New Flash zero-day exploit that allows system takeover | Hacker News Reader

New Flash zero-day exploit that allows system takeover

blogs.adobe.com

89 pointsck243 comments

This may be confirmation bias, and admittedly no software is without vulnerability, but is it just me or do we see these updates for Flash moreso than just about any other internet-facing client?

Is Flash really that bad or is everyone else just bad at reporting zero-day exploits publicly?

Flash really is that bad:

http://en.wikipedia.org/wiki/Adobe_Flash#Flash_client_securi...

Also "Zero Day Exploits" generally mean that the exploit was released to 3rd parties before it was given to the company whose software was being exploited.

I think 0-day means something a little different http://en.wikipedia.org/wiki/Zero-day_attack

That Wikipedia article appears to give the same definition. What difference are you trying to call attention to?

They are correct (it's zero-day) in that the vulnerability is announced, yet Adobe says it's going to be a week (the 21st) before they release a fix.

Vulnerability known before the vendor can release a fix is "zero-day".

Flash really is that bad. As a potential malware vector & as something where most users are probably hopelessly out of date (and not by their own fault).

I'm an ex-flash developer (8 years). I can tell you it's bad. I could find many ways of crashing the browser a few years back. And just reading this article, I went about:plugins in chrome and disabled flash for now.

Most software companies will put security bugs on a uber priority fix list. Everything else goes to the back of the line :).

One of the best ways to get any bug fixed in any Library, OS etc... is to find a way to exploit it.

I'm a sysadmin at a Big 4 auditing firm. Adobe products are the bane of our existence.

Acrobat 9.4.1 takes over to install. Oh that's right, there's a vulnerability in that version, so now we're gonna have to push 9.4.2

When a user's Flash installation is corrupted, many times the uninstaller fails, so we have to use Windows Installer Cleanup to remove it. Every week, there's a new issue. Can't these fellows get it right?

It's bias.

Java has ~3 times as many holes as Flash does (if one is comparing in the context of "browser plugins").

I can't comment on Flash being worse than other software, but one thing is clear: it extends the attack surface of your browser with a whole maze of exploitable goodness.

Browsing on iOS made me finally realize how unimportant Flash is to me. I've since disabled it on every computer I use.

I actually had the reverse chronology. I discovered how using ClickToFlash gave me significantly better battery life on my MBP, along with faster page loads and zero mysterious pinwheels. ClickToFlash has a better price-performance ratio than upgrading to an SSD – and I love my SSD.

So when I got an iPad, I was especially mystified at why anyone should complain about this garbage being missing.

edit: Useful links.

Go grab ClickToFlash (Safari, OS X):

http://clicktoflash.com/

Or the Safari extension for Mac or Windows:

http://hoyois.github.com/safariextensions/clicktoflash/

Or the Firefox equivalent:

https://addons.mozilla.org/en-US/firefox/addon/flashblock/

rentzsch's clicktoflash is actually considerably out of date at this point.

The new, Safari-extensionized version that is mentioned second is much better and updated frequently. (this link: http://hoyois.github.com/safariextensions/clicktoflash/)

(mathematical stickler: seeing as ClickToFlash is free, it's price/performance ratio is always zero)

Haw, quite so. Still, even if the SSD were given to you for free, and we measured cost in installation time, the cost in time to install each one versus the resulting gains would be tremendously in favor of ClickToFlash, so awful is Flash.

Don't forget FlashControl for Chrome:

https://chrome.google.com/extensions/detail/mfidmkgnfgnkihnj...

I prefer enabling Click-to-play in about:flags.

Click-to-play doesn't let you disable it temporarily, which is a problem for some sites that rely on background Flash files. On Chrome, I prefer https://chrome.google.com/extensions/detail/gofhjkjmkpinhpoi...

I'm not sure I understand your meaning. Using just click to play in about:flags, on a page with blocked plugins you can click the icon which appears next to the bookmark star and select "Run all plug-ins this time". Is that not sufficient?

Ugh, I honestly hadn't noticed that. Maybe it wasn't enabled yet on the dev build or something.

Still, per-site whitelisting is nice.

For per-site whitelisting, you can click on that icon and check "always allow plugin on ..." or go to "settings > under the hood > content > plugins > manage exception."

It isn't the easiest or most intuitive way, but so far worked well enough to me.

I am not 100% sure if that extension is totally blocking the Flash files. Last time I checked it, it was only applying a "display: none" with CSS, and some files slipped past it, making it ineffective against 0-day exploits.

Yeah, I've been noticing something similar. Since upgrading my Android phone to 2.2, with Flash support, browsing the web got slower and clunkier. So many pages have flash advertisements on them, and the phone just doesn't have the horsepower to render them and stay responsive. I wonder if I can turn it off...

go to settings, enable plugins, on demand

I did it fairly early getting my android, it makes a big difference

Thanks, this is a great tip.

in the browser, go to settings, then click 'enable plug-ins' and choose 'on demand'. it will work like clicktoflash and show you a container with an icon wherever flash applets are on a page, which you can just tap on to start playing if you want to.

That's fine if you don't play flash games.

I just use noscript. No flash will load unless i tell it to, no javascript will load unless i allow it. It's like we first intended, i am the god of my browser. NONE SHALL PASS!

Agreed. What you lose is about 99% ads or games or overly complicated restaurant websites UI's. For cases where its like a Flash video player, i just click on the NoFlash/ClickToFlash placeholder rectangle, that then allows the actual Flash asset to load, and I partake of it. I've generally seen less freezes, crashes and memory use since switching to this approach.

Chrome already updated: http://googlechromereleases.blogspot.com/2011/03/stable-and-...

Someone put up a partial decompile here: http://bugix-security.blogspot.com/2011/03/cve-2011-0609-ado...

I thought Chrome sandboxes all plugins. How do Flash vulnerabilities - or any plugin vulnerability - affect Chrome, in particular on OS X?

Chrome can not sandbox all plugins without some effort. Only recently did they add support for sandboxing Flash to the stable Chrome release, and even then, only on Windows:

http://googlechromereleases.blogspot.com/2011/03/chrome-stab...

Where can I get accurate information on how sandboxing works on OS X, what it exactly does, what its limits are, and which vulnerabilities it does and doesn't protect against?

A plugin exploit is another vector through which one can attack the sandbox.

FlashBlock: it's not just for keeping your browser from crashing, saving your RAM, conserving battery life, and/or keeping your computer from locking up!

Adobe reminds me of Apple in the 90s at the low point

They remind me more of Microsoft at Apple's 90s low point. Their software is everywhere, and it's full of security problems as a side effect of how there was little consideration for security in the original design.

Microsoft has only recently caught up with its insecure legacy. That suggests that we have another 15 years before Flash becomes stable software.

What's the purpose of being able to inject Flash files into Excel documents again?

  =SUM(SWF1:SWFn)

Like it or not, at many big companies, word docs and excel spreadsheets (and powerpoints...) get abused in incredible ways. You'll somehow end up distributing a training document in an excel spreadsheet, and then some not-so-tech-savy manager will come up with the brilliant idea of including VIDEOS in the training documents... and then it begins.

Simply put, Microsoft and Adobe will cram as much crap into their fileformats (pdfs...) as they think random middle managers in large corporations want (and sadly actually use...).

I've seen such things done. It hurts to get a word doc that's just full of embedded jpgs from a scan of a printed out pdf that was originally a website...

Why did the security advisory mention attacks against Adobe Reader when the announcement was about Flash?

acrobat/reader content can easily come with embedded flash objects, this is a common way flash vulnerabilities are exploited.

Reply on news.ycombinator.com