Slashdot Mirror
Adobe Patches One Flash Zero Day, Another Still Unfixed
Trailrunner7 writes Adobe has released an emergency update for Flash to address a zero-day vulnerability that is being actively exploited. The company also is looking into reports of exploits for a separate Flash bug not fixed in the new release, which is being used in attacks by the Angler exploit kit. The vulnerability that Adobe patched Thursday is under active attack, but Adobe officials said that this flaw is not the one that security researcher Kafeine said Wednesday was being used in the Angler attacks. The patch for Flash comes just a day after Kafeine disclosed that some instances of the Angler exploit kit contained an exploit for a previously unknown vulnerability in the software. Adobe officials said Wednesday that they were investigating the reports. Kafeine initially saw Angler attacking the latest version of Flash in IE on Windows XP, Vista, 7 and 8, but said the exploit wasn't being used against Chrome or Firefox. On Thursday he said on Twitter that the group behind Angler had changed the code to exploit Firefox as well as fully patched IE 11 on Windows 8.1.
Adobe 9 and CS4 have no patches. Safe! Phew!
Adobe seems to be trying hard to get it.
Seriously, it's not needed anymore. No one should use it or have it installed.
Zero-day attacks occur during the vulnerability window that exists in the time between when vulnerability is first exploited and when software developers start to develop and publish a counter to that threat.
Zero-day vulnerabilities make hackers happy because the users don't know about it, and thus can't prevent exploitation. Once the vulnerability is made public, you can block access to that port, or disable the functionality, or avoid exploitation in other ways. It is no longer a zero-day vulnerability.
IF the vuln was made public 5 days ago, then it's a five-day vuln. If the vuln was made public 10 days ago, then it's a ten-day vuln. Once it's patched, it's no longer a vulnerability. That is where the name 'zero-day' comes from.
"First they came for the slanderers and i said nothing."
Another chance to block the installation of McAfee Security Scan Plus. Will someone please rid me of this nuisance crapware?!?
Harrison's Postulate - "For every action there is an equal and opposite criticism"
You know, I subscribed to US-CERT alerts to get notified about this kind of thing, but thank goodness I also browse Slashdot from time to time.
The US-CERT alert for this critical patch probably won't arrive for another couple days or so.
Probably postfix sendmail. Adobe is catching up.
"First they came for the slanderers and i said nothing."
Java by far.
Oracle waited for a year to pit in a patch for +100 exploits!! Yes you should be arrested for running that in your browser.
http://saveie6.com/
Can anyone tell us if that's vulnerable (& on what platforms)?
I don't have flash installed but I do have chrome (with it's integrated flash) for those sites that just cannot keep up with the times. Yes, I use flashcontrol to autoexecute only whitelisted sites, but you never know...
Democracy is a sheep and two wolves deciding what to have for lunch. Freedom is a well armed sheep contesting the issue
There's some Flash content I still want to view. But I want to look at content, not fight to focus my attention away from screaming, flashing, pulsing, squirming ads on every side. If you want me to run your program, make it worth my while. Especially when the platform on which you want me to run it might let it infect my machine.
Static ads are still fine. I don't much care if you track me and focus them. I'll even click through them occasionally. But I won't let you run down my battery and my brain with animations. I don't care if your marketing macaques say they get more clicks. I've made my choice. I'll never see them.
Sendmail I can understand, but postfix?
Postfix? I thought postfix was pretty solid.
Yeah you're right, I was braindead this morning when I posted that.
"First they came for the slanderers and i said nothing."
Releases starting somewhere in the 11.3's and onwards are still consuming all available memory. Without THAT fix I'll stick with 11.2 and flashblock the items I don't want.
227-3517
Just to clarify: I've modded you down not because I think you're wrong, but simply because a systemd flamewar in here would be off topic.
I'm beginning to think that all links to goat.cx are actually encrypted messages.
Get free satoshi (Bitcoin) and Dogecoins
What it means "investigating"? An exploit kit exist, they can download it and see how it works and have people working on it round the clock. The fact there is no commitment on when the bug is going to be fixed is absurd.