Slashdot Mirror
Shockwave Vulnerabilities Affect More Than 450 Million Systems
Trinity writes "Researchers from VUPEN have discovered critical vulnerabilities in Adobe Shockwave, a technology installed on over 450 million Internet-enabled desktops. The vulnerabilities could allow remote code execution by tricking a user into visiting a web page using Internet Explorer or even Mozilla Firefox. Version 11.5.1.601 as well as earlier ones are affected. The vendor recommends upgrading to version 11.5.1.602." Especially sobering when you consider Adobe's current push to be essentially required as an intermediary player for anyone who wants to see certain government data.
Not just a good idea. It's the law.
What's the difference between Shockwave and Flash?
Or are they the same thing? If so, why two names for it?
As there are over a billion computers with Windows vulnerabilities and countless other "at risk" applications that get patched regularly this doesn't sound like a situation all that out of the ordinary. And as with Windows some users will update and some will remain at risk.
I went ahead and updated, just in case, before too many /. readers do, all at once. =P
Is he worried the gov will abuse this hole? If not I fail to see what makes it especially sobering. If it were a client->server hole that would be a problem of course.
Not that I support anything adobe makes aside from photoshop anyways...
You could pretty much take any two security issue threads on here, swap the comments section, and never know the difference.
Software has bugs.
Some of them are security issues.
They get discovered.
They (usually) get fixed.
What's there to talk about?
As of posting, there's no MSI installer for the new version yet, and the .exe installer doesn't seem to support silent installs.
http://www.appdeploy.com/packages/detail.asp?id=1438
First dupe articles, now dupe posts!
Sometimes, life itself is sarcasm...
I find it harder and harder to really give a shit anymore. All of our systems (linux, Windows ,OSX) all have various automatic patching schemes. Once the vendor gets around to fixing their crap (Adobe in this case) we'll ingest the patch and move on.
Once upon a time I monitored the various security announcement lists but ultimately it didn't matter. Most of this crap has become mission critical so turning it off isn't an option, fixing it yourself is rarely and option so you're left with wait and patch solution.
I guess it's kind of free'ing. I no longer stress about it and focus on more relevant issues.
That will take the "or even Mozilla Firefox" right out of there. Never use a browser developed by an organization that makes it's money directly from pushing ads on you. They disallow plug-ins like this.
I judt got a nre Kinesis keybiartf so please excusr ant egregiou typos.
If you're having problems installing the updated Shockwave player, it may be because you have Data Execution Prevention enabled.
To disable:
Look in the root of your C: drive for boot.ini.
Start a command line. Attrib c:\boot.ini -r -a -s -h
Edit boot.ini (In notepad)
Look for "noexecute=optin" and change it to "noexecute=AlwaysOff" (don't add or remove any spaces, line breaks, etc)
Save boot.ini.
In the command window type attrib c:\boot.ini +r +a +s +h
Reboot. DEP is now disabled.
Install the Shockwave Player update.
Re-edit boot.ini to re-enable Data Execution Prevention, and reboot once again.
Alternatively you can save a copy of the edited boot.ini, set the attribs to +r +a +s +h, and rename as necessary in case (read: when) you need to disable DEP again in the future.
I figure a lot of users are going to have this problem (again), as Adobe still hasn't fixed this bug.
To me this just seems like user stupidity. You can have your computer hijacked a million different ways however if you pay attention to what you click you can avoid most.
It is much easier to patch 700 million PCs than it is to make stupid people smarter.
And we're clearly not doing such a good job of patching 700 million PCs.
Rich And Stupid is not so bad as Working For Rich And Stupid.
To disable:
Look in the root of your C: drive for boot.ini.
Start a command line. Attrib c:\boot.ini -r -a -s -h
Edit boot.ini (In notepad)
Look for "noexecute=optin" and change it to "noexecute=AlwaysOff" (don't add or remove any spaces, line breaks, etc)
Save boot.ini.
In the command window type attrib c:\boot.ini +r +a +s +h
Reboot. DEP is now disabled.
Install the Shockwave Player update.
If I hadn't looked closely I would have assumed this was a relatively painless set of steps an end user would need for doing some workaround in linux.
Actually, adobe has pissed me off many times. Shockwave, in particular, is a bitch to remove because Adobe gets all funky with file permissions - unnecessarily.
Even Adobe can't explain Shockwave properly.
Shockwave is a real 3D system usable as a decent game engine. At one time, it even had the Havok physics engine, but Adobe didn't keep up the payments and had to take that out. Try BMX Street Rider, which is a reasonably decent free-play game in a modest sized city. It's way ahead of the proposed hacks for doing 3D with Javascript.
What killed Shockwave for trivial applications is "LOADING..." problems. Flash can start before all the content has been loaded, because Flash has two interleaved streams, a timeline and assets. As soon as you have enough assets for the stuff needed by the timeline so far, Flash can go. So you can write Flash that starts fast and loads assets in the background.
Especially sobering when you consider Adobe's current push to be essentially required as an intermediary player for anyone who wants to see certain government data.
Adobe is pushing for Flash and PDF... not Shockwave and PDF...
Not on my computer.
1) Are there FOSS alternatives to Flash and/or Shockwave?
2) Why(not)?
3) If there was, would it help reduce problems like this?
Please don't mod me as trolling for asking questions!
Utilizing the synergization of benchmark e-solutions to pre-workaround action items!
I just dont use adobe products anymore, either flash, or shockwave, are too seriously integrated into our pcs, that when the day comes that skynet is self aware, that will be the first application it looks to to take over all pcs around the world....have we not learned anything from terminator?
Download the Shockwave software and run the UNinstall script.
Google Gnash and Swfdec; they're coming along nicely, but aren't 100% replacements as of yet.
"Our country is not nearly so overrun with the bigoted as it is overrun with the broadminded." -Archbishop Fulton Sheen
I'm a Linux user, you insensitive clod!
1. Yes/no.
2. See above. Nobody cares about Shockwave, though.
3. Yes.
It's called Gnash. See http://www.gnu.org/software/gnash/
There's also a few others, such as http://swfdec.freedesktop.org/wiki/ . Gnash is probably better.
I have developed a truly marvelous proof of this comment, which this signature is too narrow to contain.
Ok, I just compiled some stats on Shockwave version plugin distribution using roughly 30 million unique data points from July 1 of this year until about a week ago - here is roughly the distribution (includes IE/FF/etc. - all major browsers):
Not installed => 67.54%
11,0,0,0 => 2.86%
10,2,0,0 => 2.84%
10,1,0,0 => 2.59%
11,0,0,465 => 2.41%
11,5,0,0 => 2.05%
11,5,1,601 => 1.90%
8,5,1,0 => 1.75%
10,1,4,0 => 1.73%
11,0,0,429 => 1.58%
11,0,3,472 => 1.56%
10,1,1,0 => 1.53%
11,5,0,596 => 1.46%
11,5,0,600 => 1.38%
11,0,3,471 => 1.35%
11,5,0,595 => 1.21%
11,0,0,458 => 0.93%
10,3,0,0 => 0.78%
11,0,3,470 => 0.66%
8,0,0,0 => 0.43%
10,1,3,0 => 0.37%
8,5,0,0 => 0.32%
11,0,3,0 => 0.23%
10,0,0,0 => 0.16%
10,0,1,0 => 0.11%
7,0,0,0 => 0.10%
11,5,1,0 => 0.08%
10,4,0,0 => 0.04%
6,0,0,0 => 0.03%
What is potentially troubling is that there does not appear to be much in the way of upgrade movement in Shockwave installs. So if "Adobe Shockwave Player versions prior to 11.5.2.602" are truly at risk, we are talking about 30% of web users roughly.
I will publish a more in-depth report later today here: http://www.statowl.com/ in the plugin section. I have been neglecting that site anyways - time to update the stats - the past three month are absent - sigh....
Thanks, i've added those to my Del.ico.us for later investigation. :)
Utilizing the synergization of benchmark e-solutions to pre-workaround action items!
Would you believe, that's the second biggest rootkit I've ever seen?
Pretty much where I'm at while I continue to throw good coin at my local robocall entitlement company and diligently recycle dead trees hand delivered by my local robomail entitlement crown corp. There used to be a number of disposable single blade razors that worked well for me, all since driven out of the market. Now I lease my triple-blade manhood from Warren Buffett at triple the price.
Ah yes, the old "and loving it" trick.
with dupe jokes, and dupe +5 mods.
and finally a dupe commenting on all the dupes from top to bottom.
surely there must be something original...
"You're very clever, young man, very clever", said the old lady. "But it's DUPES all the way down!"
what exactly does "upgrade movement" mean?
I rarely see Web sites use Shockwave. And if I do, it usually games. 99% of the stuff I see are in Flash. If I need it, I will just reinstall, look/use, and then uninstall it.
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
IF you look in Firefox add-ons/plugins it will be listed as
"Shockwave for Director 11.5.2.602"
whereas regular flash player is listed as
"Shockwave Flash 10.0.32.18"
I don't think 450,000,000 desktops out there have a shockwave player installed? I doubt it is that popular.
As the island of our knowledge grows, so does the shore of our ignorance.
what exactly does "upgrade movement" mean?
That means that it would appear shockwave users do not frequently upgrade. They probably had to install the plugin to view something and then they forget about it. In this case, this may leave more people open to attack.
2. See above. Nobody cares about Shockwave, though.
Nay, say I and the (many) school districts who visit shockwave-only educational sites. Not having Shockwave Director available on Linux has cost me clients. Talk about a slap in the face for trying to give schools a break by using good software, because they are too attached to bad software..
It is pitch black. You are likely to be eaten by a grue.
Rolled this out to a small lab (you know how students are, and where they can go, better safe than...).
After installation, *all* users are asked to individually install another component when the Shock embed in the open page attempts to play (which as non-admins, they can't do). Since several of our teaching programs Shockwave this presents a real PITA.
Previously there was no such behavior. Any ideas?
Oh, so this isn't a story about astronomy... what a relief!
with dupe jokes, and dupe +5 mods.
and finally a dupe commenting on all the dupes from top to bottom.
surely there must be something original....
"You're very clever, young man, very clever", said the old lady. "But it's DUPES all the way down!"
I checked my firefox addons list and sure enough, Shockwave was in there. The plugins were Disabled. Well, I might as well get rid of it if I never use it, no? And so the hunt began. I checked my add/remove list. Nope, not there. I tried searching for its files, but still couldn't find it. I googled how to uninstall it, fretted over the invisible and uninstallable evil program with security holes hiding on my computer as I navigated some links, checked the firefox plugin page, and after ten or so minutes I discovered... ... that I don't actually have Shockwave. Just the firefox plugins, which came along for the ride when I copied firefox over from my old computer.
D'oh.
At the rate the RDBMS is moving right now - those updated Shockwave reports will not be up until tomorrow. That happens a lot with mediocre hardware and millions upon millions of rows to process. It seems like only yesterday I thought those servers were really fast....
Believe it or not, Adobe dropped the Hardware acceleration right before release of flash 10.
The pseudo3D support and pixel bender are software-only in flash. From you can get from brief blogs is that they abandon the hole thing. I am sure we wont get GPU acceleration in version 11 either, and i bet v12 too.
Search for flash 11 features if you don't believe me. On the other hand there are rumors that microsoft will have GPU support in sl 4.
but the electric force is 36 orders of magnitude stronger than gravity! 36 magnitudes! Did i mention the electric force is 36 orders of magnitude stronger than gravity because the electric force is 36 orders of magnitude stronger than gravity.
The last Adobe flash update installed McAfee Security Scan without my even noticing. So watch out for those pre-check boxes.
Only a month or so ago, I still had Shockwave 9 installed. I'm sure I'm not alone in saying I have a good number of programs installed on my computer, and keeping track of which ones need updates is a real chore that I usually just (unwisely) ignore. But, then I found this great free program called Secunia PSI. Every week I just click "Scan" and it compares the software installed on my computer, including windows, with an online database, and reports anything that has known security vulnerabilities.
...
with dupe jokes, and dupe +5 mods.
and finally a dupe commenting on all the dupes from top to bottom.
surely there must be something original....
"You're very clever, young man, very clever", said the old lady. "But it's DUPES all the way down!" ...