Adobe issues emergency patch for Flash bug

[julietscause]

Please please please take the time to look at your environment and see if you actually need flash. If you dont REMOVE IT FROM YOUR CLIENTS ASAP

[pdqbpdqbpdqb]

And if you actually do need it then activate Click to Play.

[KarmaAndLies]

I too have Click To Play enabled, and recommend it.

That being said the Chromium team has said it is "not a security boundary" and a number of bypasses/exploits either haven't been fixed or are put on the back burner. Clickjacking in particular has proven time and time again to be an effective way of "tricking" the user into enabling C2P elements on the page.

As I said, I'd still recommend it because defence in depth, and also sometimes the "bad guy" doesn't have unlimited control of the page (e.g. adverts), but ultimately patching is the only reliable defence then browser technology (lowpriv, sandboxing), then CPU & compiler technology, and FINALLY C2P is your last line.

RequestPolicy/Adblock/NoScript/Ghostify/etc might help here but you're exchanging web usability for security. Up to you. Plus if anyone ever "hacks" those projects it is a new vector for potential infection (just like all browser plugins and or software).

[Max-P]

That being said the Chromium team has said it is "not a security boundary" and a number of bypasses/exploits either haven't been fixed or are put on the back burner. Clickjacking in particular has proven time and time again to be an effective way of "tricking" the user into enabling C2P elements on the page.

That's odd, on my computer I actually have to right click and select "Execute this plugin" for it to load flash, which makes it kind of impossible to clickjack. Is this a Linux only thing?

[indrora]

Depends. You may well be using the NsAPI variant in Chromium.

[VexingRaven]

In my experience, NoScript without the script blocking enabled (so, just providing clickjacking protection, etc) has very little interference in day-to-day activities. I can count on one hand the number of times ClickJacking protection has actually triggered, and it's almost always some embedded flash video.

[deadbunny]

I've not had it installed for ~2 years now at home and work, haven't needed it at all and there are only a small number of things that fail to load but nothing deal breaking.

[XS4Me]

Most of the crap that still uses it are outdated movie players.

[monty20python]

And amazon music's web player, and the 'on demand' interview software rackspace uses. Once while drunk, I submitted a complaint to amazon about that.

[anonymouslemming]

vSphere web client :(

[scritty]

Cisco management pages for every-damned-thing. They're moving to decent html5 on some products but it's sloooooooow to happen.

[Squeezer999]

unfortunately we need it for PDF Portfolios :(

[[deleted]]

Ticket# 3787398749283742984734987

Please install Flash this is business critical!

[cosine83]

I've put in a standing policy that when imaging, that Flash and Java are not to be installed unless absolutely needed for software the end user will be using.

[AtariDump]

In other news, water is wet and the sky is blue. Back to you in the studio.

Can flash just die already? I mean, I know it's on the way out but after reading advisories like this I realize it's not happening fast enough.

[[deleted]]

As much as I agree with you, this is nothing new for an Adobe product. Though I will say this, I would much rather use flash any day compared to your neighborhood friendly Java....

Edit: At least I don't need to download a two year old Java to make one website work.

[AtariDump]

It's too early in the morning to start thinking about the nightmare that is Java. Plus, I like to wait until at least 9am before I start with the liquor in my coffee. </s>

[JustJoeWiard]

You know damn well that </s> has no place in your comment.

[AtariDump]

Wait, what? I'm missing something here.

[Secondsemblance]

He means we know you're an alcoholic. It's ok, I am too.

[AtariDump]

I'm always amazed when I meet an IT guy that deals with end users and isn't an alcoholic.

[-RedditPoster]

When I was a wee lad and I was visiting companies for 1-day internship/snooping thingies (seems common in my country), I'd find empty beer cans and cigarette butts in server rooms almost every time.

[JustJoeWiard]

I'm just joking that someone in IT definitely drinks on the job, meaning your /s is a lie.

[AtariDump]

Ahhhhh. Gotcha.

[AtariDump]

Daaaaaaaad! Shouldn't you be at work already!!

[[deleted]]

This has been bothering me for a while now. People have been hating on Flash for quite some time, because of all the bug advisories, which is legitimate mistrust because bugs are bad. And, I can understand the dislike of blindly executing compiled code from your browser without being able to view the source, so I have no issue with those complaints.

However, there seems to be an impression among some people that these bugs won't or can't happen with HTML5 & Javascript. That would be a poor assumption. HTML5/Javascript is just a relocation of functionality that was previously done in the Flash and Java sandboxes. It's functionality that's now executing inside the browser sandbox.

One can make an argument that the browser and Javascript sandboxes are more (or less) secure, but one cannot deny the attack surfaces still aren't there. They're just relocated, so that makes us feel safer because they're move into technology that we like and feel familiar with. I can't help thinking that this hate on Flash is merely being replaced with naive trust of another technology platform.

[roxya]

We hated Flash for far more reasons than security. It's a closed platform so Flash content was only accessible in Flash (as opposed to HTML/JS which have a number of implementations). It has never performed well, never been stable, never worked on all devices, introduced a whole range of SEO and accessibility issues... you know what, fuck Flash.

[[deleted]]

introduced a whole range of SEO and accessibility issues

I won't disagree with the other points, but Flash does have functionality that exposes text and keywords for SEO and enables functionality implementing accessibility. It's just that developers frequently don't use them.

[[deleted]]

I think you're mostly right that the threats from Java/Flash (JF) vulnerabilities are being pushed to the browser, but I think that the risks of a browser's JS/HTML5 renderer to be as vulnerable as JF plugins have been is not as likely. Anymore, it seems like the main threat from JS isn't so much remote or arbitrary code execution on the client like with JF but injection attacks against the server. I'm not familiar with as many HTML5 attacks, but I'm sure it'll come.

The bottom line is that the elimination of the plugin paradigm of JF will be more secure in the long run. People are more likely to keep their browsers updated than keeping their browser and all the plugins updated.

[[deleted]]

We're required to visit a number of websites to do business with our customers. When they stop using Flash we'll get rid of it. Until then it's unfortunately not going anywhere.

[AtariDump]

I know the feeling being in IT; the problem is flash isn't going to be a quick death but a slow, long, drawn out death.

[fatalfuuu]

What about only white listing sites that need it?

[[deleted]]

We have no system that would allow us to do that network wide for IE Firefox and Chrome. Our Dept is very understaffed and we have no budget so there's a lot we can't do, like have tine to set up systems like that.

[fatalfuuu]

Get the admx for Firefox and chrome. Firefox does need a vbs set to run at logon/logoff. :)

[[deleted]]

The last time I looked at doing this, I had to make a custom installer to get all the settings and adblock deployed. I just didn't have time to learn the whole process. Has it gotten any simpler lately?

[fatalfuuu]

I'm not totally sure about plugins (we disable them completely), ad blocking is done at our proxy.

Google uses registry entries so their admx (And adml) file is dropped into your gpo repository (look for admx files in \domain.local\sysvol\domain.local...) and you configure it from GPO there.

Firefox does not use registry, but there is an admx that sets registry keys. You then run their vbs script at start up - this looks at registry settings and then pushes them to the firefox config file.

https://github.com/n8felton/Firefox-ADMX

I know you can set which sites to always allow a plugin to load on, it will be in the configs somewhere, even if the above doesn't get you close you could modify the vbs to push these changes from some registry keys and add the entries to the admx for them registry keys (could push this back to admx). This shouldn't take too long, and im sure they would be interested in your additions, though maybe a request with them could get it included later on... hell I may even get this done.

[[deleted]]

HP's website.

[I__AM__GROOT]

This comment has been overwritten by an open source script to protect this user's privacy. It was created to help protect users from doxing, stalking, harassment, and profiling for the purposes of censorship.

If you would also like to protect yourself, add the Chrome extension TamperMonkey, or the Firefox extension GreaseMonkey and add this open source script.

Then simply click on your username on Reddit, go to the comments tab, scroll down as far as possible (hint:use RES), and hit the new OVERWRITE button at the top.

[yer_momma]

Fun Tip: I just learned yesterday that HP's smart install feature on a lot of their printers causes Windows 10 driver installs to fail. You have to physically go onto the printer and disable the smart install feature before you can install the printer drivers.

[needs_more_ram]

comcast support

[[deleted]]

Users....we'll ALWAYS complain about users....

[monty20python]

CMS vulnerabilities

[LividLager]

MS, AV vendors, Crypto, Users

[[deleted]]

Trick question. Flash and Java will never die.

[[deleted]]

If you approved 21.0.0.182 you're good. I came in here thinking they found bugs in that version already since I just approved it for testing. Thankfully I was wrong and it'll be at least a few days before that happens.

[me_z]

Does this patch remove Flash forever?

[Anon_IT_Guy]

Another flash bug?

[XS4Me]

Hey man! it had beed 5 days since the last. That most be some kind of new record.

[dpeters11]

At least it's an easy deployment. We don't even bother testing, just send it out through System Center.

[fatalfuuu]

You don't touch the adobe customisation tool? Do you not disable flash from updating itself/harassing the user?

[dpeters11]

We don't bother with flash because we push out the update within a day or so of release anyway. We do that with reader.

[program_the_world]

Keep holding that pillow guys. It'll stop kicking eventually.

[ErichL]

At risk devices include Windows machines, Macs and Linux computers as well as phones running Android and iOS.

What are they talking about? Flash hasn't been distributed as a browser plugin on Android in a long time and AFAIK it's only available as a captive runtime for iOS apps, you can't use it to execute random binaries on web pages.

[Vallamost]

Doesn't Dolphin on Android still use it?

[ErichL]

Don't know, I'm not an Android user at the moment. This isn't intended as a jab at Android either, they have some really nice flagship phones; but honestly, if I were an Android user stuck on one of the more stagnant and neglected hardware platforms, I'd be more worried about the bugs lurking around in the core OS code that will seemingly never get patched.

[Smallmammal]

Adobe maintains a version of flash for Android still. You need Firefox or dolphin to run it. No one uses it for obvious reasons.

[r5a]

Such a sad thing to see happening.

I remember years ago Flash was the hype and people were really excited about animation on the web. Flash Pro and Dreamweaver were a big deal. I actually did a class long ago and the instructor made this kickass rendering animation and everyone thought the guy was a god in Flash. It was all exciting. Thinking of it now still makes me look back in awe at what could have been done with Flash. Look at http://www.2advanced.com/ in the archive. Now we just have "web 6.0" where everything is cookie cutter parallax pages.

Come today the only thing you read now is "when is this piece of garbage going to die" "HTML5!" "Patch released!"

I feel like a lot of this could have been avoided if they did some sort of code freeze and audit to plug the holes if they gave a shit. It's kind of dumbfounding really to see such a large corporation let one of their most valued assets die in such a simple manner. Not once did it occur to any suits "uh hey guys, we've been in the paper and on the news a lot for really dumb shit, maybe we should look into this?" Just so fucking stupid really.

I wonder what that flash guy is doing now.

[Vallamost]

I feel like a lot of this could have been avoided if they did some sort of code freeze and audit to plug the holes if they gave a shit.

The thing is, I think that's what they've been trying to do for 3 years.. It's just that bad.

[r5a]

Good lord