us-cert.gov/cas/signup.html>.
____________________________________________________________________
Produced 2010 by US-CERT, a government organization.
Terms of use:
<http://www.us-cert.gov/legal.html>
