Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

New Adobe Flash Vulnerabilities Being Actively Exploited On Windows and OS X

Soulskill posted about a year and a half ago | from the something-to-be-said-for-consistency dept.

Security 167

Orome1 writes "Adobe has pushed out an emergency Flash update that solves two critical vulnerabilities (CVE-2013-0633 and CVE-2013-0634) that are being actively exploited to target Windows and OS X users, and is urging users to implement it as soon as possible. According to a security bulletin released on Thursday, the OS X exploit targets Flash Player in Firefox or Safari via malicious Flash content hosted on websites, while Windows users are targeted with Microsoft Word documents delivered as an email attachments which contain malicious Flash content. Adobe has also announced its intention of adding new protections against malicious Flash content embedded in Microsoft Office documents to its next feature release of Flash Player."

cancel ×

167 comments

Sorry! There are no comments related to the filter you selected.

Die Flash, Die (5, Funny)

Anonymous Coward | about a year and a half ago | (#42834777)

I know many will rush to disagree with me but Flash cannot die soon enough...

Re:Die Flash, Die (5, Funny)

Anonymous Coward | about a year and a half ago | (#42834813)

This is German for "the Flash, the".

Re:Die Flash, Die (3, Funny)

jbeaupre (752124) | about a year and a half ago | (#42835255)

Yeah. Remember that time, about 70 years ago, when a bunch of of Americans and British were running around Europe yelling "The German!" So silly.

Re:Die Flash, Die (1)

Anonymous Coward | about a year and a half ago | (#42835341)

Also, "The cabbage"

And replace it with what? (3, Interesting)

popo (107611) | about a year and a half ago | (#42834919)

And replace it with what? The atrocity also known as HTML5 which is not write once run anywhere, is an absolute bear to code and despite the hype is nowhere near suitable for gaming yet?

There's a reason Flash is the world's most popular online multimedia platform. It's not without issues, but it is lacking a worthy contender.

Re:And replace it with what? (0)

Anonymous Coward | about a year and a half ago | (#42834969)

Silverlight will save us! Oh right, about that.

Re:And replace it with what? (5, Interesting)

Billly Gates (198444) | about a year and a half ago | (#42835017)

Yep. HTML 5 can offer hardware acceleration on pretty much any mobile device.

The reason for flash was that Java was an ugly POS and people did not want to wiat a full minute for their ugly applets to load while flash was all nice and pretty and loaded instantly.

Flash also exists because of IE. Old IE I may add as IE 9 and IE 10 got their act together and support the HTML 5 video tags. When IE 10 comes out for Windows 7 and XP goes EOL we will see a shift in websites catering to HTML 5 users making flash obsolete for all but the conservative businesses.

Re:And replace it with what? (0)

Anonymous Coward | about a year and a half ago | (#42835093)

You do realize that for these types of things, "conservative businesses" means "all businesses"

Re:And replace it with what? (2)

Billly Gates (198444) | about a year and a half ago | (#42835147)

Businesses only upgrade if they have a case. Having websites and cloud services move to HTML 5 is a pretty darn good business case to upgrade. IN the past IE 6 had such a strong marketshare that they didnt have to worry about as webmasters were forced to cater to it.

According to statcounter.com IE 8 usage is falling fast to 14% in the weekdays and 10% at the weekends. IE also is getting auto updated with Windows Update and before did not which is why grandmas kept using IE 6 for many many years. When that number hits 5% IE 8 you can expect websites will start focusing on HTML 5 and CSS 3.

IE 8 may remain for many corps for years but it wont be all business this time around because of the things stated above. I mean they didn't stick with Mosaic for 10 years did they?

Re:And replace it with what? (4, Insightful)

gstoddart (321705) | about a year and a half ago | (#42835295)

There's a reason Flash is the world's most popular online multimedia platform.

Can you tell us what that is?

For me, Flash has never provided anything of value -- just ads and badly written web sites is my opinion of it. I think Flash is crap.

Re:And replace it with what? (0)

Anonymous Coward | about a year and a half ago | (#42835561)

I block Flash ads as well, but it's completely myopic to suggest that they don't provide "value" for website owners. Flash is used for adverts because it works. Deal with it.

For video, I've yet to see a HTML5 player that works as well as Flash. It's an okay fallback for iDevice users, but nothing you'd want to foist on the general public.

Games/Animation: not that I really care about this either, but for those who do, HTML5 seems like it's stuck in the NES era.

Re:And replace it with what? (3, Interesting)

gstoddart (321705) | about a year and a half ago | (#42835663)

I block Flash ads as well, but it's completely myopic to suggest that they don't provide "value" for website owners.

Yeah, but is it of value to users? It isn't for me, and I'm not here to provide value for website owners. As a user, requirement for flash means the back button.

Flash is used for adverts because it works. Deal with it.

Flash gets blocked/not even installed by me an other users because it's crap. Deal with it.

I'm not going to allow Flash ads for any reason -- and if the only thing of value is for ads, that pretty much is what I already thought.

For video, I've yet to see a HTML5 player that works as well as Flash

Maybe it's my age showing, but the number of times I feel like I want to watch a video on the internet is vanishingly small. As in, I have no idea the last time I cared enough to watch a video on the internet. Same for games.

I don't give a rats ass if other people want to run Flash -- run wild, it's your computer. But I'd be hard pressed to name a single thing that has ever made me think "gee, I've been missing out by not having Flash".

Re:And replace it with what? (4, Funny)

cbhacking (979169) | about a year and a half ago | (#42836605)

Good for you... but it turns out that a fair number of the most popular websites on the entire WWW play videos, typically in Flash, and they are watched by people of all ages (perhaps more among the younger set, but certainly not exclusively). Quite a few sites (perhaps not individually the most popular, but a massively common *class* of site) also serve lots of Flash video, although for legal reasons they are only supposed to be watched by adults. People also like to watch videos of events they couldn't make it to and listen to streaming music, both of which are common uses of Flash. You can do web-based video chat or even videoconferencing using Flash (Google Talk can do this, for example).

I don't like Flash, and I certainly don't trust it; I keep it tightly curtailed where it's installed at all. However, it's definitely useful in some cases. HTML5 is catching up, but not fast.

Re:And replace it with what? (1)

cayenne8 (626475) | about a year and a half ago | (#42836645)

Maybe it's my age showing, but the number of times I feel like I want to watch a video on the internet is vanishingly small. As in, I have no idea the last time I cared enough to watch a video on the internet. Same for games.

With me, and my age is getting up there too....I feel I'm watching more and MORE video on the web, but to learn things!!

I'm trying to learn a lot of video and image editing software and tons of stuff out there from tutorials, to special tricks, differences in versions, etc.

And if you're into DIY, well, again, youtube and the like are the first places I look for before I even search for text or blogs on things these days.

I've not been into games in a couple of decades, but for any new project, software or activity I'm interested in, I look first to online videos to get me going.

Re:And replace it with what? (2)

miknix (1047580) | about a year and a half ago | (#42836033)

For video, I've yet to see a HTML5 player that works as well as Flash.

Youtube's? In fact, youtube switches to html5 everytime when it can, guess what? I don't even notice.

Re:And replace it with what? (1, Interesting)

amicusNYCL (1538833) | about a year and a half ago | (#42835617)

Can you tell us what that is?

Like he said, it doesn't have a viable feature-comparable alternative.

For me, Flash has never provided anything of value -- just ads and badly written web sites is my opinion of it. I think Flash is crap.

Cool story. Meanwhile, even here in 2013, our company started in 1996 is still selling new Flash-based learning courses to companies and government agencies worldwide, and they're still ordering new ones. It's easy for the artists to work in, the code to run the courses hasn't need to be patched or updated in several years, and the major time expense is still having people write the actual instructional content.

Re:And replace it with what? (1)

gstoddart (321705) | about a year and a half ago | (#42835797)

Cool story. Meanwhile, even here in 2013, our company started in 1996 is still selling new Flash-based learning courses to companies and government agencies worldwide, and they're still ordering new ones.

Yup, and it's products like yours why I periodically have go open up the browser of insecurity (IE) to access because it's the only one what has Flash enabled. Usually 2-3 times per year some company-mandatory crap needs it.

But for day to day use? Flash is disabled or just simply not installed because I have no trust in it, and it mostly is used for annoying ads. I periodically hit a site which requires Flash for any navigation -- those sites get a back button and never visited again.

Re:And replace it with what? (-1)

Anonymous Coward | about a year and a half ago | (#42836317)

Go back under your rock, you nasty old curmudgeon. YOU provide no value, either, so you should be ignored as you ignore Flash. Present something reasonable, not just your shitty, moronic opinion.

*clicks Back*

Re:And replace it with what? (0)

gstoddart (321705) | about a year and a half ago | (#42836369)

Go back under your rock, you nasty old curmudgeon.

Aww, how sweet ... that's the nicest thing anybody has said to me all week.

Present something reasonable, not just your shitty, moronic opinion.

But ... it's all I've got.

Seriously AC, go stick your penis in your ear. Or your rear if you're into that sort of thing.

Re:And replace it with what? (2)

ColdWetDog (752185) | about a year and a half ago | (#42836003)

And you can argue with this being a feature - or a bug. Just recently finished some course work over at the American Heart Association website. Flash, natch. The structure of which has not been changed for a decade. The same poorly thought out navigation, the same IE centric, buggy code. Just some new content.

Yes, it's AHA's decision not to spend the money to really look at what they are doing, but it's a pretty standard business practice. If it ever worked, it's good enough.

If I ever find the person(s) responsible for that abomination, they'd best hope I don't have a defibrillator handy.

Re:And replace it with what? (1)

Kagato (116051) | about a year and a half ago | (#42835937)

Most media options are done in flash. Any type of subscription based service that runs in the browser is flash because there is no standard. And it's going to stay that way so long as Microsoft is going to be a dick and insist everyone else uses their tech for secure streaming.

Re:And replace it with what? (4, Interesting)

westlake (615356) | about a year and a half ago | (#42836043)

For me, Flash has never provided anything of value -- just ads and badly written web sites is my opinion of it. I think Flash is crap.

You're entitled to your opinion.

But Flash remains a remarkably viable platform with mature development tools for animation, video and games. Amanita Design [amanita-design.net] comes vividly to mind with games like Samorost, Machinarium, and Botanicula.

Animation in adds and badly designed websites don't go away simply because their developers have migrated to HTML5.

Re:And replace it with what? (0)

Anonymous Coward | about a year and a half ago | (#42836417)

Can you tell us what that is?

The reason is Youtube. I wish Google would go ahead and switch it to HTML5. All the browsers are ready for it now.

Re:And replace it with what? (1)

Anonymous Coward | about a year and a half ago | (#42835301)

Flash is write once run only on Flash Player (of an equal or higher version).

Re:And replace it with what? (0)

Anonymous Coward | about a year and a half ago | (#42835315)

Interesting how silverlight, which has all the features flash has, and is much faster, and is installed on 50-75% of all machines worldwide, is not something we hear about.

Re:And replace it with what? (1)

jythie (914043) | about a year and a half ago | (#42835667)

Developer community and 3rd party library support tend to trump things like speed or capability. A language and its VM can be fantastic, but if you have trouble hiring people or finding packaged libraries to include, then its utility is restricted.

Re:And replace it with what? (0)

Anonymous Coward | about a year and a half ago | (#42836011)

silverlight was the last flash killer to come and go. MS have announced they intend to let it die, though it is questionable whether it ever lived. 1% of sites used it.

html5 will have its role on the web, but like html4, xhtml etc. as it turns out it's good for text and pictures and not much else.

Why replace it with anything? (0)

Anonymous Coward | about a year and a half ago | (#42835387)

And replace it with what? The atrocity also known as HTML5 which is not write once run anywhere, is an absolute bear to code and despite the hype is nowhere near suitable for gaming yet?

There's a reason Flash is the world's most popular online multimedia platform. It's not without issues, but it is lacking a worthy contender.

Why replace it with anything? What exactly does it do for me, Joe Anonymous Coward?

Play cat videos? HTML5 does that absolutely fine.

Show me ads? No thanks.

Annoying animated menu navigation? I think pretty much every site has given up on those or found an alternative by now, thanks to Flash-less tablets and phones.

Play dinky games? Yeah, there are still some, I guess, but most of them are now smartphone apps.

There are plenty of "online multimedia platforms" now. Maybe none of them does all the toaster-fridge things that Flash does, but that just means more focus and less crap.

Flash, you had a good life; now go to the old plugins home and live out your days fishing and watching TV without being a burden to your family. Give RealPlayer my love, will you remember to do that for me? Oh, and Java Applets will come by soon, you like them!

Re:Why replace it with anything? (1)

mark-t (151149) | about a year and a half ago | (#42835711)

Let me say up front that I'd love to be rid of flash forever, but that said... there seems to be an inseparable bond between multimedia and flash.

However....

I don't have cable... I don't watch enough TV to justify the expense... but there's a handful of shows (3 of them) that I really *do* like to watch each week, and the networks that air them in my area coincidentally also have those shows available for streaming one day after they air, which allows me to watch them at my convenience. The caveat is that all of these networks require flash to watch the programs in a browser window.

Okay, so I'm also still sitting through a minute or so of commercials every 8 to 10 minutes, much as I would if I watched it live, but this is preferable to me to not watching the shows I like at all.

I choose to not resort to piracy because I don't subscribe to the notion that just because I might want something that somebody else made, that this should somehow mean I am entitled to have it on terms that the maker never agreed to.

Show me an html5 alternative that a) provides a seamless viewing experience; and b) content makers will be sufficiently satisfied with the level of control that it offers that they are actually willing to utilize it (which is realistically still going to mean that the distributor gets to insert advertisements at places of their choosing), and I'd love to say goodbye to flash forever.

Re:And replace it with what? (5, Insightful)

Anonymous Coward | about a year and a half ago | (#42835433)

There's a reason Flash is the world's most popular online multimedia platform.

Yes. DRM.

Re:And replace it with what? (0)

Anonymous Coward | about a year and a half ago | (#42835437)

Nothing, don't replace it because it is totally un fucking necessary.

Re:And replace it with what? (0)

Anonymous Coward | about a year and a half ago | (#42835499)

And replace it with what? The atrocity also known as HTML5 which is not write once run anywhere

As opposed to flash, which is write once and exploit everywhere.

Are you starting to see the problem here?

Re:And replace it with what? (0)

Anonymous Coward | about a year and a half ago | (#42835503)

The only value Flash adds to the internet is for web advertising (*). The vast majority of video hosting sites have already shifted to HTML 5 and web gaming is a shrinking market which leaves only advertising. So long as advertisers build their content delivery around Flash, it will still have legs. As soon as they shift to HTML 5 (which I expect to happen in the next 2 years), Flash will be all-but-dead.

And everyone, including Adobe, knows this. The only people who don't are grognards holding on to the past where Flash was relevant. It isn't any more. Adobe is building out HTML 5 editing tools and has abandoned Flash for Android. They see where things are going.

*Saying that Flash adds value to the internet due to advertising amuses me greatly because both Flash and advertising are two of the most hated things on the internet...

Re:And replace it with what? (4, Insightful)

JDG1980 (2438906) | about a year and a half ago | (#42836301)

And replace it with what? The atrocity also known as HTML5 which is not write once run anywhere, is an absolute bear to code and despite the hype is nowhere near suitable for gaming yet?

It's true that for this one particular use-case, Flash may still have an edge against open technologies. But 99% of the Flash on the web is either ads or videos. We don't want to see the ads anyway, and HTML5 makes embedding videos without Flash in a standards-compliant fashion relatively easy. And remember, if your site relies upon Flash, no one with an iDevice will be able to use it correctly. And that's not going to change. In contrast, HTML5 videos work fine on both desktop browsers and portable devices.

If the only thing Flash is good for is some types of online gaming, then many users don't need it at all, and for those who do, it should be set by default to use a whitelist and only permit the plugin to be invoked on domains that are specifically authorized by the user.

Re:Die Flash, Die (0)

Anonymous Coward | about a year and a half ago | (#42834945)

I disagree with you.

Another reason to use Chrome, avoid Safari, Mac. (1)

Andy Prough (2730467) | about a year and a half ago | (#42835281)

Automatic flash updates. TFA states that Firefox and Safari on Mac are currently vulnerable and require manual update. Even IE10 on Win8 is doing auto updates. My odds of getting exploited via this vulnerability on my Chromebook? Basically zilch?

Re:Another reason to use Chrome, avoid Safari, Mac (2)

KiloByte (825081) | about a year and a half ago | (#42835487)

This particular vulnerability might be patched, but you're wide open to hundreds of others. Flash is not something a responsible OS distributor should install by default.

How is Chromebook "open" to Flash vulnerability? (2)

Andy Prough (2730467) | about a year and a half ago | (#42835569)

I'd like to see the explanation as to how my Chromebook could be "wide open to hundreds" of Flash vulnerabilities. Seems preposterous from what little I know about Flash and how it interacts with Chromebook's locked-down Gentoo-based OS.

Re:Another reason to use Chrome, avoid Safari, Mac (1)

tibit (1762298) | about a year and a half ago | (#42835805)

TFA is spreading FUD. I've had self-updating flash on OS X for at least a year now, IIRC. Yes, it has been self-updating for safari and other browsers, all automagically. Yes, you can manually disable autoupdates, but then it's your own damn fault.

Are there non-malicious uses? (3, Interesting)

fuzzyfuzzyfungus (1223518) | about a year and a half ago | (#42834839)

I realize that implementing embedded flash objects in Office documents was probably something that mostly happened because Microsoft wanted OLE to make embedding arbitrary stuff in arbitrary stuff happen(unlike Adobe's sick fetish for inserting horrible things into PDFs, which is their own damn fault); but do Flash embeds in Office documents actually occur, in the wild, as something people would actually do and distribute, for anything other than malicious purposes? I honestly can't remember ever having seen a single one, ever.

Re:Are there non-malicious uses? (0)

Anonymous Coward | about a year and a half ago | (#42835307)

I've seen Flash animations and the like embedded into PowerPoint presentations after being downloaded from some website. I don't know how common that is but I've seen it in academia when a textbook publisher offers animations or video on their website in the Flash format and the professor wants to show it during a lecture without having to quit out of the presentation.

Granted, you could state that using PowerPoint is malicious intent in of itself.

Re:Are there non-malicious uses? (0)

Anonymous Coward | about a year and a half ago | (#42835681)

They get forwarded around the office. Everything is stuffed inside office documents. The nanny software lets them through. They must be OK. They've been checked. Yeah?

Re:Are there non-malicious uses? (1)

cbhacking (979169) | about a year and a half ago | (#42836673)

Relatedly, I believe the reason that Word is being used as the exploit vector on Windows is because it doesn't have the sandboxing of IE/Firefox/Chrome. While you could get a lot more people to run the Windows attack code if you posted it on websites, it doesn't do any good when every popular browser newer than IE6 is locked down to not be able to launch arbitrary programs or write to most of the filesystem or registry.

Re:Are there non-malicious uses? (4, Informative)

tibit (1762298) | about a year and a half ago | (#42835821)

People use Word documents to send freaking pictures around, because they don't know they can paste into Paint. They don't know how to send weblinks either, so they paste it into Word and send it on.

Re:Are there non-malicious uses? (1)

antdude (79039) | about a year and a half ago | (#42836055)

Ugh, and old Windows' Paint to send as big bloated BMP images. :(

Re:Are there non-malicious uses? (-1, Troll)

kuporuta (2836515) | about a year and a half ago | (#42835861)

http://www.cloud65.com/ [cloud65.com] Kaylee. if you, thought Robin`s c0mment is neat... on monday I bought a gorgeous Mazda MX-5 after having made $9340 this-past/month and in excess of ten-k last-munth. without a question it is the nicest work I have ever had. I actually started 6 months ago and almost straight away began to make at least $85... per/hr. I work through this website,

Related to 57 patches for IE next Tuesday? (2)

Billly Gates (198444) | about a year and a half ago | (#42834853)

I wonder if this and Java are related to the HUE monster security update [zdnet.com] for IE?

Huh? (1, Informative)

mcgrew (92797) | about a year and a half ago | (#42834925)

I'm typing this on a Win 7 notebook w Firefox. KSHE's playing right now (using Flash, of course) and no notification came to me, although some virus defs came through this morning.

Windows users are targeted with Microsoft Word documents delivered as an email attachments which contain malicious Flash content

Why? They could as easily infect you with a macro. Who in their right mind opens a Word doc from and unknown source, especially when Windows warns you when you start to open a word doc in Outlook (we use Outlook at work).

I just wish Flash would stop crashing every single time I have it hibernate when I'm listening to the radio.

Re:Huh? (5, Insightful)

PlusFiveTroll (754249) | about a year and a half ago | (#42834975)

>Who in their right mind opens a Word doc from and unknown source

The idiot secretary in the next office over, or the next floor down.

Then the payload mines her email addresses and sends you "Minutes from meeting" or some similar crap. So now instead of having an email from an unknown person you get an email from someone you'd expect to get word documents from. Hopefully you are in a company that has decent A/V on incoming mail, most small businesses don't.

Re:Huh? (1)

Ryanrule (1657199) | about a year and a half ago | (#42835153)

Secretaries are not a thing anymore.

Re:Huh? (1)

bsane (148894) | about a year and a half ago | (#42835449)

Now they're called assistants (or similar) and they still exist every where I've ever worked, there are just a lot fewer of them, and they don't type things up or take notes.

Re:Huh? (0)

Anonymous Coward | about a year and a half ago | (#42835073)

Not as easy with a macro -- Office doesn't run macros by default and shows a pretty scary warning when it asks you to run it. Flash just runs.

Re:Huh? (1)

NJRoadfan (1254248) | about a year and a half ago | (#42835211)

I didn't even know you could embed Flash content in a Word document. I'm guessing they are using ActiveX, which means you are safe if you don't happen to have the ActiveX version of Flash installed. Whats very annoying is that Adobe's update notifier doesn't update both the ActiveX and Netscape plug-in versions of Flash, just one or the other. Always check the Flash control panel and make sure you have the latest version for both!

Re:Huh? (1)

tibit (1762298) | about a year and a half ago | (#42835847)

In a word, run nightly ninite [ninite.com] :)

Re:Huh? (0)

Anonymous Coward | about a year and a half ago | (#42835505)

Flash's auto updater is a pile of crap, perhaps checking for an update once every 47 years.

I got so annoyed with it i wrote my own which checks every 3 hours

Re:Huh? (0)

Anonymous Coward | about a year and a half ago | (#42835849)

I've found, at least on Windows XP, that it only checks for an update when you log in. Wonderful "feature"...especially for 90% of people who log in once every few weeks between reboots and wouldn't know to run the updater manually.

Re:Huh? (2)

Inda (580031) | about a year and a half ago | (#42835581)

"especially when Windows warns you when you start to open a word doc in Outlook"

Um, some of us have taught them to tick the "don't ask again" box. Sorry about that.

Getting macros to run is harder these days. There's an extra click or two. They don't execute automatically any more.

Re:Huh? (3, Interesting)

_xeno_ (155264) | about a year and a half ago | (#42835735)

As far as I can tell, the Flash updater only bothers to check for an update when the computer first boots.

Because everyone here constantly reboots their computer, right? I mean, it's not like most computers have sleep modes, and that most people just leave the OS running so they don't have to wait for it to boot. Clearly everyone constantly reboots their computer, once per day, to allow the Adobe Flash Updater to check for updates.

Re:Huh? (4, Informative)

benjymouse (756774) | about a year and a half ago | (#42835913)

Windows users are targeted with Microsoft Word documents delivered as an email attachments which contain malicious Flash content

Why?

Probably because of Windows sandboxing Flash through low-integrity mode. Even if you get to exploit a Flash vulnerability and execute your shell code on Windows, the code is still severely restricted in what it can do. Code executing inside of a low-integrity process can still not infect a system as write-ups (writing or interacting with a higher integrity object/process) are denied.

They could as easily infect you with a macro. Who in their right mind opens a Word doc from and unknown source, especially when Windows warns you when you start to open a word doc in Outlook (we use Outlook at work).

No, infecting with a Macro is more difficult since the last several versions of Word. Word will not automatically run macros and also has an internet-origin policy whereby documents received through Outlook or other email clients or downloaded using a browser is tainted with the "internet zone". You have to dismiss several warnings to run macros from such a document. But if Word will run Flash content (show the animation) and a vulnerability can be exploited, shell code can run as a user.

That is, until Word 2010 which *also* runs in low-integrity when viewing content tainted with the internet zone. Since Word 2010 the shell code will still be confined to the low-integrity sandbox.

Dear Adobe (1)

Anonymous Coward | about a year and a half ago | (#42834949)

Get the fuck out of the business of doing anything that can connect to the internet. Because you suck at it.

Re:Dear Adobe (2)

Rougement (975188) | about a year and a half ago | (#42835013)

Yep. They've years to develop something that doesn't suck balls and failed miserably.

Time for HTML 5 yet? (1)

Billly Gates (198444) | about a year and a half ago | (#42834967)

Another reason why proprietary addons that can execute code are a bad idea on the open web. Java got picke do enough last month. Flash also executes code by its very nature so of course it will have holes in it.

Adobe Flash Steps (1)

Anonymous Coward | about a year and a half ago | (#42835025)

1. Develop a technology and an authoring tool
2. Add features at a breakneck pace so no one can compete on the authoring tool
3. Profit!
4. Fix vulnerabilities until the end of times

LOL ... (3, Insightful)

gstoddart (321705) | about a year and a half ago | (#42835039)

Or, don't even run it. Flash has been a security and privacy hole for a decade or more.

I refuse to install it except on work machines where I periodically have to use it for something I can't avoid.

Yet another exploit? I'd like to say I'm shocked, but that would be a lie.

FTFY (1)

schneidafunk (795759) | about a year and a half ago | (#42835365)

Email attachments have been a security and privacy hole for a decade.

Re:FTFY (1)

gstoddart (321705) | about a year and a half ago | (#42835403)

Oddly enough, it was only ever Microsoft who decided they'd just blindly run anything in an email attachment.

Re:FTFY (0)

Anonymous Coward | about a year and a half ago | (#42835613)

Mail.app does it too. There was a recent vulnerability about that.

Re:LOL ... (1)

amicusNYCL (1538833) | about a year and a half ago | (#42835659)

I refuse to install it except on work machines where I periodically have to use it for something I can't avoid.

Which Flash-only websites do you use for work?

Re:LOL ... (1)

medcalf (68293) | about a year and a half ago | (#42835777)

It's not really just a problem with Flash, or with Flash and Java, or with Flash and Java and (pick a technology). The problem is that we do not really know how to build complex, integrated systems — which is what end users need to get what they want (in this case, games and multimedia of various kinds) — that are secure enough for the Internet environment, at low enough operational and development costs to make them practical. Perhaps a new compute architecture (and associated language changes) is needed, where memory for programs and memory for data are physically separated. This could potentially lead to slightly reduced functionality for dramatically improved security. But in any case, this is not just a case of something being badly built, it's an instance illustrating how nearly all the software we use is in some sense badly built.

Can haz software best practices? (-1)

Anonymous Coward | about a year and a half ago | (#42835055)

Someone needs to whip these Adobe programmers into shape - this is silly. If we're getting a patch everyday and 3 on Tuesdays it's plain downright bonkers zonkers crazy. Maybe if they scoped their plug-in instead of trying to embed an OS inside the web browser...

Software development really has turned to shit these days. No one gives a fuck how broken to hell everything is.

Re:Can haz software best practices? (0)

Anonymous Coward | about a year and a half ago | (#42835931)

Adobe software has always been crash-ridden and buggy. Adobe Premiere was the software that taught me to press CTRL+S every ten seconds and make a backup every hour in case the save corrupted the file.

This is such bullshit (0)

Anonymous Coward | about a year and a half ago | (#42835069)

All these problems are caused by cheap ass OSs that can't protect themselves. All this patching only mitigates the symptoms, nothing more. Fix the OS dammit!

Why is it so bad? (1)

KlomDark (6370) | about a year and a half ago | (#42835137)

For way to many years it's been a mess. And these near-daily emergency patches now. WTF is broken in their development/testing process? I don't understand how it can stay so horrid, or why Adobe finds this acceptable...

Even Windows has gotten a lot more secure over the years. But Flash, seems more broken each day.

Anyone have any insight?

Re:Why is it so bad? (0)

Anonymous Coward | about a year and a half ago | (#42835317)

Adobe doesn't make any money from Flash player at all.
So any money spent to fix it is a cost with no quantifiable benefits.

Re:Why is it so bad? (4, Insightful)

DarkOx (621550) | about a year and a half ago | (#42835715)

Probably because there is not much you can do to fix a fundamentally bad idea. Think of it like all the various attempts to make smoking 'healthy' at the end of day intentionally sucking combustion gases into your lungs just is not good for you, no matter how low tar, free of synthetic chemicals etc you make it.

What does flash do? It executes code from unknown origin on your machine. That has never been a good idea; even if in some cases you can't get around needing to do it. Flash has more problems though it can't be fully sandbox'ed without breaking all those old apps, it needs to be able to do things like read files, open sockets connections, etc.

Re:Why is it so bad? (1)

tibit (1762298) | about a year and a half ago | (#42835885)

That's what any web browser does. Flash does not run native code directly from untrusted sources, just as web browsers don't. Usually, the content exploits the bugs that let you run some binary code directly, but it's not because shipping native code around is how it was supposed to work. Both web browsers and flash players get executable content they have to compile to native code and run, or at least run on a bytecode machine.

Re:Why is it so bad? (1)

DarkOx (621550) | about a year and a half ago | (#42836325)

No quite true. If we ignore javascript for a moment pure html rendering is not program execution; its document formatting.

Re:Why is it so bad? (0)

Anonymous Coward | about a year and a half ago | (#42836439)

Too bad Adobe doesn't have any competition, like say, Macromedia.

Re:Why is it so bad? (1)

JDG1980 (2438906) | about a year and a half ago | (#42836537)

For way to many years it's been a mess. And these near-daily emergency patches now. WTF is broken in their development/testing process? I don't understand how it can stay so horrid, or why Adobe finds this acceptable... Even Windows has gotten a lot more secure over the years. But Flash, seems more broken each day. Anyone have any insight?

Adobe outsources most of their development process to India. That's a major contributing factor.

WTF.. (1, Insightful)

GrBear (63712) | about a year and a half ago | (#42835343)

Why the fuck does a WORD PROCESSOR even allow embedded Flash files?! Payloading like this shouldn't even be possible in the first place, that would be as bad as embedded .EXE files in a .doc that autorun when you open the .doc

Re:WTF.. (1)

jones_supa (887896) | about a year and a half ago | (#42835891)

Indeed, I laughed when I read that in the summary. That kind of attack vector is just so good old Microsoft. <3

Re:WTF.. (0)

Anonymous Coward | about a year and a half ago | (#42836401)

Because OLE. A word processor has almost nothing to do with processing words. Sure, you have a spell checker and search/replace, but mostly it's formatting and layout.

We don't need antivirus software! (2)

Netdoctor (95217) | about a year and a half ago | (#42835419)

Such is the mantra here...

Sooo tempted to send the CVE out to several people internally, as a word document.

*sigh*

Punishment (1)

ThatsNotPudding (1045640) | about a year and a half ago | (#42835477)

Does Adobe even ever get wrist-slapping fines for being one of the Horsemen of the Internet Apocolypse? They seem quite to content to write shit code and leasurely fix it when their excrement is pointed out.

Installing flash, without browser restart? (1)

Midnight Thunder (17205) | about a year and a half ago | (#42835567)

One thing that I see as causing some people to delay updating their Flash, despite an update being available, is that the installer requires you to restart your browser or anything else Flash think is using it. Many people take the attitude "I am working and don't want to be bothered restarting my apps, for something I rarely use".

Is there any other way Flash could install its updates, without requiring browsers to be restarted?

Re:Installing flash, without browser restart? (0)

Anonymous Coward | about a year and a half ago | (#42835851)

Weird. While reading this story I just barely updated Flash (on Windows XP) with both IE 8 and Firefox open. No restart at all.

My report: 6 months without using Flash (4, Interesting)

hessian (467078) | about a year and a half ago | (#42835653)

Some time ago, after the last round of Flash exploits, I de-installed it and resolved to live without it.

There are glitches: I can't get most video content, and Flash-only sites are inaccessible. However, this ended up being not a big issue.

One reason for this is that many YouTube videos play in HTML5 on Firefox. (If you find a video you can't play, try embedding it; this sometimes produces a workable version.)

Overall, the playback on HTML5 is better than Flash. There are fewer random slowdowns and stall-outs. On the downside, not every video is in HTML5.

The most amazing this is that browser crashes have dropped to near zero, either one or zero during this time. Most of what I thought was FF and Opera being buggy was in fact Flash being buggy.

There's not yet enough content switched to HTML5 from Flash to navigate everything, but during my 6 months without Flash, I've noticed that more firms are going away from the Flash-only navigation school of design.

YMMV. For me, life without Flash has been better, although I do miss out on some things.

Re:My report: 6 months without using Flash (1)

tibit (1762298) | about a year and a half ago | (#42835917)

It used to be that the #1 source of Safari crashes auto-reported to Apple was Flash. I wouldn't be surprised if that's still the case.

Re:My report: 6 months without using Flash (1)

aaarrrgggh (9205) | about a year and a half ago | (#42836563)

I was quite content without it, until Google tweaked some things in their finance pages where graphs wouldn't allow static graphs anymore. I grudgingly re-installed yesterday after nearly three years without. It's out again... I will just skip using Google Finance.

Re:My report: 6 months without using Flash (2)

mister_playboy (1474163) | about a year and a half ago | (#42836593)

You can solve the video playing problem quite easily with something like FF's Video Download Helper add-on or JDownloader. These tools can examine a URL and allow you to download any videos they find for local playback.

IE tip (1)

jones_supa (887896) | about a year and a half ago | (#42835965)

A simple way to make Internet Explorer block Flash by default: Gear icon -> Safety -> ActiveX Filtering.

After that, you can re-enable Flash for selected sites by clicking the blue icon in the address bar.

This vulnerability effects Linux and Android too (1)

sophos7 (2836531) | about a year and a half ago | (#42836153)

From Adobe's Security Bulletin Affected software versions Adobe Flash Player 11.5.502.146 and earlier versions for Windows and Macintosh Adobe Flash Player 11.2.202.261 and earlier versions for Linux Adobe Flash Player 11.1.115.36 and earlier versions for Android 4.x Adobe Flash Player 11.1.111.31 and earlier versions for Android 3.x and 2.x If you're running on Android it might not show in the market but if you view "All Apps" which shows previously installed apps along with ones currently installed, Flash will be there and say Update next to it. I think it's also interested that this comes about a week since Firefox started blocking all plug-ins by default, except Flash.

Windows secure, OS X not so much. (4, Interesting)

benjymouse (756774) | about a year and a half ago | (#42836209)

We see here how the Windows platform has been battle hardened to the point where the attackers have to resort to lower-yield secondary attacks. Head-on attacking Flash on Windows does not get the attacker very far because of the security advancements such as Mandatory Integrity Control (MIC). That's why the attackers try to exploit it in contexts where MIC does not prevent system infection, such as through older versions of Microsoft Word through emails.

OS X is still wide open to such head-on attacks when a vulnerability exists, especially Firefox because Mozilla has steadfastly refused to put in place a proper sandboxing barrier. Even Safari has some sandboxing in the latest version of OS X.

Firefox not. A vulnerability in Firefox or one of its plugins means significant risk of successful exploits.

Flash on Windows executes in a low-integrity process. Even if a Flash vulnerability is exploitable and shellcode gets to execute in the Flash host process, it still cannot write anywhere or interact with higher integrity objects because of mandatory integrity control (MIC) which was introduced with Vista.

The upshot: Attackers have to try secondary routes on Windows where the conversion rates are much, much lower. And this specific attack vector will not work on Word (or other Office applications) since Word 2010. Since the 2010 versions, internet downloaded documents are also opened in low-integrity mode, meaning that even here the shellcode would be similarly restricted.

Chrome to the rescue (1)

Just Some Guy (3352) | about a year and a half ago | (#42836291)

This is the primary reason I use Chrome: so that I don't have to bother with a system-wide Flash. I can still watch cat videos (by clicking on them), but my word processor can't be infected through software that's not installed.

Re:Chrome to the rescue (1)

mister_playboy (1474163) | about a year and a half ago | (#42836697)

Your comment made be curious, so I looked into it and Chrome is indeed using the PPAPI plugin (which other programs can't make use of) on all platforms as of Chrome 23.

Good to know. :)

JRE and Flash, RIP 2013, Silverlight RIP 2010 (1)

TheSkepticalOptimist (898384) | about a year and a half ago | (#42836345)

Lets all push to get rid of alternative runtimes once and for all.

New Adobe Flash marketing slogan (0)

Anonymous Coward | about a year and a half ago | (#42836597)

"Adobe Flash! It's Infectious!"

How about Linux/Android/etc users (1)

phorm (591458) | about a year and a half ago | (#42836729)

Does this bug also affect users of those OS's, because last time I heard
a) Adobe isn't offering a flash package for current android
b) Adobe isn't offering updates to the Linux flash version.

I'll assume that Linux users can have the vulnerable version, is there something in the OS that makes them immune or were they just not mentioned?

Load More Comments
Slashdot Login

Need an Account?

Forgot your password?