Slashdot Mirror
New Adobe Flash Vulnerabilities Being Actively Exploited On Windows and OS X
Orome1 writes "Adobe has pushed out an emergency Flash update that solves two critical vulnerabilities (CVE-2013-0633 and CVE-2013-0634) that are being actively exploited to target Windows and OS X users, and is urging users to implement it as soon as possible. According to a security bulletin released on Thursday, the OS X exploit targets Flash Player in Firefox or Safari via malicious Flash content hosted on websites, while Windows users are targeted with Microsoft Word documents delivered as an email attachments which contain malicious Flash content. Adobe has also announced its intention of adding new protections against malicious Flash content embedded in Microsoft Office documents to its next feature release of Flash Player."
I know many will rush to disagree with me but Flash cannot die soon enough...
I realize that implementing embedded flash objects in Office documents was probably something that mostly happened because Microsoft wanted OLE to make embedding arbitrary stuff in arbitrary stuff happen(unlike Adobe's sick fetish for inserting horrible things into PDFs, which is their own damn fault); but do Flash embeds in Office documents actually occur, in the wild, as something people would actually do and distribute, for anything other than malicious purposes? I honestly can't remember ever having seen a single one, ever.
I wonder if this and Java are related to the HUE monster security update for IE?
http://saveie6.com/
And replace it with what? The atrocity also known as HTML5 which is not write once run anywhere, is an absolute bear to code and despite the hype is nowhere near suitable for gaming yet?
There's a reason Flash is the world's most popular online multimedia platform. It's not without issues, but it is lacking a worthy contender.
------ The best brain training is now totally free : )
>Who in their right mind opens a Word doc from and unknown source
The idiot secretary in the next office over, or the next floor down.
Then the payload mines her email addresses and sends you "Minutes from meeting" or some similar crap. So now instead of having an email from an unknown person you get an email from someone you'd expect to get word documents from. Hopefully you are in a company that has decent A/V on incoming mail, most small businesses don't.
Yep. They've years to develop something that doesn't suck balls and failed miserably.
Or, don't even run it. Flash has been a security and privacy hole for a decade or more.
I refuse to install it except on work machines where I periodically have to use it for something I can't avoid.
Yet another exploit? I'd like to say I'm shocked, but that would be a lie.
Lost at C:>. Found at C.
Such is the mantra here...
Sooo tempted to send the CVE out to several people internally, as a word document.
*sigh*
This particular vulnerability might be patched, but you're wide open to hundreds of others. Flash is not something a responsible OS distributor should install by default.
The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
I'd like to see the explanation as to how my Chromebook could be "wide open to hundreds" of Flash vulnerabilities. Seems preposterous from what little I know about Flash and how it interacts with Chromebook's locked-down Gentoo-based OS.
"especially when Windows warns you when you start to open a word doc in Outlook"
Um, some of us have taught them to tick the "don't ask again" box. Sorry about that.
Getting macros to run is harder these days. There's an extra click or two. They don't execute automatically any more.
This post contains benzene, nitrosamines, formaldehyde and hydrogen cyanide.
Some time ago, after the last round of Flash exploits, I de-installed it and resolved to live without it.
There are glitches: I can't get most video content, and Flash-only sites are inaccessible. However, this ended up being not a big issue.
One reason for this is that many YouTube videos play in HTML5 on Firefox. (If you find a video you can't play, try embedding it; this sometimes produces a workable version.)
Overall, the playback on HTML5 is better than Flash. There are fewer random slowdowns and stall-outs. On the downside, not every video is in HTML5.
The most amazing this is that browser crashes have dropped to near zero, either one or zero during this time. Most of what I thought was FF and Opera being buggy was in fact Flash being buggy.
There's not yet enough content switched to HTML5 from Flash to navigate everything, but during my 6 months without Flash, I've noticed that more firms are going away from the Flash-only navigation school of design.
YMMV. For me, life without Flash has been better, although I do miss out on some things.
Futurist Traditionalism
Probably because there is not much you can do to fix a fundamentally bad idea. Think of it like all the various attempts to make smoking 'healthy' at the end of day intentionally sucking combustion gases into your lungs just is not good for you, no matter how low tar, free of synthetic chemicals etc you make it.
What does flash do? It executes code from unknown origin on your machine. That has never been a good idea; even if in some cases you can't get around needing to do it. Flash has more problems though it can't be fully sandbox'ed without breaking all those old apps, it needs to be able to do things like read files, open sockets connections, etc.
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
As far as I can tell, the Flash updater only bothers to check for an update when the computer first boots.
Because everyone here constantly reboots their computer, right? I mean, it's not like most computers have sleep modes, and that most people just leave the OS running so they don't have to wait for it to boot. Clearly everyone constantly reboots their computer, once per day, to allow the Adobe Flash Updater to check for updates.
You are in a maze of twisty little relative jumps, all alike.
Windows users are targeted with Microsoft Word documents delivered as an email attachments which contain malicious Flash content
Why?
Probably because of Windows sandboxing Flash through low-integrity mode. Even if you get to exploit a Flash vulnerability and execute your shell code on Windows, the code is still severely restricted in what it can do. Code executing inside of a low-integrity process can still not infect a system as write-ups (writing or interacting with a higher integrity object/process) are denied.
They could as easily infect you with a macro. Who in their right mind opens a Word doc from and unknown source, especially when Windows warns you when you start to open a word doc in Outlook (we use Outlook at work).
No, infecting with a Macro is more difficult since the last several versions of Word. Word will not automatically run macros and also has an internet-origin policy whereby documents received through Outlook or other email clients or downloaded using a browser is tainted with the "internet zone". You have to dismiss several warnings to run macros from such a document. But if Word will run Flash content (show the animation) and a vulnerability can be exploited, shell code can run as a user.
That is, until Word 2010 which *also* runs in low-integrity when viewing content tainted with the internet zone. Since Word 2010 the shell code will still be confined to the low-integrity sandbox.
Reading slashdot one-liner: (irm http://rss.slashdot.org/Slashdot/slashdot).rdf.item | fl title,desc*
We see here how the Windows platform has been battle hardened to the point where the attackers have to resort to lower-yield secondary attacks. Head-on attacking Flash on Windows does not get the attacker very far because of the security advancements such as Mandatory Integrity Control (MIC). That's why the attackers try to exploit it in contexts where MIC does not prevent system infection, such as through older versions of Microsoft Word through emails.
OS X is still wide open to such head-on attacks when a vulnerability exists, especially Firefox because Mozilla has steadfastly refused to put in place a proper sandboxing barrier. Even Safari has some sandboxing in the latest version of OS X.
Firefox not. A vulnerability in Firefox or one of its plugins means significant risk of successful exploits.
Flash on Windows executes in a low-integrity process. Even if a Flash vulnerability is exploitable and shellcode gets to execute in the Flash host process, it still cannot write anywhere or interact with higher integrity objects because of mandatory integrity control (MIC) which was introduced with Vista.
The upshot: Attackers have to try secondary routes on Windows where the conversion rates are much, much lower. And this specific attack vector will not work on Word (or other Office applications) since Word 2010. Since the 2010 versions, internet downloaded documents are also opened in low-integrity mode, meaning that even here the shellcode would be similarly restricted.
Reading slashdot one-liner: (irm http://rss.slashdot.org/Slashdot/slashdot).rdf.item | fl title,desc*
Does this bug also affect users of those OS's, because last time I heard
a) Adobe isn't offering a flash package for current android
b) Adobe isn't offering updates to the Linux flash version.
I'll assume that Linux users can have the vulnerable version, is there something in the OS that makes them immune or were they just not mentioned?
The 1st paragraph of TFA:
Short of using SELinux or apparmor on Linux (and live with the consequences), there is nothing to prevent an exploit using these vulnerabilities through e.g. Firefox or other non-sandbozed browsers. IIRC Chromium uses a sandbox which would prevent the attack from infecting your account.
Windows uses low-integrity mode to sandbox Flash in browsers which is why the attackers try to use an alternate (and lower yeilding) attack vector through older versions of Microsoft Word (Word 2010 sandboxes the entire document including any Flash content if the document was downloaded from an untrusted source or received through an email)
Reading slashdot one-liner: (irm http://rss.slashdot.org/Slashdot/slashdot).rdf.item | fl title,desc*