Slashdot Mirror
Adobe Pushes Emergency Flash Player Security Fix
wiredmikey writes "As expected, Adobe today released a security update for its Flash Player. The out of cycle update addresses critical security issues in flash player as well as an important universal cross-site scripting issue. Adobe reported that one of the vulnerabilities (CVE-2011-2444) is being exploited in the wild in active targeted attacks designed to trick the user into clicking on a malicious link delivered in an email message. To illustrate the importance of keeping systems up to date, including Adobe Flash products, the fact that the RSA cyber attack was executed using a spear phishing attack with an embedded flash file should serve as a friendly reminder. RSA was breached after an employee opened a spreadsheet that contained a zero-day exploit that installed a backdoor through an Adobe Flash vulnerability."
The sooner we can get rid of Flash, the better. Bring on the HTML5, which will have no security vulnerabilities whatsoever!
Oh. Really? ;)
Adobe used to mean something to the computing world. Now it is just the proponent of the worst jerry-rigged encapsulation methods and application platforms for malicious exploitation.
Adobe was the company that trained me to press CTRL+S at least every two minutes so I wouldn't lose too much work the next time Premiere crashed, and to save to a new file every couple of hours so that I wouldn't lose too much when it corrupted the save.
All you have to worry about is...
http://www.pcmag.com/article2/0,2817,2368269,00.asp
This one took about a week...
http://www.slashgear.com/apples-mac-os-x-security-update-2011-005-blocks-stolen-diginotar-certificates-09178410/
Maybe u can just go to slashd0t.org instead if you set up your internal certs proper if your on a mac :) .
Coming soon, can you set up local certs on a mac? rats... google returned a hit... :)
https://discussions.apple.com/thread/2734627?start=0&tstart=0
even better
PDF should not be a distribution method for online documentation or viewing in web browsers, it should be available as a tertiary format FOR PRINTING ONLY
Web browser developers have treated CSS paged media as a mere afterthought. What's the best practice to distribute paged media such as slide presentations for on-screen viewing?
Flash should not be the default video player. But it is.
I agree for pixel-based video, not so much for vector-based cartoons, at least until 2014 when Windows XP dies (taking IE <= 8 with it) and until browsers' SVG renderers become much faster.
Flash is truly become one big pile of steaming crap! I used to be against Apple, but frankly I think it should be made unlawful and Adobe fined a trillion dollars for every security incident involving that piece of garbage.
Fucking hell, all of this so we can watch some fucking videos on the Internet and be annoyed by idiotic ads. Somebody, please, wipe Adobe out. They have become, through their sheer stupidity and incompetence, a force for online evil.
The world's burning. Moped Jesus spotted on I50. Details at 11.
They change their bundleware push every few weeks to months, it seems to vary a bit. Chrome is a recent addition, some McAffee shit was before that, I think the bing toolbar may have shown up once or twice...
.bomb affiliate sleazeware; but it isn't a google-specific thing(though Google is getting themselves rather dirty by association, particularly when they have google.com from which to offer things, which is a pedestal that few can hope to aspire to...
It's atrociously unprofessional on Adobe's part, very 90's
Nation-State Attackers Are Adobe's Biggest Worry: [A]dobe has contacts in the big defense contractors, government agencies and other organizations that are most often the targets of state-sponsored attacks. So when a new attack begins, the company typically hears about it within hours as customers begin to call and report a new threat involving an Adobe product. Now, says Brad Arkin, the senior director of product security and privacy at Adobe, it's at a point where the company's main adversaries are state-sponsored actors. Arkin said that when a new attack involving a zero-day bug in one of Adobe's products starts, it typically will begin with attacks against a select group of high-profile organizations. That usually means defense contractors, government agencies or large financial services companies. [HSEC-1.2; Date: 20 September 2011; Source: http://threatpost.com/en_us/blogs/nation-state-attackers-are-adobes-biggest-worry-092011%5D
How do I get this vital security update for my iPhone?
"We live in a global world" - Harvey Pitt, former Securities and Exchange Commission Chairman
Cross-site Scripting FAQ http://www.cgisecurity.com/xss-faq.html
Believe me, if I started murdering people, there would be none of you left.
It's sad that we need something like this, but I'm glad it exists. There's an RSS feed from the Adobe Product Security Incident Response Team.
when I say I don't care because to me Flash is DEAD. Ever since HTML 5 started congealing, I've seen no reason to bother with Flash outside of simple animations. Which is where it started. And should have stayed, but with MM Director dying a slow and deserved death in the mid 90s, they had to find new work for the engineers....
Shoes for Industry. Shoes for the Dead.
Nice quickly installing slim version, no junk and no download manager etc required:
IE
http://fpdownload.adobe.com/get/flashplayer/current/install_flash_player_ax.exe
Firefox etc
http://fpdownload.adobe.com/get/flashplayer/current/install_flash_player.exe
Waterfox - a Firefox fork with legacy extension support, security updates and better privacy by default.
Does this also affect the 64 bit version 11? Just curious since they haven't updated it for 2 weeks.
The world is made by those who show up for the job.
the more features you add to a program the more likely it is to be exploited. it also doesn't help to be closed source.
Anons need not reply. Questions end with a question mark.
Is every security update now front page-worthy news? Maybe it's been a slow news day or something, but Flash security patches aren't exactly a rare occurrence. Might as well have an article "SUN COMES UP AGAIN TODAY!"
Adobe was the company that trained me to press CTRL+S at least every two minutes so I wouldn't lose too much work the next time Premiere crashed, and to save to a new file every couple of hours so that I wouldn't lose too much when it corrupted the save.
Heh, I learned that already in childhood playing Sierra games. Save early, save often and keep your old savegames. Of course that was by design, maybe they were just trying to prepare people for work life? It has certainly saved my ass a few times...
Live today, because you never know what tomorrow brings
For those few (like me) who use SeaMonkey with "Advertise Firefox compatibility" disabled, the download site for Flash is broken. You wind up in a loop without ever getting the download. Either enable "Advertise Firefox compatibility" or spoof Firefox in some other way. Then, before trying the download site, remove all Adobe cookies. Yes, it's another case of invalid UA sniffing.
When you finally download, you get a stub installer, not a complete installer. This is true for everyone, including users of IE and Firefox. To download the complete installer, see http://forums.adobe.com/thread/889580?tstart=0.
I'm not sure why I pursued this so vigorously. Normally, I browse the Web with Flash disabled.
These people at Adobe are getting unbelievable. Now, the way that you could previously have gotten an offline installer (choose different OS/different browser), foists you a web downloader instead of a full installer, and guess what? You run it, and it deletes itself! Besides foisting Google Toolbar on you (or McAfee Antivirus crapware if you are downloading Firefox flash), this is about as slimeball as it gets.
Does this effect the Flash 11 beta?
My browsers aren't either.
Only couple of cases when I do click on flashblock is - in youtube or vimeo when they don't have html5 support
It doesn't matter how quickly Adobe push out security updates, their updater is ineffective because it has too many manual steps, when it should be able to be completely automated like Windows Update is.
Most users that I have seen simply click "Cancel" every time they start up their computer and the updater comes up, because they don't know what it is, and have been tought not to install software that they don't know.
Tepples listed one good use for PDFs (natively paginated documents, such as IRL slideshows/presentations)
The impression I got from the top-level post was that documents SHOULD NOT* be natively paginated and SHOULD be authored for scrollable media. Slideshows/presentations allegedly lead to PowerPoint syndrome.
a PDF viewer that almost invariably supports both continuous scrolling and single-page viewing.
In theory, yes. But in practice, people still distribute PDFs with two-column layouts intended for printing. And even with one-column layouts, continuous scrolling still leaves a two inch gap between the text at the bottom of one page and the text at the top of the next.
Unless someone is using a PDF viewer implemented in Flash *shudder*
That was FlashPaper, Macromedia's competitor to Acrobat before Adobe bought Macromedia. Nowadays, even though PDF technology has nothing to do with Flash technology, they're associated in people's minds under the banner of "Adobe products".
* In the sense of RFC 2119.