Slashdot Mirror
Shockwave Vulnerabilities Affect More Than 450 Million Systems
Trinity writes "Researchers from VUPEN have discovered critical vulnerabilities in Adobe Shockwave, a technology installed on over 450 million Internet-enabled desktops. The vulnerabilities could allow remote code execution by tricking a user into visiting a web page using Internet Explorer or even Mozilla Firefox. Version 11.5.1.601 as well as earlier ones are affected. The vendor recommends upgrading to version 11.5.1.602." Especially sobering when you consider Adobe's current push to be essentially required as an intermediary player for anyone who wants to see certain government data.
Not just a good idea. It's the law.
As there are over a billion computers with Windows vulnerabilities and countless other "at risk" applications that get patched regularly this doesn't sound like a situation all that out of the ordinary. And as with Windows some users will update and some will remain at risk.
As of posting, there's no MSI installer for the new version yet, and the .exe installer doesn't seem to support silent installs.
http://www.appdeploy.com/packages/detail.asp?id=1438
First dupe articles, now dupe posts!
Sometimes, life itself is sarcasm...
I find it harder and harder to really give a shit anymore. All of our systems (linux, Windows ,OSX) all have various automatic patching schemes. Once the vendor gets around to fixing their crap (Adobe in this case) we'll ingest the patch and move on.
Once upon a time I monitored the various security announcement lists but ultimately it didn't matter. Most of this crap has become mission critical so turning it off isn't an option, fixing it yourself is rarely and option so you're left with wait and patch solution.
I guess it's kind of free'ing. I no longer stress about it and focus on more relevant issues.
What's the difference between Shockwave and Flash?
Or are they the same thing? If so, why two names for it?
You're welcome.
Sex? Cars? Come on, I'm sure we can think of something.
Faster! Faster! Faster would be better!
If you're having problems installing the updated Shockwave player, it may be because you have Data Execution Prevention enabled.
To disable:
Look in the root of your C: drive for boot.ini.
Start a command line. Attrib c:\boot.ini -r -a -s -h
Edit boot.ini (In notepad)
Look for "noexecute=optin" and change it to "noexecute=AlwaysOff" (don't add or remove any spaces, line breaks, etc)
Save boot.ini.
In the command window type attrib c:\boot.ini +r +a +s +h
Reboot. DEP is now disabled.
Install the Shockwave Player update.
Re-edit boot.ini to re-enable Data Execution Prevention, and reboot once again.
Alternatively you can save a copy of the edited boot.ini, set the attribs to +r +a +s +h, and rename as necessary in case (read: when) you need to disable DEP again in the future.
I figure a lot of users are going to have this problem (again), as Adobe still hasn't fixed this bug.
> Is he worried the gov will abuse this hole?
No. He's worried that that the government is going to make their data inaccessible to anyone who doesn't install a useless piece if junk that would make their computer insecure.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
Even Adobe can't explain Shockwave properly.
Shockwave is a real 3D system usable as a decent game engine. At one time, it even had the Havok physics engine, but Adobe didn't keep up the payments and had to take that out. Try BMX Street Rider, which is a reasonably decent free-play game in a modest sized city. It's way ahead of the proposed hacks for doing 3D with Javascript.
What killed Shockwave for trivial applications is "LOADING..." problems. Flash can start before all the content has been loaded, because Flash has two interleaved streams, a timeline and assets. As soon as you have enough assets for the stuff needed by the timeline so far, Flash can go. So you can write Flash that starts fast and loads assets in the background.
I just dont use adobe products anymore, either flash, or shockwave, are too seriously integrated into our pcs, that when the day comes that skynet is self aware, that will be the first application it looks to to take over all pcs around the world....have we not learned anything from terminator?
I did too – then I realized that I didn't have Shockwave in the first place. I had Flash, which is different. Now I'm considering uninstalling Shockwave again, because I didn't need it before and I don't expect to need it in the future.
Are you sure you had it to begin with?
"Shockwave Flash" is Flash (plays .swf files). "Shockwave for Director" is Shockwave (uses .dcr files).
Yes, it's confusing. You can thank Adobe for that.
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
Google Gnash and Swfdec; they're coming along nicely, but aren't 100% replacements as of yet.
"Our country is not nearly so overrun with the bigoted as it is overrun with the broadminded." -Archbishop Fulton Sheen
1. Yes/no.
2. See above. Nobody cares about Shockwave, though.
3. Yes.
It's called Gnash. See http://www.gnu.org/software/gnash/
There's also a few others, such as http://swfdec.freedesktop.org/wiki/ . Gnash is probably better.
I have developed a truly marvelous proof of this comment, which this signature is too narrow to contain.
Ok, I just compiled some stats on Shockwave version plugin distribution using roughly 30 million unique data points from July 1 of this year until about a week ago - here is roughly the distribution (includes IE/FF/etc. - all major browsers):
Not installed => 67.54%
11,0,0,0 => 2.86%
10,2,0,0 => 2.84%
10,1,0,0 => 2.59%
11,0,0,465 => 2.41%
11,5,0,0 => 2.05%
11,5,1,601 => 1.90%
8,5,1,0 => 1.75%
10,1,4,0 => 1.73%
11,0,0,429 => 1.58%
11,0,3,472 => 1.56%
10,1,1,0 => 1.53%
11,5,0,596 => 1.46%
11,5,0,600 => 1.38%
11,0,3,471 => 1.35%
11,5,0,595 => 1.21%
11,0,0,458 => 0.93%
10,3,0,0 => 0.78%
11,0,3,470 => 0.66%
8,0,0,0 => 0.43%
10,1,3,0 => 0.37%
8,5,0,0 => 0.32%
11,0,3,0 => 0.23%
10,0,0,0 => 0.16%
10,0,1,0 => 0.11%
7,0,0,0 => 0.10%
11,5,1,0 => 0.08%
10,4,0,0 => 0.04%
6,0,0,0 => 0.03%
What is potentially troubling is that there does not appear to be much in the way of upgrade movement in Shockwave installs. So if "Adobe Shockwave Player versions prior to 11.5.2.602" are truly at risk, we are talking about 30% of web users roughly.
I will publish a more in-depth report later today here: http://www.statowl.com/ in the plugin section. I have been neglecting that site anyways - time to update the stats - the past three month are absent - sigh....
2. See above. Nobody cares about Shockwave, though.
Nay, say I and the (many) school districts who visit shockwave-only educational sites. Not having Shockwave Director available on Linux has cost me clients. Talk about a slap in the face for trying to give schools a break by using good software, because they are too attached to bad software..
It is pitch black. You are likely to be eaten by a grue.