Slashdot Mirror
Adobe Patches Nine Vulnerabilities In Flash
jones_supa writes Adobe has patched nine vulnerabilities in Flash Player — four of which are considered "critical" — in order to protect against malicious attackers who could exploit the bugs to take control of an affected system. Adobe acknowledged security researchers from Google, McAfee, HP, and Verisign. Flash's security bulletin contains more information on the vulnerabilities. The issues are fixed in mainline Flash Player 16.0.0.257 (incl. Google Chrome Linux version), extended support release 13.0.0.260, and Linux standalone plugin 11.2.202.429.
Hey, mozilla, please implement proper MSE support, so that youtube actually works thank you!
Hey DICE, please use HTML5 video for slashdot thank you!
Given the track record of Flash, I would say they patched 9 and introduced 18.
Achille Talon
Hop!
Why in the world are we still using this completely unnecessary software?
No, didn't think so. I guess at some point Flash in firefox will just stop working because so many sites will require a more modern version. Funnily enough I don't think I'll care.
Reboot now or crash you browser?
My ism, it's full of beliefs.
The download page crashed FF Nightly. Classy++
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Luckily, Flash crashes before any malicious code can be executed!
"I'm a well-wisher, in that I don't wish you any specific harm."
This sort of thing happens every month. Microsoft, Oracle, Apple, etc. This is news?
Why in the world are we still using this completely unnecessary software?
Because at a point a few years back it was the only viable solution available to do some of the things flash does. There was no realistic alternative for several years. That gave it a very large installed base and large installed bases don't go away just because they later become inconvenient.
One of the smartest things Apple did in recent years was to keep flash out of iOS so it could never get an installed base on that platform. Solved a whole host of inevitable security and performance problems AND it pushed the rest of the net somewhat away from flash. Apple had other less altruistic reasons to do this besides just the security problems with flash but on the whole I think we have all benefited from flash being pushed aside.
The Flashblock extension apparently is not supported by Firefox v35. With the extension enabled, YouTube videos won't play. When the Flashblock extension is disabled, YouTube videos play immediately, without user permission. Is that a Firefox problem, or is Adobe checking for Flashblock and refusing to operate if the Flashblock extension is installed?
...).
Adobe's Flash software is abusive to users, in my opinion. From the Better Privacy Firefox extension web page, re-written for clarity:
Some properties of Flash-cookies (LSOs):
1) They don't expire. They stay on each computer for an unlimited time.
2) By default they offer a storage of 100 KB. Normal cookies, 4 KB.
3) Browsers are not fully aware of LSO's, They often cannot be displayed or managed by browsers.
4) Using Adobe's Flash, companies store and access highly specific personal and technical information (system, user name, files,
5) Flash sends the stored information to servers without the computer user's permission.
6) Some Flash applications are not visible to the user. Not all Flash applications display anything.
7) There is no easy way to tell which Flash-cookie sites are tracking you.
8) Shared folders allow cross-browser tracking, LSO's work in every flash-enabled application.
9) Adobe doesn't provide a user-friendly way to manage LSO's. Management is very cumbersome.
10) Many companies make extensive use of Flash-cookies.
Apparently Adobe develops software but doesn't check for flaws. There have been 24 new versions of Adobe's Flash software in one year, if I count correctly, since v11.9.900.170 in January of 2014. (The latest version is v16.0.0.257.) As the Slashdot story mentions, the flaws were found by other companies, not Adobe.
One purpose of the extremely frequent updating may be to push users to allow Adobe to do its silent updating, giving Adobe control over user's computers.
Now, apparently, Flash applications will not work unless the latest version of Flash is installed. That's apparently another way Adobe pushes users to allow Adobe to do silent updating, using the Windows operating system service Adobe calls ARM: "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
Apparently the former Adobe CEO, Bruce Chizen became tired of managing, because Adobe was, in my opinion, poorly managed for years before Mr. Chizen was replaced in 2007. Bruce Chizen is on Oracle's board of directors. Birds of a feather flock together?
The present Adobe CEO, Shantanu Narayen, is, in my opinion, a very poor manager. For example, an organization with which we are acquainted paid $2,000 to update to an Adobe CS6 suite. CS6 came with old versions of some Adobe programs, and an Adobe representative justified that practice.
Do you realise that many of the criticisms you're directing toward Flash -- about rapid updates, numerous security fixes including some that were found by others, auto-updating, and so on -- could also be directly aimed at Chrome?
Chrome is an application that actively circumvents the main Windows security model so that it can update executable code on the user's machine without the administrative privileges usually required to install and modify applications. The day someone breaks into Google's update mechanism for even a short time, whether technically or from within the organisation, the damage will be astronomical.
We could discuss related issues with Microsoft's recommended security models and how much of that update mechanism is actually suggested by Microsoft itself rather than Google, but the facts of what Chrome is doing and the potential danger associated with it are still the same regardless of whose idea it was.
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
I uninstalled Flash long ago. Very occasionally I find a site that doesn't work at all without Flash, but it's rarely one I care about.
The worst thing are the 'mobile' sites which say 'ah, you're running iOS, so I'm going to give you a sane site that doesn't have any of that Flash crap,' so you know they can make their site run fine without Flash, but you go there with an Android device and it says 'ah, you're running Android, so i'm going to give you the Flash version' even though Flash hasn't run on Android for several versions now.
Flash is useless on my 192dpi laptop. Everything is so tiny or sometimes only fills up the top left 25% of the box. Adobe doesn't ever seem to care -- https://bugbase.adobe.com/inde...
Morphing Software
Define 'viable' -- do you mean it was the only sufficiently insecure platform which allowed arbitrary execution of code on the host machine?
It was the only platform available at the time to do certain tasks on the web the way people ("developers" especially) wanted to do them particularly tasks relating to video. There was nothing else comparable at the time. I never claimed it was a good or secure solution, merely that it was the only game in town. Warts and all. A lot of code was written to utilize flash and that sort of thing doesn't go away overnight even when it should.
Flash is a great example of private technology and interests getting ahead of standards. Internet Explorer 6 is another great example.
Management figures it's just used for viewing porn sites.
Have gnu, will travel.
One of the last footholds of Flash is the ability to write a Native App for iOS and Android with Adobe AIR.
That is by definition not a native app. It can behave like one but it's not the same thing.
What Steve Jobs was talking about was the Flash Browser plug-in -- which was unviable as a mobile browser experience.
Here is what Jobs said about Flash. Note the bit where he said:
"We know from painful experience that letting a third party layer of software come between the platform and the developer ultimately results in sub-standard apps and hinders the enhancement and progress of the platform. If developers grow dependent on third party development libraries and tools, they can only take advantage of platform enhancements if and when the third party chooses to adopt the new features. We cannot be at the mercy of a third party deciding if and when they will make our enhancements available to our developers"
It was VERY much about maintaining control over how applications were developed for iOS.
Hell, Google bent over backwards to give Adobe everything they claimed Apple denied them and couldn't get it to run in a stable or usable manner on Android.
Yes they did and there were a lot of people loudly crowing about how having Flash somehow made Android better than iOS. There were/are plenty of reasons to prefer Android but Flash has never been one of them.
"... many of the criticisms [directed] toward Flash... can also be aimed at Chrome"
/svc
/medsvc
I agree. That's why I stopped using Google's Chrome browser. One one computer I checked,
Google installed 3 system services:
Google Update Service (gupdate), "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"
Google Update Service (gupdatem), "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"
Google Updater Service (gusvc), "C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe"
Normally, software requires an update only if new features have been developed, or in rare cases when a vulnerability is found. I'm guessing, and it is just a guess, that a lot of the vulnerabilities found in Adobe's Flash software are due to extremely poor management of Adobe that began about halfway through Bruce Chizen's period of being CEO. I imagine that the best people at Adobe left because of not liking Chizen's management. Certainly now, when I talk with people at Adobe, they seem very much out of control, as though there is no real management at Adobe or even understanding of technology management.
However, although Google's management has been degrading rapidly in recent years, in my opinion, Google has historically been much better managed. Someone checks Google software before it is released. But there are such frequent updates in Chrome that it seems possible that Google is being forced by some secret agency in the U.S. government (There are many more than just the NSA.) to deliver software to get information directly from user's computers. (I've been studying the degradation of management of formerly excellent companies since the downfall of Fairchild Semiconductor and of Tektronix.)
Also, there is an abuse that is becoming much more common: It is possible to give a name to a service (or an Internet domain) that is misleading or un-informative about who is in control of it. The sneaky, dishonest, abusive people are becoming more powerful, as in other areas of U.S. society.
So, we need an open-source operating system that has a far better security model. (Open source so that we can try to prevent hidden agencies from being in control.) We need a federal law that all software components must be labeled with their true supplier.
"Wrong. Flash developers specify the minimum API version for their applications. Nothing has changed here. I can still run apps in old versions of the player."
Not wrong, because we've seen the problem with several domains. I'm guessing that Flash development software now automatically includes that limitation, and that the Flash development software updates without user intervention or knowledge. Most people who develop with Flash don't have the technical ability to know the "minimum API version for their applications".
"In Chrome it took me 60 seconds to figure out how to delete Flash cookies or view which sites are using Flash cookies."
Translation: In Chrome a highly technically knowledgeable person, who knows that Flash cookies must be deleted, took only 60 seconds to delete them.
"In terms of uploading content to the server, Flash is essentially capable of what JS is capable of. Companies don't need Flash to upload user information."
No JavaScript engine installs a system service. Flash does, and, according to Adobe, new vulnerabilities are discovered in Adobe software every 2 to 4 weeks. So, even if Adobe is not abusive, there are plenty of opportunities for others to invade a system.
"A quick look at cookies on my system shows that the vast majority of websites are storing information with regular cookies, not Flash."
Cookies on the system of a technically knowledgeable person are not representative of the cookies on the systems of average users.
Thanks for the info about AdBlock.
Thanks for the additional info about AdBlock.
"The best theory I've seen so far is that Flash is bit like quantum soup with a black hole in hiding in the extremely odd extra dimensions."
That is not just a joke, it is a direction of useful inquiry.
We need to philosophize about why a company would be so horrible toward its customers. Okay, probably not involving the quantum soup and black holes of Physics, but instead the quantum soup and black holes of Sociology.
There is some recent Slashdot sociological inquiry about Bill Gates and a cancer cure.
Then there is WEIRD, When Every Idea Rates Dumb.