Slashdot Mirror
Adobe To Patch Flash 0-Day Friday
Trailrunner7 writes "Adobe is planning to patch the recently disclosed Flash Player vulnerability on Friday — just four days after it was disclosed — for users on Windows, Mac OS X and Linux. The vulnerability is being used in targeted attacks right now that use malicious Word documents. Adobe said it plans to push out the Flash Player patch for Google Chrome today, as part of the Chrome release channel, but Reader X users will have to wait till June for a fix."
Impressive.
At least my iPad is still safe.
HOW MANY MORE TIMES?
Do NOT open a document that you're not expecting, that isn't from someone you know, etc. Yeah, you could say that this can be passed legitimately from person to person but come on - this is the first rule of virus protection - don't open documents without screening them (not via some magical software that "knows" if it's bad or not, but by using your brain) first.
The fact that you can even still GET a Word virus whether it executes in macros, integrated Flash or some other ActiveX-based crap, tells you that Microsoft just don't care any more.
The vulnerability exists in Flash Player not Microsoft Word. A Word document is simply the package being used to distribute the payload.
Doesn't Slashdot post this same article every week?
And the whole damn country can be taken down by a media player. Truly fascinating.
For justice, we must go to Don Corleone
It must have been something you assimilated. . . .
Why should I?
It's a fucking document. It's a series of bits which are converted into pixel values and shown on a screen, not code.
If you get your computer compromised by a document, then the only person who's fault it is is the one who wrote the document decoder (and/or the idiot who decided that documents should include embedded code, which is ridiculous).
You have your computer configured right now to accept documents that you're not expecting -- jpegs, all over the web. But you do this all the time, because you know that the folks who wrote your browser managed to not fuck up a jpeg decoder -- no matter what's in that file, the worst it can make you do is get in trouble with your boss.
Likewise, you feel, or you should feel, perfectly safe running vim on anything that comes your way, since going "vim virus.txt" is not going to do bad things to you, no matter what's in there -- because the people who wrote vim are not morons.
The same ought to be true for other document formats. Perhaps I am an old fuddy-duddy, but there is absolutely no reason that any responsible document format needs to contain executable code -- and if any document decoder mistakes data for code (via a buffer overrun or similar), then their ass is the one to blame.
If it's that horrible song, maybe they could patch some talent into it.
Try to uninstall Adobe Flash for a week. I did and I can't say that I miss anything.
YouTube:
- The HTML5 beta works rather well with modern browsers like Firefox 4.0 and nearly every video is available. You don't need a Google account. The setting is stored in a cookie.
- If you're on Linux, try Minitube. It's a standalone player for YouTube that uses hardware acceleration.
Thanks to the iPad, more and more web sites offer alternatives to Flash. My preferred news TV station is now streaming both with Ogg/Theora and H.264.
Yes, I can't view the occasional funny cat video because it's only available in Flash format but guess what: I'm still alive.
A new vulnerability can be found by white hats and reported to the company, which is not a 0-day. A new vulnerability can be found by black hats and exploited before the company knows about it. That's a 0-day, and it's problematic because they company wasn't able to attempt to mitigate or fix the problem before it was exploited. Not all new vulnerabilities are 0-days; probably most are not. It's not important whether a vulnerability was found the first day the software was released or not. The important thing is how long it takes the company to respond. If they had no knowledge of the vulnerability, it's a worst case scenario.
What a fool believes, he sees, no wise man has the power to reason away.