New Flash zero-day exploit that allows system takeover

http://blogs.adobe.com/psirt/2011/03/security-advisory-for-adobe-flash-player-adobe-reader-and-acrobat-apsa11-01.html

by ck2 • 15 years ago

89 43 15 years ago

blogs.adobe.com

This may be confirmation bias, and admittedly no software is without vulnerability, but is it just me or do we see these updates for Flash moreso than just about any other internet-facing client?

Is Flash really that bad or is everyone else just bad at reporting zero-day exploits publicly?

zdw2• 15 years ago

Flash really is that bad:

http://en.wikipedia.org/wiki/Adobe_Flash#Flash_client_securi...

Also "Zero Day Exploits" generally mean that the exploit was released to 3rd parties before it was given to the company whose software was being exploited.

levigross2• 15 years ago

I think 0-day means something a little different http://en.wikipedia.org/wiki/Zero-day_attack

46Bit• 15 years ago

Flash really is that bad. As a potential malware vector & as something where most users are probably hopelessly out of date (and not by their own fault).

keyle• 15 years ago

I'm an ex-flash developer (8 years). I can tell you it's bad. I could find many ways of crashing the browser a few years back. And just reading this article, I went about:plugins in chrome and disabled flash for now.

levigross2• 15 years ago

Most software companies will put security bugs on a uber priority fix list. Everything else goes to the back of the line :).

One of the best ways to get any bug fixed in any Library, OS etc... is to find a way to exploit it.

oz• 15 years ago

I'm a sysadmin at a Big 4 auditing firm. Adobe products are the bane of our existence.

Acrobat 9.4.1 takes over to install. Oh that's right, there's a vulnerability in that version, so now we're gonna have to push 9.4.2

When a user's Flash installation is corrupted, many times the uninstaller fails, so we have to use Windows Installer Cleanup to remove it. Every week, there's a new issue. Can't these fellows get it right?

DarkShikari• 15 years ago

It's bias.

Java has ~3 times as many holes as Flash does (if one is comparing in the context of "browser plugins").

wladimir• 15 years ago

I can't comment on Flash being worse than other software, but one thing is clear: it extends the attack surface of your browser with a whole maze of exploitable goodness.

code_duck• 15 years ago

Browsing on iOS made me finally realize how unimportant Flash is to me. I've since disabled it on every computer I use.

danilocampos2• 15 years ago

I actually had the reverse chronology. I discovered how using ClickToFlash gave me significantly better battery life on my MBP, along with faster page loads and zero mysterious pinwheels. ClickToFlash has a better price-performance ratio than upgrading to an SSD – and I love my SSD.

So when I got an iPad, I was especially mystified at why anyone should complain about this garbage being missing.

edit: Useful links.

Go grab ClickToFlash (Safari, OS X):

http://clicktoflash.com/

Or the Safari extension for Mac or Windows:

http://hoyois.github.com/safariextensions/clicktoflash/

Or the Firefox equivalent:

https://addons.mozilla.org/en-US/firefox/addon/flashblock/

zdw2• 15 years ago

rentzsch's clicktoflash is actually considerably out of date at this point.

The new, Safari-extensionized version that is mentioned second is much better and updated frequently. (this link: http://hoyois.github.com/safariextensions/clicktoflash/)

(mathematical stickler: seeing as ClickToFlash is free, it's price/performance ratio is always zero)

feverishaaron• 15 years ago

Don't forget FlashControl for Chrome:

https://chrome.google.com/extensions/detail/mfidmkgnfgnkihnj...

machrider2• 15 years ago

Yeah, I've been noticing something similar. Since upgrading my Android phone to 2.2, with Flash support, browsing the web got slower and clunkier. So many pages have flash advertisements on them, and the phone just doesn't have the horsepower to render them and stay responsive. I wonder if I can turn it off...

daleharvey• 15 years ago

go to settings, enable plugins, on demand

I did it fairly early getting my android, it makes a big difference

there• 15 years ago

in the browser, go to settings, then click 'enable plug-ins' and choose 'on demand'. it will work like clicktoflash and show you a container with an icon wherever flash applets are on a page, which you can just tap on to start playing if you want to.

BoppreH• 15 years ago

That's fine if you don't play flash games.

flexd• 15 years ago

I just use noscript. No flash will load unless i tell it to, no javascript will load unless i allow it. It's like we first intended, i am the god of my browser. NONE SHALL PASS!

mkramlich• 15 years ago

Agreed. What you lose is about 99% ads or games or overly complicated restaurant websites UI's. For cases where its like a Flash video player, i just click on the NoFlash/ClickToFlash placeholder rectangle, that then allows the actual Flash asset to load, and I partake of it. I've generally seen less freezes, crashes and memory use since switching to this approach.

agl• 15 years ago

Chrome already updated: http://googlechromereleases.blogspot.com/2011/03/stable-and-...

0x0• 15 years ago

Someone put up a partial decompile here: http://bugix-security.blogspot.com/2011/03/cve-2011-0609-ado...

FooBarWidget2• 15 years ago

I thought Chrome sandboxes all plugins. How do Flash vulnerabilities - or any plugin vulnerability - affect Chrome, in particular on OS X?

nupark• 15 years ago

Chrome can not sandbox all plugins without some effort. Only recently did they add support for sandboxing Flash to the stable Chrome release, and even then, only on Windows:

http://googlechromereleases.blogspot.com/2011/03/chrome-stab...

FooBarWidget2• 15 years ago

Where can I get accurate information on how sandboxing works on OS X, what it exactly does, what its limits are, and which vulnerabilities it does and doesn't protect against?

pharrington• 15 years ago

A plugin exploit is another vector through which one can attack the sandbox.

sukuriant• 15 years ago

Why did the security advisory mention attacks against Adobe Reader when the announcement was about Flash?

trotsky• 15 years ago

acrobat/reader content can easily come with embedded flash objects, this is a common way flash vulnerabilities are exploited.

michaelpinto• 15 years ago

Adobe reminds me of Apple in the 90s at the low point

amalcon• 15 years ago

They remind me more of Microsoft at Apple's 90s low point. Their software is everywhere, and it's full of security problems as a side effect of how there was little consideration for security in the original design.

Microsoft has only recently caught up with its insecure legacy. That suggests that we have another 15 years before Flash becomes stable software.

jarin• 15 years ago

FlashBlock: it's not just for keeping your browser from crashing, saving your RAM, conserving battery life, and/or keeping your computer from locking up!

null_ptr• 15 years ago

What's the purpose of being able to inject Flash files into Excel documents again?

cpeterso• 15 years ago

  =SUM(SWF1:SWFn)

icegreentea• 15 years ago

Like it or not, at many big companies, word docs and excel spreadsheets (and powerpoints...) get abused in incredible ways. You'll somehow end up distributing a training document in an excel spreadsheet, and then some not-so-tech-savy manager will come up with the brilliant idea of including VIDEOS in the training documents... and then it begins.

Simply put, Microsoft and Adobe will cram as much crap into their fileformats (pdfs...) as they think random middle managers in large corporations want (and sadly actually use...).

I've seen such things done. It hurts to get a word doc that's just full of embedded jpgs from a scan of a printed out pdf that was originally a website...

New Flash zero-day exploit that allows system takeover

Related Stories