Adobe issues emergency update to fix cross-platform Flash exploit

AppleInsiderAppleInsider
Posted:
in General Discussion edited January 2014
Adobe on Friday released a security bulletin that announced an emergency update that affects all versions of its Flash Player, though it seems the exploit is currently being used to target Windows PCs running Microsoft's Internet Explorer .

Dubbed an "object confusion vulnerability," the bug tricks a user into opening a malicious file sent in an email message which can cause Flash to crash, potentially giving the attacker control of the affected PC.

First reported by Microsoft Vulnerability Research, the bug resides in Flash Player code for Windows, Mac, Linux and Android, though Adobe claims that the exploit being used only targets Internet Explorer for Microsoft's OS. Users who installed Flash on Google Chrome are unaffected as the browser updated automatically.
"Adobe recommends users of Adobe Flash Player 11.2.202.233 and earlier versions for Windows, Macintosh and Linux update to Adobe Flash Player 11.2.202.235," Adobe said in the bulletin. "Users of Adobe Flash Player 11.1.115.7 and earlier versions on Android 4.x devices should update to Adobe Flash Player 11.1.115.8. Users of Adobe Flash Player 11.1.111.8 and earlier versions for Android 3.x and earlier versions should update to Flash Player 11.1.111.9."
Adobe Flash Player Security
Source: Adobe


While Windows users who have selected the "silent update" option will receive the update automatically, those who did not or are running Flash 10.3.x or later for Mac must manually install the fix from within the program. To verify that the latest version of Flash is installed, users must navigate to the "About Flash Player" page or right-click on content running Flash within a webpage. Each browser on a given computer should be checked.

Comments

  • Reply 1 of 17
    radjinradjin Posts: 165member


    When is FLASH not a problem?


     


    When it's not installed...

  • Reply 2 of 17
    slurpyslurpy Posts: 5,384member


    Seems like I read about a flash exploit every 2 days. Fucking amazing. The sooner the platform is completely dead and irrelevant, the better. Not sure where we'd be without Apple who dealt it some fatal blows. SJ was completely right to keep flash off iOS. 

  • Reply 3 of 17
    vandilvandil Posts: 187member


    Hilariously, this same headline could have been run any time over the past 12+ years.  I guess people just can't get enough of Internet Explorer.

  • Reply 4 of 17
    mstonemstone Posts: 11,510member

    Quote:

    Originally Posted by Slurpy View Post


    Seems like I read about a flash exploit every 2 days. Fucking amazing. The sooner the platform is completely dead and irrelevant, the better. Not sure where we'd be without Apple who dealt it some fatal blows. SJ was completely right to keep flash off iOS. 



    If HTML5 wasn't such a pain in the ass to develop, Flash would be irrelevant, except for a few nice features that are unique to Flash and Java.


     


    HTML5 compared to Flash is like building your own electric vehicle and your own solar panel which takes 12 hours of sun to charge the battery so you can drive 20 miles an hour with a range of 10 miles.


     


    But what the heck, it doesn't require any gasoline so it must be better.

  • Reply 5 of 17
    lightstrikerlightstriker Posts: 458member
    mstone wrote: »
    If HTML5 wasn't such a pain in the ass to develop, Flash would be irrelevant, except for a few nice features that are unique to Flash and Java.

    HTML5 compared to Flash is like building your own electric vehicle and your own solar panel which takes 12 hours of sun to charge the battery so you can drive 20 miles an hour with a range of 10 miles.

    But what the heck, it doesn't require any gasoline so it must be better.

    Its a hell lot better than digging miles deep for oil, wait days to refine it into gasoline than falling into the hole. :p
  • Reply 6 of 17
    mstonemstone Posts: 11,510member

    Quote:

    Originally Posted by lightstriker View Post





    Its a hell lot better than digging miles deep for oil, wait days to refine it into gasoline than falling into the hole. image


    Well to continue with the car analogy, I look at Flash as the SUV of the web. It is irresponsible to use it to commute to work everyday all by yourself when there is perfectly good public transportation, but rather nice to have when you want to take the family camping or to the beach, load it up with groceries or gardening supplies from Home Depot. As far as HTML5 or Flash is concerned I'd rather not have anything moving around on my web page anyway, unless it served a purpose. I like to point to the Google finance app as a useful implementation of Flash. The rest of the time I just need static images and text.

  • Reply 7 of 17
    cvaldes1831cvaldes1831 Posts: 1,832member


    I've found a compromise for my Mac. I install Flash, then sandbox it in one web browser, iCab. The rest of my applications behave as though Flash isn't installed.


     


    You have to put the two pertinent plug-ins into a Plugins folder in iCab. Here's what I do in Terminal.


     


    sudo mkdir /Applications/iCab.app/Contents/Plugins

    cd /Applications/iCab.app/Contents/Plugins

    sudo mv /Library/Internet Plug-Ins/Flash Player.plugin .

    sudo mv /Library/Internet Plug-Ins/flashplayer.xpt .


     


    You can also do the same for the Silverlight plug-in if it's installed on your system.


     


    sudo mv /Library/Internet Plug-Ins/Silverlight.plugin .


     


    That's it. All your other apps will look for Flash in the /Library/Internet Plug-Ins folder. Since it's not there, they assume it's not installed.


     


    iCab itself will load the plug-ins in the main Library as well as whatever is in its own folder.


     


    It turns out that most of the websites I normally access behave just fine without Flash. I end up firing up iCab maybe once or twice a month for a few minutes. Maybe a year ago, I was doing it a couple times a week, but as the iPad grows in popularity, more and more site operators seem to be getting the message and are moving away from Flash.

  • Reply 8 of 17
    habanerohabanero Posts: 77member

    Quote:

    Originally Posted by Slurpy View Post


    Seems like I read about a flash exploit every 2 days...



    yeah, right. No hyperbole there.


    I remember the 15 from last month (oh, wait, that was Safari)

  • Reply 9 of 17
    freerangefreerange Posts: 1,597member
    Die flash, die!
  • Reply 10 of 17
    freerangefreerange Posts: 1,597member
    Ah, the trolls rear their ugly heads...
  • Reply 11 of 17
    tallest skiltallest skil Posts: 43,388member

    Quote:

    Originally Posted by cvaldes1831 View Post

    I've found a compromise for my Mac. I install Flash, then sandbox it in one web browser, iCab. The rest of my applications behave as though Flash isn't installed.


     


    I go further than that. No Flash in my browser (so that I never report as having Flash to any website) and then if I MUST view a Flash element, I just download it and play it here:


     


    Screen Shot 2012-05-05 at 7.21.51 PM.png


     


    The Flash Projector standalone application. That's obviously not the icon it comes with. I just found it fitting.

  • Reply 12 of 17
    jeffreytgilbertjeffreytgilbert Posts: 368member

    Quote:

    Originally Posted by Slurpy View Post


    Seems like I read about a flash exploit every 2 days. Fucking amazing. The sooner the platform is completely dead and irrelevant, the better. Not sure where we'd be without Apple who dealt it some fatal blows. SJ was completely right to keep flash off iOS. 



     


    How does a 99% install base and continued adoption and development constitute a fatal blow? Why is everyone on this board blind? You'd rather have slow security updates maybe?

  • Reply 13 of 17
    jeffreytgilbertjeffreytgilbert Posts: 368member

    Quote:

    Originally Posted by mstone View Post


    If HTML5 wasn't such a pain in the ass to develop, Flash would be irrelevant, except for a few nice features that are unique to Flash and Java.


     


    HTML5 compared to Flash is like building your own electric vehicle and your own solar panel which takes 12 hours of sun to charge the battery so you can drive 20 miles an hour with a range of 10 miles.


     


    But what the heck, it doesn't require any gasoline so it must be better.



     


    More than a few nice features. What people don't get is that HTML5 allows you to do more with Flash than you were able to do before, so nobody using Flash sees HTML5 as the enemy, yet the onslaught of ignorant apple fans continues to bemoan it as the greatest evil the world has ever faced. Flash has limits, but it's a pretty awesome piece of software. HTML5 has limits, but it's warmly welcomed by all web developers. 

  • Reply 14 of 17
    jeffreytgilbertjeffreytgilbert Posts: 368member

    Quote:

    Originally Posted by Tallest Skil View Post


     


    I go further than that. No Flash in my browser (so that I never report as having Flash to any website) and then if I MUST view a Flash element, I just download it and play it here:


     


    Screen Shot 2012-05-05 at 7.21.51 PM.png


     


    The Flash Projector standalone application. That's obviously not the icon it comes with. I just found it fitting.



     


    You're so awesome. I wish we could all be as awesome as you.

  • Reply 15 of 17
    tallest skiltallest skil Posts: 43,388member

    Quote:

    Originally Posted by jeffreytgilbert View Post

    You're so awesome. I wish we could all be as awesome as you.


     


    Having an opinion about Flash isn't report-worthy, you understand.

  • Reply 16 of 17
    nvidia2008nvidia2008 Posts: 9,262member


    Several months ago I completely nuked Flash from Firefox and Safari. Life has never been better. I just have it on Chrome for those, ahem, videos. Let me just say that iPad and HTML5 adult entertainment has large (pun unintended) opportunities still.

  • Reply 17 of 17
    nvidia2008nvidia2008 Posts: 9,262member


    laughing-lol-crazy.png


     


    Quote:

    Originally Posted by Tallest Skil View Post


     


    I go further than that. No Flash in my browser (so that I never report as having Flash to any website) and then if I MUST view a Flash element, I just download it and play it here:


     


    Screen Shot 2012-05-05 at 7.21.51 PM.png


     


    The Flash Projector standalone application. That's obviously not the icon it comes with. I just found it fitting.


Sign In or Register to comment.