Forgot your password?
typodupeerror
Security Bug

Shockwave Vulnerabilities Affect More Than 450 Million Systems 130

Posted by timothy
from the drug-resistant-infections dept.
Trinity writes "Researchers from VUPEN have discovered critical vulnerabilities in Adobe Shockwave, a technology installed on over 450 million Internet-enabled desktops. The vulnerabilities could allow remote code execution by tricking a user into visiting a web page using Internet Explorer or even Mozilla Firefox. Version 11.5.1.601 as well as earlier ones are affected. The vendor recommends upgrading to version 11.5.1.602." Especially sobering when you consider Adobe's current push to be essentially required as an intermediary player for anyone who wants to see certain government data.
This discussion has been archived. No new comments can be posted.

Shockwave Vulnerabilities Affect More Than 450 Million Systems

Comments Filter:
  • Flashblock (Score:4, Insightful)

    by sakdoctor (1087155) on Thursday November 05, 2009 @03:18PM (#29998146) Homepage

    Not just a good idea. It's the law.

    • Re:Flashblock (Score:5, Informative)

      by al0ha (1262684) on Thursday November 05, 2009 @03:22PM (#29998206) Journal
      It is not Flash Player - it is Shockwave Player, and frankly I am really surprised devs still use Shockwave and people still install Shockwave Player.

      The only reason to use Shockwave in the past was that it was scriptable. Flash has been scriptable since version 5.
      • by Tumbleweed (3706)

        It is not Flash Player - it is Shockwave Player, and frankly I am really surprised devs still use Shockwave and people still install Shockwave Player.

        In my Firefox, it's called "Shockwave Flash" - one plugin that does both.

        • Re:Flashblock (Score:5, Informative)

          by colfer (619105) on Thursday November 05, 2009 @04:08PM (#29998842)

          No, it's two different plugins.

          1. Shockwave Flash 10.0 r32
          2. Shockwave for Director 11.5

          You can have 1 without 2, latest versions.
          Looks some crazed half-forgotten branding initiative.

          Interestingly, the player test page http://www.adobe.com/shockwave/welcome/ [adobe.com] tries to install an old version if you have only Flash:

          Macromedia Shockwave Player 10.1

          That's the old branding and an old version. But anyway it fails to install. Maybe Adobe is confused by my nightly version of Firefox.

          • No, it's two different plugins.

            1. Shockwave Flash 10.0 r32
            2. Shockwave for Director 11.5

            Yes. This. Also, that's confusing as hell.

          • I rarely see Web sites use Shockwave. And if I do, it usually games. 99% of the stuff I see are in Flash. If I need it, I will just reinstall, look/use, and then uninstall it.

      • Re:Flashblock (Score:4, Informative)

        by Khyber (864651) <techkitsune@gmail.com> on Thursday November 05, 2009 @04:05PM (#29998798) Homepage Journal

        Flash didn't have Shockwave's 3D acceleration until version 10 of Flash. That is why many devs still used Shockwave.

        Surprised? Pay more attention to the featureset next time, yea?

      • Re:Flashblock (Score:5, Interesting)

        by mcgrew (92797) * on Thursday November 05, 2009 @04:05PM (#29998806) Homepage Journal

        I'm surprised that anybody's surprised that a new Adobe exploit has surfaced, They seem to have surpassed Microsoft in their zeal to get your PC infected; Microsoft seems to hava actually been getting better in the last couple of years. Or Microsoft seems to at least be trying. Adobe doesn't seem to care.

        • Re:Flashblock (Score:5, Insightful)

          by Tubal-Cain (1289912) on Thursday November 05, 2009 @04:12PM (#29998902) Journal

          They seem to have surpassed Microsoft in their zeal to get your PC infected...

          And considering that they have more marketshare than Microsoft, they can actually pull it off.

        • Adobe doesn't seem to care.

          It's not the only thing they don't care about.

          When will they come out with Photoshop / Image Raedy for Linux? No market? Bullshit.

          Basically, a wink wink nod nod with the money men @ Microsoft and Apple.

          • by V!NCENT (1105021)

            The official response from Adobe at the time was that there was no screen color adjustment software (or whatever it's called, you know what I mean) for Linux at that time. Maybe if someone informs them about these software packages on Linux they might reconsidder a Photoshop port and see what their next complaints are so the 'community' could adress these problems...

        • They seem to have surpassed Microsoft in their zeal to get your PC infected;

          Is this any better/worse than the Remote Code Execution [nai.com] vulnerability in Silverlight last month?

          And a general question to Slashdot. Is the current proliferation and duplication of interactive web platforms (Flash, Silverlight, HTML5 etc) with the resultant increase in surface area for vulnerabilities better or worse than a monoculture?

          Would we all be better off just pushing for a single web platform?

      • Re:Flashblock (Score:5, Informative)

        by deuterium (96874) on Thursday November 05, 2009 @04:25PM (#29999120)

        Being a Director developer, there are some things Director can do that Flash can't:

        Control embedded PDF files
        Manipulate bitmaps
        Create 3D scenes with physics
        Make network calls through proxy servers
        Access/Modify system resources
        Wider range of media support

        Director is actually capable of more than Flash, it just never caught on as well with developers. The mob rules, though.

        • Re:Flashblock (Score:5, Insightful)

          by ais523 (1172701) <ais523(524\)(525)x)@bham.ac.uk> on Thursday November 05, 2009 @04:39PM (#29999318)

          Being a Director developer, there are some things Director can do that Flash can't:

          Make network calls through proxy servers
          Access/Modify system resources

          Director is actually capable of more than Flash, it just never caught on as well with developers. The mob rules, though.

          This may be nice for a developer, but for a user, this is really scary.

        • by EXrider (756168)
          Question... why to this day does Adobe STILL not have some kind of unified server update solution for business networks? Sure, as an admin, I can roll my own scripts together to get it done, but with the frequency required lately, it's getting really old. It drives me insane having to download and install the same CS updates on multiple machines. Acrobat Reader and Flash updates on multiple browsers and platforms is even worse.
          • by toadlife (301863)

            They supply their software as .msi packages which can be deployed via active directory GPOs. That's how I deploy, flash, shockwave and reader. I'll be deploying the new shockwave tomorrow. They make you sign up for a "license" in order to get access to the msi packages, which is extremely annoying.

            • They supply their software as .msi packages which can be deployed via active directory GPOs. That's how I deploy, flash, shockwave and reader. I'll be deploying the new shockwave tomorrow. They make you sign up for a "license" in order to get access to the msi packages, which is extremely annoying.

              We have a problem with Flash, Shockwave, and Java. Somehow when it's being pulled down and installed via GPO the installation breaks and I have to uninstall it, remove the registry key, and run the MSI cleanup, then gpupdate and HOPE it works. The problem? We're a school district with 2500+ student desktops and when they do testing that relies on Flash/Shockwave/Java it's a problem when the installation is broken and we have to manually fix and verify every system.

              • by toadlife (301863)

                I've never had problems with the flash and shockwave msi pakcages, but I have experienced problems with java not uninstalling properly. We ended up witha situation where the old java would not install and the new java was partially installed. My solution was to write a start up script (assigned by GPO). It would check for the existence of a file that was specific to the old version of java and if found would call another script to clean up the mess.

                REM - Fix broken java 1.5 issue
                if exist "C:\Program Files

            • by EXrider (756168)
              Yeah, I'm aware of the MSI packages available. Unfortunately MSIs deployed via GPO do not help me with the 15 Macs running various versions of CS, Flash and Acrobat.
        • by weicco (645927)

          Access/Modify system resources

          Just curious... Do you happen to know if this is possible in Windows Vista and IE with UAC turned on? Shouldn't the lower privileges of the browser and UAC stop any add-on from accessing, or at least modifying, system resources?

          This is why I scratched my head when I read from the summary even Firefox. Shouldn't it say, in this particular case, even IE?

      • Re: (Score:3, Insightful)

        by CSMatt (1175471)

        Flashblock puts a placeholder in front of Flash, Shockwave, Authorware, Java, and Sliverlight.

        • by David_W (35680)

          Flashblock puts a placeholder in front of Flash, Shockwave, Authorware, Java, and Sliverlight.

          Are you using a different Flashblock than this one [mozdev.org]? According to the page there it only blocks the first three. I wouldn't mind to have something that could do it for the other two as well, but Flashblock doesn't seem to be it.

  • As there are over a billion computers with Windows vulnerabilities and countless other "at risk" applications that get patched regularly this doesn't sound like a situation all that out of the ordinary. And as with Windows some users will update and some will remain at risk.

  • Is he worried the gov will abuse this hole? If not I fail to see what makes it especially sobering. If it were a client->server hole that would be a problem of course.
    Not that I support anything adobe makes aside from photoshop anyways...
    • Re:Government (Score:5, Informative)

      by John Hasler (414242) on Thursday November 05, 2009 @03:52PM (#29998654) Homepage

      > Is he worried the gov will abuse this hole?

      No. He's worried that that the government is going to make their data inaccessible to anyone who doesn't install a useless piece if junk that would make their computer insecure.

    • by Culture20 (968837)
      Back when there was a serious MS excel bug, there was a State agency website in Iowa(?) that was serving up an infected xls file for some semi-important accounting thing.
  • You could pretty much take any two security issue threads on here, swap the comments section, and never know the difference.

    Software has bugs.
    Some of them are security issues.
    They get discovered.
    They (usually) get fixed.

    What's there to talk about?
    • Re: (Score:3, Funny)

      by ColdWetDog (752185)

      What's there to talk about?

      Sex? Cars? Come on, I'm sure we can think of something.

      • by Yvan256 (722131)

        Sex in cars? Sexy cars? Car-on-car sex?

        The possibilities are a bit limited if you only give us two options.

  • no MSI installer yet (Score:2, Informative)

    by Rob Bos (3399)

    As of posting, there's no MSI installer for the new version yet, and the .exe installer doesn't seem to support silent installs.

    http://www.appdeploy.com/packages/detail.asp?id=1438 [appdeploy.com]

    • by gad_zuki! (70830)

      Big deal. Wrap it in an AutoHotKey script, make it invis, whatever you want. Admins who wait for MSIs are pretty lazy or dont know scripting.

      • by idontgno (624372)

        Admins who wait for MSIs are in a systems management regime that requires MSI installs.

        FTFY.

    • by clone53421 (1310749) on Thursday November 05, 2009 @04:25PM (#29999114) Journal

      So? This isn't Flash. You don't need it to visit 95% of the web. You hardly ever need it – I didn't even have it installed.

      Check the add-ons; if you don't have "Shockwave for Director", it isn't even installed. "Shockwave Flash" is the flash player (not Shockwave).

  • Hard to care anymore (Score:5, Interesting)

    by belthize (990217) on Thursday November 05, 2009 @03:28PM (#29998320)

    I find it harder and harder to really give a shit anymore. All of our systems (linux, Windows ,OSX) all have various automatic patching schemes. Once the vendor gets around to fixing their crap (Adobe in this case) we'll ingest the patch and move on.

    Once upon a time I monitored the various security announcement lists but ultimately it didn't matter. Most of this crap has become mission critical so turning it off isn't an option, fixing it yourself is rarely and option so you're left with wait and patch solution.

    I guess it's kind of free'ing. I no longer stress about it and focus on more relevant issues.

    • by BitZtream (692029) on Thursday November 05, 2009 @03:52PM (#29998652)

      As a dev, autoupdates are evil. It's great if the updates don't change the behavior of whatever is being updated, but it sucks ass when those updates break or as MS is so fond of, remove functionality.

      I've spent the last two months straight dealing work arounds for MS patches that have done this and are rolled out across 15k machines overnight.

      Autoupdates are dangerous things. You get unexpected changes with no apparent reason. You have become the beta tester for software companies, and it's become accepted since they will patch it later. Hell, video game consoles are now rolling out buggy games sooner than they should because they can 'patch them later'

      how about we up our standards a luittle instead and start requiring better engineering instead of treating updates as acceptable and normal

      • by belthize (990217)

        I started to clarify in my initial post but didn't feel like it. We don't *autopatch* anything. We apply applicable patches after testing.

        It doesn't change the initial point about not really stressing about announced vulnerabilities. Nothing I can do till they get around to patching it, at which point we'll test and release, though not in this case since we blessedly have no shockwave reqs.

      • by tacokill (531275)
        how about we up our standards a luittle instead and start requiring better engineering instead of treating updates as acceptable and normal

        Which option do you think costs less?
        There's your answer.
        • by Sigma 7 (266129)

          Which option do you think costs less?

          Do you count the cost of a bad reputation if you release a game like Big Rigs [wikipedia.org]?

          If a game is critically buggy, it's available for one week, and that's it. My most recent experience is with Ghost Recon Advanced Warfighter; while I could say that it is a passable co-op game, it has a critical bug [youtube.com] which Ubisoft support believes is a problem with an outdated video card driver. Because of that, I can't recommend it.

      • As a dev, autoupdates are evil. It's great if the updates don't change the behavior of whatever is being updated, but it sucks ass when those updates break or as MS is so fond of, remove functionality.

        Autoupdates are dangerous things. You get unexpected changes with no apparent reason

        It doesn't have to be that way... [debian.org]

        Come, friend... come and try stable. We'll treat you right.

      • by L0rdJedi (65690)

        Why aren't you using an update server? Then you could just point the machines at that and hold the patches there until you've had a chance to test them. I've only got about 60 machines to keep track of and that's what I do. We didn't install IE7 until our CRM software (Goldmine) was compatible. I think I had to hold it back for about 2 months. Once I updated the machines, that forced our other vendor, that was writing a custom web app, to update their code ("No, I will not walk around to 40+ computers

      • The last Adobe flash update installed McAfee Security Scan without my even noticing. So watch out for those pre-check boxes.
    • Would you believe, that's the second biggest rootkit I've ever seen?

      I guess it's kind of free'ing. I no longer stress about it and focus on more relevant issues

      Pretty much where I'm at while I continue to throw good coin at my local robocall entitlement company and diligently recycle dead trees hand delivered by my local robomail entitlement crown corp. There used to be a number of disposable single blade razors that worked well for me, all since driven out of the market. Now I lease my triple-blade manho

    • by Yvanhoe (564877)
      MS won't patch it (not one of their softwares), Firefox will not upgrade it automatically (for a reason I fail to understand) as it is a plugin, Ubuntu doesn't have a patch yet. Maybe debian is up to date... But flash has been a pain in the neck as it almost always required me to care individually of it. However, because this kind of vulnerability has always been a risk, I am using Adblock+NoScript
  • That will take the "or even Mozilla Firefox" right out of there. Never use a browser developed by an organization that makes it's money directly from pushing ads on you. They disallow plug-ins like this.
  • by ThreeGigs (239452) on Thursday November 05, 2009 @03:37PM (#29998450)

    If you're having problems installing the updated Shockwave player, it may be because you have Data Execution Prevention enabled.

    To disable:
    Look in the root of your C: drive for boot.ini.
    Start a command line. Attrib c:\boot.ini -r -a -s -h
    Edit boot.ini (In notepad)
    Look for "noexecute=optin" and change it to "noexecute=AlwaysOff" (don't add or remove any spaces, line breaks, etc)
    Save boot.ini.
    In the command window type attrib c:\boot.ini +r +a +s +h
    Reboot. DEP is now disabled.
    Install the Shockwave Player update.

    Re-edit boot.ini to re-enable Data Execution Prevention, and reboot once again.

    Alternatively you can save a copy of the edited boot.ini, set the attribs to +r +a +s +h, and rename as necessary in case (read: when) you need to disable DEP again in the future.

    I figure a lot of users are going to have this problem (again), as Adobe still hasn't fixed this bug.

    • by WD (96061) on Thursday November 05, 2009 @03:48PM (#29998588)

      If the act of simply installing the software relies on violating DEP, do you think that perhaps may be an indication about the quality of the code itself? It may be time to think twice about whether you want it on your system. Uninstalling is probably easier and safer.

    • by Anonymous Coward on Thursday November 05, 2009 @03:49PM (#29998598)

      Ummm, why not use the simple right-click "my computer" and turn DEP off (or just add a DEP exception) instead of editing a text file?

      If you're having problems installing the updated Shockwave player, it may be because you have Data Execution Prevention enabled.

      To disable:
      Look in the root of your C: drive for boot.ini.
      Start a command line. Attrib c:\boot.ini -r -a -s -h
      Edit boot.ini (In notepad)
      Look for "noexecute=optin" and change it to "noexecute=AlwaysOff" (don't add or remove any spaces, line breaks, etc)
      Save boot.ini.
      In the command window type attrib c:\boot.ini +r +a +s +h
      Reboot. DEP is now disabled.
      Install the Shockwave Player update.

      Re-edit boot.ini to re-enable Data Execution Prevention, and reboot once again.

      • Re: (Score:2, Informative)

        by ThreeGigs (239452)

        Been there done that, and DEP status doesn't change unless a reboot happens. And if you've got DEP set to optin in boot.ini, it'll always re-enable itself. Yes, there are other ways to change it, but I always preferred to go directly to the root.

    • by Anonymous Coward on Thursday November 05, 2009 @03:49PM (#29998600)

      And I want to run an application that executes in its data area why?

      It would be different if the installer intentionally used some sort of self modifying code system.

      But the only possible explanation for why a Shockwave updater fails to run with DEP enabled, is that at least one of its threads is doing some sort of buffer overrun and running off into the woods. It just usually doesn't break things bad enough to make the installation fail, unless DEP actually stops the thread.

      Not exactly the type of program I want to be running on my computer.

      • by Spad (470073)

        Sophos AV's heuristics scanning (HIPS) goes mental when you try and install Shockwave; it gets flagged as suspicious behaviour and a buffer overrun risk (Incidentally, Adobe Reader is the same).

      • by lennier (44736)

        "And I want to run an application that executes in its data area why?"

        If it's using any kind of virtual machine with a dynamic languge and a just-in-time compiler (like Forth or Lisp or maybe an efficient implementation of Javascript), it might need to compile bytecode to x86 code and then execute it. How else are we going to implement these languages? "Nobody needs a dynamic language with incremental compilation, everyone should have separate run and compile phases" isn't really a long-term answer.

      • by blincoln (592401)

        And I want to run an application that executes in its data area why?

        There are two kinds of "DEP" in Windows - hardware DEP, and software "DEP". The software "DEP" is not literally "data execution prevention", it involves blocking the use of exceptions which aren't registered in a global table, or something along those lines. Yes, software that violates it is probably not great, but sometimes an alternative isn't available.

        • by yuhong (1378501)

          The software "DEP" is not literally "data execution prevention", it involves blocking the use of exceptions which aren't registered in a global table, or something along those lines.

          Yep, that is called SafeSEH. OS support for using the SafeSEH table was introduced in Windows Server 2003 and XP SP2, and compiler support for generating this table was introduced in Visual C++ 2003.

    • by tokul (682258)

      If you're having problems installing the updated Shockwave player, it may be because you have Data Execution Prevention enabled.

      Even Windows thinks that Shockwave is malware. :)

    • To disable:
      Look in the root of your C: drive for boot.ini.
      Start a command line. Attrib c:\boot.ini -r -a -s -h
      Edit boot.ini (In notepad)
      Look for "noexecute=optin" and change it to "noexecute=AlwaysOff" (don't add or remove any spaces, line breaks, etc)
      Save boot.ini.
      In the command window type attrib c:\boot.ini +r +a +s +h
      Reboot. DEP is now disabled.
      Install the Shockwave Player update.


      If I hadn't looked closely I would have assumed this was a relatively painless set of steps an end user would nee
    • I have no C:, you insensitive clod!

      (I have a root though.)

    • by operagost (62405)
      So... why are you removing the "archive" attribute? Just like that doing that spells the word "rash"?
    • by EXrider (756168)
      It needs to execute code from the data segment to install!? What a piece! Just un-install it and be done with it.
  • To me this just seems like user stupidity. You can have your computer hijacked a million different ways however if you pay attention to what you click you can avoid most.
  • Especially sobering when you consider Adobe's current push to be essentially required as an intermediary player for anyone who wants to see certain government data.

    Adobe is pushing for Flash and PDF... not Shockwave and PDF...

  • 1) Are there FOSS alternatives to Flash and/or Shockwave?

    2) Why(not)?

    3) If there was, would it help reduce problems like this?

    Please don't mod me as trolling for asking questions!

    • Re: (Score:3, Informative)

      by supersloshy (1273442)

      Google Gnash and Swfdec; they're coming along nicely, but aren't 100% replacements as of yet.

    • Re: (Score:3, Informative)

      by slimjim8094 (941042)

      1. Yes/no.
      2. See above. Nobody cares about Shockwave, though.
      3. Yes.

      It's called Gnash. See http://www.gnu.org/software/gnash/ [gnu.org]
      There's also a few others, such as http://swfdec.freedesktop.org/wiki/ [freedesktop.org] . Gnash is probably better.

      • Re: (Score:3, Interesting)

        by TheDarkener (198348)

        2. See above. Nobody cares about Shockwave, though.

        Nay, say I and the (many) school districts who visit shockwave-only educational sites. Not having Shockwave Director available on Linux has cost me clients. Talk about a slap in the face for trying to give schools a break by using good software, because they are too attached to bad software..

  • by hesaigo999ca (786966) on Thursday November 05, 2009 @04:20PM (#29999052) Homepage Journal

    I just dont use adobe products anymore, either flash, or shockwave, are too seriously integrated into our pcs, that when the day comes that skynet is self aware, that will be the first application it looks to to take over all pcs around the world....have we not learned anything from terminator?

    • by brkello (642429)
      If you think about it, this is a good thing. Skynet will probably have some adobe products on it somewhere which we can use to hack in to it and disable it, thus saving us all. Adobe has been protecting us from skynet since its inception.
  • by Anonymous Coward on Thursday November 05, 2009 @04:59PM (#29999618)

    Ok, I just compiled some stats on Shockwave version plugin distribution using roughly 30 million unique data points from July 1 of this year until about a week ago - here is roughly the distribution (includes IE/FF/etc. - all major browsers):

    Not installed => 67.54%
    11,0,0,0 => 2.86%
    10,2,0,0 => 2.84%
    10,1,0,0 => 2.59%
    11,0,0,465 => 2.41%
    11,5,0,0 => 2.05%
    11,5,1,601 => 1.90%
    8,5,1,0 => 1.75%
    10,1,4,0 => 1.73%
    11,0,0,429 => 1.58%
    11,0,3,472 => 1.56%
    10,1,1,0 => 1.53%
    11,5,0,596 => 1.46%
    11,5,0,600 => 1.38%
    11,0,3,471 => 1.35%
    11,5,0,595 => 1.21%
    11,0,0,458 => 0.93%
    10,3,0,0 => 0.78%
    11,0,3,470 => 0.66%
    8,0,0,0 => 0.43%
    10,1,3,0 => 0.37%
    8,5,0,0 => 0.32%
    11,0,3,0 => 0.23%
    10,0,0,0 => 0.16%
    10,0,1,0 => 0.11%
    7,0,0,0 => 0.10%
    11,5,1,0 => 0.08%
    10,4,0,0 => 0.04%
    6,0,0,0 => 0.03%

    What is potentially troubling is that there does not appear to be much in the way of upgrade movement in Shockwave installs. So if "Adobe Shockwave Player versions prior to 11.5.2.602" are truly at risk, we are talking about 30% of web users roughly.

    I will publish a more in-depth report later today here: http://www.statowl.com/ [statowl.com] in the plugin section [statowl.com]. I have been neglecting that site anyways - time to update the stats - the past three month are absent - sigh....

  • IF you look in Firefox add-ons/plugins it will be listed as

    "Shockwave for Director 11.5.2.602"

    whereas regular flash player is listed as

    "Shockwave Flash 10.0.32.18"

    I don't think 450,000,000 desktops out there have a shockwave player installed? I doubt it is that popular.

  • by Anonymous Coward

    Rolled this out to a small lab (you know how students are, and where they can go, better safe than...).

    After installation, *all* users are asked to individually install another component when the Shock embed in the open page attempts to play (which as non-admins, they can't do). Since several of our teaching programs Shockwave this presents a real PITA.

    Previously there was no such behavior. Any ideas?

    • Try going somewhere with a shockwave embed as an admin, let the install mechanism do it's download happy dance, then have someone with user privileges do the same. I think you'll find that the problem is solved.

  • Oh, so this isn't a story about astronomy... what a relief!
  • I checked my firefox addons list and sure enough, Shockwave was in there. The plugins were Disabled. Well, I might as well get rid of it if I never use it, no? And so the hunt began. I checked my add/remove list. Nope, not there. I tried searching for its files, but still couldn't find it. I googled how to uninstall it, fretted over the invisible and uninstallable evil program with security holes hiding on my computer as I navigated some links, checked the firefox plugin page, and after ten or so minutes I

panic: kernel trap (ignored)

Working...