New Adobe Flash 0-Day 133
Trailrunner7 writes "Adobe is warning its users about a critical vulnerability in Flash that affects Adobe Reader and Acrobat, as well, and is being used in some highly targeted attacks right now. The vulnerability in Flash Player affects Reader and Acrobat, both of which include Flash functionality, but it does not affect Reader X. Adobe officials said that Reader X's Protected Mode sandbox would prevent successful exploits. The company plans to have a patch for the affected products ready by next week for all platforms, including Windows, Mac, Linux, Android and Solaris."
Thanks for the warning... (Score:2)
I re-installed Windows and cleared up the infestation last year. Not a particularly happy episode.
Re: (Score:1)
You clearly didn't terminate the infestation
Flash in Acrobat Reader (Score:5, Insightful)
What the hell for? Fucking Adobe.
Re: (Score:2)
Re: (Score:2)
I've hearing on slashdot about these open source readers for some time, but only recently did I experience one. I had a 300MB pdf that Adobe Reader just wouldn't open at all. A day or so of reading forums and updating components and I finally got it to open the file.... takes about 5 minutes and lags whenever I try to scroll. So I downloaded Foxit (after reading about it on /., and I'll never switch back. It opens the scene in about 2 seconds, and scrolls nicely. (Not that the file DID open originally
Re: (Score:2)
foxit is not exactly open source, is it
Re: (Score:3)
Official Evince for Windows MSI [gnome.org].
Re: (Score:2)
Re: (Score:1)
Re: (Score:1)
There is only one sane PDF standard, PDF/A, and Flash is not in it.
Re: (Score:2)
To make it the slowest possible PDF reader available. I recently switched to FoxIt after Adobe's shitty software continually hung Windows for MINUTES at a time searching for disconnected network printers I only access when I'm at the office.
No problems with FoxIt and thus I haven't bothered to look back.
Re: (Score:2)
This is why it's bad that Windows doesn't include a basic PDF reader. Mac OS X uses Preview (an independent reimplentation) and Unix uses derivatives of Ghostscript (an independent reimplementation).
Re:Flash in Acrobat Reader (Score:5, Funny)
What the hell for? Fucking Adobe.
How else do you fit so many vulnerabilities in one product so efficiently? In fact they found they had to tap higher dimensions to fit more holes than there was physical space in Adobe products. Kinda like a cross between the Tardis and a permanent help desk role: The void is greater than physically possible.
Version check (Score:3)
for those of you who want to check which version you have and which is the latest:
http://www.adobe.com/software/flash/about/ [adobe.com]
Re: (Score:1)
Re: (Score:2)
btw - I have a 64 bit plugin running under Firefox/Fedora.
I can beat that (Score:1)
Adobe tells me that I'm running version 10.3.180.42. Or rather, mostly *blocking* version 10.3.180.42 with ClickTo Flash in 64 bit Safari.
Re: (Score:1)
Better yet:
https://www.mozilla.com/en-US/plugincheck/
It'll check ALL your plugins and tell you if they're up to date. It might fail for obscure plugins that it doesn't know about, but all the major ones are supported. Plus, you don't send a whole bunch of data to a company like Adobe.
Re: (Score:2)
Version check does not help much, because the fix has not been issued yet. "The company plans to have a patch for the affected products ready by next week for all platforms"
Shockwave flash file inside an excel spreadsheet? (Score:5, Informative)
Re: (Score:2)
The payload might only be leveraging a specific bug in XP, but what's to say that a different payload couldn't be delivered through the same attack vector? One that targets other versions of Windows, even other operating systems altogether?
Re: (Score:3)
The rest of us can rest easy and enjoy a little bit of schadenfreude.
I'm sorry, I can't even pronounce that. I'd like a Kahlúa please.
Re: (Score:1)
shaw den froy duh (lightly roll the "r" in froy for some extra authenticity)
German for "bad pleasure", means taking pleasure at the misfortune of others.
Re: (Score:2)
Sigh.
Re: (Score:2)
Kraft durch Schadenfreude.
Re: (Score:1)
TFA says DEP is the reason it doesn't work on Win7, so doesn't that mean 32-bit Win7 is still affected?
Re: (Score:1)
What's in a name? (Score:2)
Adobe is copying Apple from ten years ago by naming the product that comes after 9, 'X'. One key difference: Acrobat X does not run on Apple computers.
Re: (Score:1)
Perhaps Acrobat X doesn't run on Apple computers because they're not powerful enough xD? One key difference: Your computer is expensive.
Wrong (Score:1)
Adobe is copying Apple from ten years ago by naming the product that comes after 9, 'X'. One key difference: Acrobat X does not run on Apple computers.
Where do you get your misinformation? Reader X runs just fine on my MacBook Pro with Snow Leopard.
who uses Adobe Reader anyways? (Score:5, Informative)
Seriously, get FoxIt PDF reader. It's free, and approximately 5 million times faster than Adobe Reader.
Re: (Score:2)
Really? I have to use PDFs a lot, and I've never seen a PDF render faster in Acrobat than Foxit.
I guess it's based on some other factor we have different.
Re: (Score:2)
In my experience Foxit is faster than Adobe on cold load.. but if you have Acrobat and acrotray is running Acrobat is faster .. but that is simply because it is already mostly sitting in memory
Great, but does it work with everything? (Score:2)
I had no end of problems using "other PDF" readers when I print postage from USPS.COM (yeah, I sells stuff on and off on fleaBay) This is not to say that I am a fan of Adobe, but with some things, there's just no substitute.
Re: (Score:2)
I don't even have Reader installed, I use FoxIt for any PDFs I have to open and have never noticed issues. YMMV, but I suggest you at least give it a try.
I notice the biggest difference when working with large (50+ page) PDF docs on my netbook. Adobe Reader is unbearably slow to scroll through pages, but FoxIt is painless and smooth.
Re: (Score:2)
We tried it at work, but we get lots of crazy restricted pdfs from outside & we had even more problems with Foxit than Reader. Which I know, is pretty hard to believe.
Re: (Score:1)
Re: (Score:2)
It's also actually a hell of a lot less secure than Adobe, oddly enough. Run a fuzzer with it and it falls over very easily. Apple's PDF reader has the same problem - even worse, in fact (15x as many exploitable vulnerabilities as Adobe Reader, according to a larger-scale experiment than I cared to run, see Charlie Miller's presentation at CanSecWest last year). I haven't tried fuzzing any of the other "fully featured" readers yet, but I'd be surprised if any of them did much better.
The reason so many vulne
Reader X sucks (Score:2)
Reader 8 and 9 were tolerable, but Reader X seems like less of a reader app and more of a bloated advertisement for Adobe's other products. I suppose my machines will remain vulnerable but usable.
Re: (Score:2)
One nice thing about Reader X for me is when the browser plug-in is invoked, it displays a progress bar indicating the download of the PDF.
Re: (Score:1)
Reader 8 isn't vulnerable to this because it lacks support for embedded flash files. Likewise removing authplay.dll (the dll Reader 9+ uses for embeded flash data) should mitigate the issue as well.
When will Adobe get its act together? (Score:3)
Re: (Score:2)
No product is entirely secure, browsers are getting patched all the time due to people finding new vulnerabilities. This covers all browsers, Firefox, IE, Safari, Opera and even Chrome.
What @#$@#$^ me off, is being forced to keep watch on two fronts for my security. If i'm using my browser, I'd wish the only thing I was able to blame for an exploit was the browser itself. With stupid plugins that web designers feel they must force visitors to use, they force me to double the potential exploitable entry po
Re: (Score:2)
Particularly with how advanced our compilers and other tools are now. When you combine compiler warnings, bounds checking, and stack shielding you don't really have any leg to stand on when it comes to exploits in your code do you?
Re: (Score:2)
When will Adobe get its act together?
My guess: it'll be when Adobe releases it's own OS, entirely written in Flash, which also will run on smart-phones - that's the next logical development... now that emacs is lagging far behind.
0 day... for Acrobat? (Score:5, Funny)
How can it be a 0 day attack when Acrobat takes 2 days to start?
Re: (Score:2)
Lately 0-day has come to mean they haven't seen it in the wild yet and haven't released the code to reproduce it (AFAIK they haven't). But yeah they toss that on anything these days .A true zero day is one you keep to your group or yourself. Groups stack them like cards in a deck for later use while keeping them secret.
Re: (Score:1)
All 0-day means is that they found the exploit in the wild before they knew the vulnerability existed.
Re: (Score:2)
Isn't that the job of newspapers?
Reader X warning - missing IFilter (Score:2)
If you are considering "upgrading" to Reader X for safety, be aware that the installer does not contain an IFilter for extracting text from PDF files, so desktop search products relying on the IFilter will no longer be able to search your PDF files. Actually, it's worse than that. Not only does it lack an IFilter, it will remove the IFilter installed by older versions. More details here [adobe.com].
this is why.... (Score:2)
This is why i hate so many websites that use flash, why put all your eggs in one basket, so that when again another flash 0 day comes out, your like...wtf....do we really need to be stuck to a propitiatory software that is useless when it comes to security....all in the hopes of achieving greater visual effects for your site....at least offer a flashless option to view the site.....so many suffer from the fact that if you have no flash installed, you can not continue, but this means it hurts them more in th
Re: (Score:2)
On the other hand, at least Android users (flash is also vulnerable there) don't have to wait for their carriers to decide when they can update their flash runtime. I assume you can just update it right there from the marketplace.
Not sure about those Androids that ship with flash though - maybe they might be stuck?
Flash inside Excel? Erm... (Score:2)
Article reports: "There are reports that this vulnerability is being exploited in the wild in targeted attacks via a Flash (.swf) file embedded in a Microsoft Excel (.xls) file delivered as an email attachment"
*BOGGLE* If that sort of functionality is even possible, then it was just an accident waiting to happen.
Re: (Score:1)
the description made me twitch a bit too.
next step i guess is to e-mail xp vmware images running internet explorer iframing excel using flash embedding a pdf
Re: (Score:2)
Excel supports OLE, and has since the 90s. Note that it's not actually putting the reader or any other directly executable code in the spreadsheet, but it can contain a reference saying "I have a SWF object that I'd like to render here" and the OS will load whatever it has that renders those.
So who did HBGary sell this one to? (Score:1)
Switch to Sumatra! (Score:3)
In related news, SumatraPDF [kowalczyk.info], the primary open-source PDF viewer for Windows, just had its 1.4 release a couple of days ago. In the course of the past ~6 months they've added GDI support so documents can print quickly (rather than sending huge bitmaps to printers), improved performance in all sorts of ways (notably including much-faster zooming and searching), and quashed lots of bugs. They've also added a browser plugin and a Windows Search filter (both optional). So even if you've tried it in the past and it didn't meet your needs, it's likely worth trying again.
Outside of multimedia (e.g. Flash) and JS- both of which I've never seen used in a PDF for anything other than an exploit- the only thing Sumatra lacks at this point, AFAIK, is the ability to work well with forms.
Re: (Score:2)
I switched from FoxIt to Sumatra on Windows after I ran into a PDF that wouldn't open in FoxIt.
Get rid of Flash. (Score:1)
Re: (Score:2)
you're kidding, right?
the thing flash does that advertisers care most about is work the same on everyone's browser. if you're paying for impressions that means a LOT.
besides that it has a whole bunch of capabilities that HTML5 doesn't get close to. try combining:
- fonts
- anti-aliased vector art
- bitmaps & pixel effects
- animations
- video
- 3d
in a single pre-compiled binary format, using little to no coding.
even if html5 could so all of this, there are still no tools sign
shouldn't there be a law agains this stuff? (Score:2)
Seems to me, if any other type of business that produces goods, had as many bugs and other crap as the adobe reader has had, wouldn't they be given large fines and other crap and not allowed to put products out until they fix it?
While I surf safe (even with the large amount of pirated/cracked/copyrighted stuff I download, I don't get hit with virus/trojans/worms/whatever. Yet, my family, friends don't have the talent, or brains to be online like i do. Update their flash player? doubt it. update acro
Here we go again ... (Score:1)
The usual "Ragging on Flash" roundup rolling in.
Let's look at the facts:
1) Flash is by far the most ubiquitous end-user plattform in existance.
2) For a little more than a decade competitors have tried to dethrone Flash. And even the most promising of those failed miserably due to pure and utter incompetence in delivering what people want and rich client developers need. (Java Media Framework and JavaFX anyone?)
3) Compared to it's penetration and availability, Flash actually is one of the safest plattforms o
Re: (Score:2)
"1) Flash is by far the most ubiquitous end-user plattform in existance."
No, that would be far from the truth. HTML is more widespread at the moment.
"2) For a little more than a decade competitors have tried to dethrone Flash. And even the most promising of those failed miserably due to pure and utter incompetence in delivering what people want and rich client developers need. (Java Media Framework and JavaFX anyone?)"
Yes Java sucks, but only as badly as Flash sucks.
"3) Compared to it's penetration and ava
Re: (Score:2)
No, that would be far from the truth. HTML is more widespread at the moment.
HTML isn't a programming language. Nor does it have a unified VM.
HTML5 + Canvas + Video tag. There you go.
Proves once again: You, as every other person here ragging on Flash, do not know what you are talking about nore have you spent 3 minutes thinking about the subject. And I'm not being offensive here, I'm just stating the facts as they are.
There is no way that HTML5 + Canvas + Whatever can deliver the functionality of a unfied ub
Re: (Score:2)
Go to the chrome experiments site. How about a re-implementation of the classic DOS game, OOTW?
If that can be done in HTML5, all of your links (which, BTW, give me a "MISSING PLUGIN" notice on a blank screen) can be too.
Sorry, buddy. Flash is fucking finished.
Re: (Score:3)
Secure OS's are only as good as the software running on it without administrator privileges.
There, fixed it for ya.
Re: (Score:2)
What does that have to do with anything? Do you think that malware can't do bad things unless it gets root?
Re:Mac, Linux, Android and Solaris. (Score:4, Interesting)
Most exploits are written as an attempt to get root/admin or affect system settings. In my testing of adobe exploits (not this one, but previous ones) I noticed that if I ran as a limited user the exploits don't usually work. If I run as admin with UAC running, the UAC never comes up and the exploit works. UAC + admin is not the same as running as a limited user.
Yes, you're right about malware running in user userspace and that's a real problem with this approach, but running as limited gives some benefits that are not obvious. Arguably, AV and smart computer usage makes up for the rest. This excel file seems to already be in all the major virus definitions.
Re: (Score:1)
It makes you wonder if my netbook (XP, limited user) is more secure than my notebook (Vista, UAC). Both have Microsoft Security Essentials and Secunia PSI.
Sadly PSI doesn't complain about Flash being insecure even though I only have 10.2.152.26, even though that's what it is installed for.
Re: (Score:3)
Re: (Score:2)
Absolutely.
The main benefit to running as root/system/administrator is that it makes it easier to hide. It's much harder for a process to hide from antimalware tools (which are running as root/system/administrator) if that process is running with lower privileges. For Macs and Linux, it's almost completely irrelevant--so few people run antimalware tools on those platforms that the difference between malware with and without root is inconsequential.
Re: (Score:2)
Secure OS's are only as good as the software running on it without administrator privileges.
There, fixed it for ya.
So if I understand correctly...
Protect the operating system at all costs... but pay no attention to what really matters ... YOUR DATA.
Re: (Score:2)
Unless it's a multiuser system. In that case YOUR DATA may be toast but everybody else's will be fine.
Re: (Score:2)
All of which can be done from a user account, even if it is only limited to when the user is logged in.
Re: (Score:2)
Re: (Score:3)
Good luck leaving userland from a flash plug-in, unless you are dumb and run everything from root.
Re: (Score:2)
Re: (Score:1)
Yeah, because local privilege escalation exploits in Linux are just so rare...
Re: (Score:2, Interesting)
Agreed. Local privilege escalation exploits are a dime a dozen on desktop Linux distributions (especially those that install the full Gnome suite). Surprisingly enough, Ubuntu is one of the better distributions in this regard because it ships with reasonably decent App Armor profiles.
Re: (Score:2)
Re: (Score:1)
Hey, don't you know? Real men run as root. [garyshood.com]
I just laughed for the first time today.
Re: (Score:2)
Re: (Score:2)
Re: (Score:3)
Someone said no exploits for Mac and Linux, huh?
Speaking of which, this pretty much means that every PowerPC Mac ever made has to be thrown in the scrap heap, doesn't it? Because Adobe has stopped updating Flash for PowerPC, which means it will be vulnerable forever. So unless you want to give up Hulu, YouTube and half the internet, they're pretty much doorstops now. Or pretty Linux home servers.
I wonder if anybody wants to buy a G4 PowerBook? It's faster than a lot of the Atom netbooks they're still selling.
Re: (Score:2)
Apple stopped supporting PowerPC Macs years ago, and has patched *more* security holes in the OS since then than have been reported in Flash.
Re: (Score:2)
Apple stopped supporting PowerPC Macs years ago, and has patched *more* security holes in the OS since then than have been reported in Flash.
Leopard was the last version of OS X to run on PowerPC. This [apple.com] is a security update for Leopard published last week.
Re: (Score:3)
Someone said no exploits for Mac and Linux, huh?
I've also heard rumors that zero Windows ME users are getting infected. Just sayin...
Re: (Score:3)
I've also heard rumors that zero Windows ME users are getting infected.
Apparently, having to run System Restore every hour also wipes out viruses.
Re: (Score:2)
Who said that?
Genuinely, who said that?
[citation needed]
There are plenty of documented exploits that have been fixed on both platforms. The only people who claim that Platform A's fans claim that there are "no exploits" are people who hate Platform A and believe everyone should use Platform B.
Everyone else is aware that no OS is safe. Well, except the users of BeOS. Both of them said they were pretty safe.
Re: (Score:2)
Re: (Score:2)
I wanted to read up on djvu but I went to the site and they didn't have the info posted in a PDF file, so I skipped it. ;)
Seriously though, why isn't it more popular? Easy. It's for the same reasons opendoc isn't popular yet:
* like MS Office, Adobe Reader is already entrenched
* Commerce has largely standardised on PDF
* PDF is basically encapsulated postscript, which makes it ideal for proofing work that is going to press
Also, PDF is an open standard, and you can choose from a number of readers and print fil
Re: (Score:2)
Re: (Score:3)
Because .PDF is the new ASCII, and DjVu isn't.
I'm willing to gamble that when I want to open a .PDF document 30 years from now, it's not going to be a problem on whatever platform I'm using at the time. But if my data was saved in some nonstandard but "optimized" format like DjVu, it will effectively be gone forever.
Replacing one file format with another is not the solution, because the file format itself is not the problem. Piss-poor engineering practices at Adobe are the problem.