In the past 6 months Adobe has released 16 Security Bulletins addressing 116 vulnerabilities. Of the 16 Adobe Security Bulletins released 81% had vulnerabilities that could be used to exploit the rights of the logged on user. However, if you don’t count the bulletins related to ColdFusion then 100% of the Security Bulletins had vulnerabilities that could be used to exploit user rights. Here’s a breakdown of the Adobe Security Bulletins:
Adobe classifies the bulletins as critical, important, moderate, and low. Similar to Microsoft, critical vulnerabilities can run attacker code and install software without users knowing. Important vulnerabilities also happen without users knowing but can only disclose information to attackers. In most cases, exploit of critical and high vulnerabilities would come in the form of visiting a malicious website or legitimate website serving up malicious content via Flash or an e-mail containing a PDF exploit. Moderate vulnerabilities can only occur if a user has a non-default configuration, and Low vulnerabilities pose no major threat to users. With that classification in mind here’s a breakdown of Adobe Software and Critical and Important Vulnerabilities with Privilege Exploits (there were no Moderate or Low):
With 93% of Adobe Flash, 83% of Adobe Shockwave, and 54% of Adobe Reader critical vulnerabilities having privilege exploitation, any user who has Adobe Flash or Reader installed, has an administrator account, and does not use privilege management software should be concerned. The majority of vulnerabilities, especially for Flash, have dangerous repercussions for user privilege exploitations including complete control over a user’s computer. Privilege management software is the only proven way to limit privilege vulnerability exploits. Privilege management, unlike patching, limits both existing and unknown vulnerabilities from being exploited by always limiting the privileges of the application regardless of the user’s account type.
Software vulnerabilities will be most dangerous to users and businesses if least privilege management best practices aren’t followed. Those best practices include removing administrative rights from end-users, running applications with restricted privileges, and securing administrator accounts. Privilege management software such as Arellia Application Control Solution and Local Security Solution can reduce the impact of vulnerabilities by securing the rights of applications and users.
Original Article at Arellia.com