Slashdot Mirror
New Adobe Flash Vulnerabilities Being Actively Exploited On Windows and OS X
Orome1 writes "Adobe has pushed out an emergency Flash update that solves two critical vulnerabilities (CVE-2013-0633 and CVE-2013-0634) that are being actively exploited to target Windows and OS X users, and is urging users to implement it as soon as possible. According to a security bulletin released on Thursday, the OS X exploit targets Flash Player in Firefox or Safari via malicious Flash content hosted on websites, while Windows users are targeted with Microsoft Word documents delivered as an email attachments which contain malicious Flash content. Adobe has also announced its intention of adding new protections against malicious Flash content embedded in Microsoft Office documents to its next feature release of Flash Player."
I know many will rush to disagree with me but Flash cannot die soon enough...
I realize that implementing embedded flash objects in Office documents was probably something that mostly happened because Microsoft wanted OLE to make embedding arbitrary stuff in arbitrary stuff happen(unlike Adobe's sick fetish for inserting horrible things into PDFs, which is their own damn fault); but do Flash embeds in Office documents actually occur, in the wild, as something people would actually do and distribute, for anything other than malicious purposes? I honestly can't remember ever having seen a single one, ever.
I wonder if this and Java are related to the HUE monster security update for IE?
http://saveie6.com/
And replace it with what? The atrocity also known as HTML5 which is not write once run anywhere, is an absolute bear to code and despite the hype is nowhere near suitable for gaming yet?
There's a reason Flash is the world's most popular online multimedia platform. It's not without issues, but it is lacking a worthy contender.
------ The best brain training is now totally free : )
I'm typing this on a Win 7 notebook w Firefox. KSHE's playing right now (using Flash, of course) and no notification came to me, although some virus defs came through this morning.
Windows users are targeted with Microsoft Word documents delivered as an email attachments which contain malicious Flash content
Why? They could as easily infect you with a macro. Who in their right mind opens a Word doc from and unknown source, especially when Windows warns you when you start to open a word doc in Outlook (we use Outlook at work).
I just wish Flash would stop crashing every single time I have it hibernate when I'm listening to the radio.
Free Martian Whores!
Get the fuck out of the business of doing anything that can connect to the internet. Because you suck at it.
Another reason why proprietary addons that can execute code are a bad idea on the open web. Java got picke do enough last month. Flash also executes code by its very nature so of course it will have holes in it.
http://saveie6.com/
1. Develop a technology and an authoring tool
2. Add features at a breakneck pace so no one can compete on the authoring tool
3. Profit!
4. Fix vulnerabilities until the end of times
Or, don't even run it. Flash has been a security and privacy hole for a decade or more.
I refuse to install it except on work machines where I periodically have to use it for something I can't avoid.
Yet another exploit? I'd like to say I'm shocked, but that would be a lie.
Lost at C:>. Found at C.
For way to many years it's been a mess. And these near-daily emergency patches now. WTF is broken in their development/testing process? I don't understand how it can stay so horrid, or why Adobe finds this acceptable...
Even Windows has gotten a lot more secure over the years. But Flash, seems more broken each day.
Anyone have any insight?
Automatic flash updates. TFA states that Firefox and Safari on Mac are currently vulnerable and require manual update. Even IE10 on Win8 is doing auto updates. My odds of getting exploited via this vulnerability on my Chromebook? Basically zilch?
Why the fuck does a WORD PROCESSOR even allow embedded Flash files?! Payloading like this shouldn't even be possible in the first place, that would be as bad as embedded .EXE files in a .doc that autorun when you open the .doc
Email attachments have been a security and privacy hole for a decade.
Some people die at 25 and aren't buried until 75. -Benjamin Franklin
Such is the mantra here...
Sooo tempted to send the CVE out to several people internally, as a word document.
*sigh*
Does Adobe even ever get wrist-slapping fines for being one of the Horsemen of the Internet Apocolypse? They seem quite to content to write shit code and leasurely fix it when their excrement is pointed out.
This particular vulnerability might be patched, but you're wide open to hundreds of others. Flash is not something a responsible OS distributor should install by default.
The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
One thing that I see as causing some people to delay updating their Flash, despite an update being available, is that the installer requires you to restart your browser or anything else Flash think is using it. Many people take the attitude "I am working and don't want to be bothered restarting my apps, for something I rarely use".
Is there any other way Flash could install its updates, without requiring browsers to be restarted?
Jumpstart the tartan drive.
I'd like to see the explanation as to how my Chromebook could be "wide open to hundreds" of Flash vulnerabilities. Seems preposterous from what little I know about Flash and how it interacts with Chromebook's locked-down Gentoo-based OS.
Some time ago, after the last round of Flash exploits, I de-installed it and resolved to live without it.
There are glitches: I can't get most video content, and Flash-only sites are inaccessible. However, this ended up being not a big issue.
One reason for this is that many YouTube videos play in HTML5 on Firefox. (If you find a video you can't play, try embedding it; this sometimes produces a workable version.)
Overall, the playback on HTML5 is better than Flash. There are fewer random slowdowns and stall-outs. On the downside, not every video is in HTML5.
The most amazing this is that browser crashes have dropped to near zero, either one or zero during this time. Most of what I thought was FF and Opera being buggy was in fact Flash being buggy.
There's not yet enough content switched to HTML5 from Flash to navigate everything, but during my 6 months without Flash, I've noticed that more firms are going away from the Flash-only navigation school of design.
YMMV. For me, life without Flash has been better, although I do miss out on some things.
Futurist Traditionalism
Let me say up front that I'd love to be rid of flash forever, but that said... there seems to be an inseparable bond between multimedia and flash.
However....
I don't have cable... I don't watch enough TV to justify the expense... but there's a handful of shows (3 of them) that I really *do* like to watch each week, and the networks that air them in my area coincidentally also have those shows available for streaming one day after they air, which allows me to watch them at my convenience. The caveat is that all of these networks require flash to watch the programs in a browser window.
Okay, so I'm also still sitting through a minute or so of commercials every 8 to 10 minutes, much as I would if I watched it live, but this is preferable to me to not watching the shows I like at all.
I choose to not resort to piracy because I don't subscribe to the notion that just because I might want something that somebody else made, that this should somehow mean I am entitled to have it on terms that the maker never agreed to.
Show me an html5 alternative that a) provides a seamless viewing experience; and b) content makers will be sufficiently satisfied with the level of control that it offers that they are actually willing to utilize it (which is realistically still going to mean that the distributor gets to insert advertisements at places of their choosing), and I'd love to say goodbye to flash forever.
File under 'M' for 'Manic ranting'
TFA is spreading FUD. I've had self-updating flash on OS X for at least a year now, IIRC. Yes, it has been self-updating for safari and other browsers, all automagically. Yes, you can manually disable autoupdates, but then it's your own damn fault.
A successful API design takes a mixture of software design and pedagogy.
A simple way to make Internet Explorer block Flash by default: Gear icon -> Safety -> ActiveX Filtering.
After that, you can re-enable Flash for selected sites by clicking the blue icon in the address bar.
From Adobe's Security Bulletin Affected software versions Adobe Flash Player 11.5.502.146 and earlier versions for Windows and Macintosh Adobe Flash Player 11.2.202.261 and earlier versions for Linux Adobe Flash Player 11.1.115.36 and earlier versions for Android 4.x Adobe Flash Player 11.1.111.31 and earlier versions for Android 3.x and 2.x If you're running on Android it might not show in the market but if you view "All Apps" which shows previously installed apps along with ones currently installed, Flash will be there and say Update next to it. I think it's also interested that this comes about a week since Firefox started blocking all plug-ins by default, except Flash.
We see here how the Windows platform has been battle hardened to the point where the attackers have to resort to lower-yield secondary attacks. Head-on attacking Flash on Windows does not get the attacker very far because of the security advancements such as Mandatory Integrity Control (MIC). That's why the attackers try to exploit it in contexts where MIC does not prevent system infection, such as through older versions of Microsoft Word through emails.
OS X is still wide open to such head-on attacks when a vulnerability exists, especially Firefox because Mozilla has steadfastly refused to put in place a proper sandboxing barrier. Even Safari has some sandboxing in the latest version of OS X.
Firefox not. A vulnerability in Firefox or one of its plugins means significant risk of successful exploits.
Flash on Windows executes in a low-integrity process. Even if a Flash vulnerability is exploitable and shellcode gets to execute in the Flash host process, it still cannot write anywhere or interact with higher integrity objects because of mandatory integrity control (MIC) which was introduced with Vista.
The upshot: Attackers have to try secondary routes on Windows where the conversion rates are much, much lower. And this specific attack vector will not work on Word (or other Office applications) since Word 2010. Since the 2010 versions, internet downloaded documents are also opened in low-integrity mode, meaning that even here the shellcode would be similarly restricted.
Reading slashdot one-liner: (irm http://rss.slashdot.org/Slashdot/slashdot).rdf.item | fl title,desc*
This is the primary reason I use Chrome: so that I don't have to bother with a system-wide Flash. I can still watch cat videos (by clicking on them), but my word processor can't be infected through software that's not installed.
Dewey, what part of this looks like authorities should be involved?
Lets all push to get rid of alternative runtimes once and for all.
I haven't thought of anything clever to put here, but then again most of you haven't either.
Does this bug also affect users of those OS's, because last time I heard
a) Adobe isn't offering a flash package for current android
b) Adobe isn't offering updates to the Linux flash version.
I'll assume that Linux users can have the vulnerable version, is there something in the OS that makes them immune or were they just not mentioned?
Flash compiles to Android and iOS without any problems-- beyond the hassle of dealing with the App store and developer certs of course.
Angry Birds was originally written in Flash. So was Canabault-- which you may not have heard of, but every "running" game out there owes a debt to. There's tons of iOS apps built in Flash.
I'd be perfectly happy to see flash off the browser and used for what it's best at-- desktop or mobile applications.
Before I get flamed for suggesting that Flash is an appropriate dev tool for mobile, keep in mind that a crappy app with a lame UI and tons of memory leaks is not the fault of the platform-- it's the fault of the programmer. JAVA, I'm looking at you here, with a degree of sympathy.
Got a reference for that? My understanding was that it was originally written in C, for iOS, and later ported to other platforms.
File under 'M' for 'Manic ranting'
If all these networks didn't insist on using it for their shows, I'd be quite happy to uninstall flash entirely. But they do, so I don't.
File under 'M' for 'Manic ranting'
I read it in a game blog somewhere... it must be true!
My impression was that the prototype/proof-of-concept was built in flash, with (as you suggested) the native-code versions built later. I, of course, could be completely mistaken in which case I'm sure someone will correct me, preferably with an anecdotal car-analogy.
Flash is blocked on all of my devices. And has been for a long time. There's absolutely no need for flash.
I understand some of their reasoning and am not critical of it.
If anything, I think every FireFox user should try it without Flash. There just are not crashes. It's inspiring.
Futurist Traditionalism