Slashdot Mirror
Adobe Patches One Flash Zero Day, Another Still Unfixed
Trailrunner7 writes Adobe has released an emergency update for Flash to address a zero-day vulnerability that is being actively exploited. The company also is looking into reports of exploits for a separate Flash bug not fixed in the new release, which is being used in attacks by the Angler exploit kit. The vulnerability that Adobe patched Thursday is under active attack, but Adobe officials said that this flaw is not the one that security researcher Kafeine said Wednesday was being used in the Angler attacks. The patch for Flash comes just a day after Kafeine disclosed that some instances of the Angler exploit kit contained an exploit for a previously unknown vulnerability in the software. Adobe officials said Wednesday that they were investigating the reports. Kafeine initially saw Angler attacking the latest version of Flash in IE on Windows XP, Vista, 7 and 8, but said the exploit wasn't being used against Chrome or Firefox. On Thursday he said on Twitter that the group behind Angler had changed the code to exploit Firefox as well as fully patched IE 11 on Windows 8.1.
Adobe seems to be trying hard to get it.
Zero-day attacks occur during the vulnerability window that exists in the time between when vulnerability is first exploited and when software developers start to develop and publish a counter to that threat.
Zero-day vulnerabilities make hackers happy because the users don't know about it, and thus can't prevent exploitation. Once the vulnerability is made public, you can block access to that port, or disable the functionality, or avoid exploitation in other ways. It is no longer a zero-day vulnerability.
IF the vuln was made public 5 days ago, then it's a five-day vuln. If the vuln was made public 10 days ago, then it's a ten-day vuln. Once it's patched, it's no longer a vulnerability. That is where the name 'zero-day' comes from.
"First they came for the slanderers and i said nothing."
Another chance to block the installation of McAfee Security Scan Plus. Will someone please rid me of this nuisance crapware?!?
Harrison's Postulate - "For every action there is an equal and opposite criticism"
You know, I subscribed to US-CERT alerts to get notified about this kind of thing, but thank goodness I also browse Slashdot from time to time.
The US-CERT alert for this critical patch probably won't arrive for another couple days or so.
Probably postfix sendmail. Adobe is catching up.
"First they came for the slanderers and i said nothing."
There's some Flash content I still want to view. But I want to look at content, not fight to focus my attention away from screaming, flashing, pulsing, squirming ads on every side. If you want me to run your program, make it worth my while. Especially when the platform on which you want me to run it might let it infect my machine.
Static ads are still fine. I don't much care if you track me and focus them. I'll even click through them occasionally. But I won't let you run down my battery and my brain with animations. I don't care if your marketing macaques say they get more clicks. I've made my choice. I'll never see them.