Snow Leopard ships with vulnerable Flash Player | Hacker News Reader

Snow Leopard ships with vulnerable Flash Player

blogs.zdnet.com

28 pointsthere18 comments

The best upgrade for my Flash experience on Mac: http://rentzsch.github.com/clicktoflash/

Really spotty story in terms of actual facts. Ok, it's an outdated version. How outdated? Are there any documented exploits that were fixed in the new version? The story never goes into detail about what exactly makes this version "vulnerable".

I just installed snow leopard on my computer today. I haven't checked to see if my flash is in fact out of date (I'm typing this on my iPod touch), and I'll certainly upgrade if it is, but I see no reason to get excited about it.

While it's light on details, it's unfortunately something worth getting somewhat excited about. A couple of very nasty vulnerabilities have been found in Flash over the last year or so - vulnerabilities exploitable across OSes. You can read about last year's stuff in exhaustive detail here: http://documents.iss.net/whitepapers/IBM_X-Force_WP_final.pd...

A more recent advisory is http://www.adobe.com/support/security/advisories/apsa09-03.h...

There was a blog post by Thomas Ptacek of Matasano security discussing the importance of Flash exploits recently but it seems to have disappeared temporarily in some sort of blog meltdown. Key quotes are still floating around the net though -

"We have different versions of the OS, and we have Mac users. But we’ve only got one Flash vendor, and everyone has Flash installed. Why do you care about Flash exploits? Because in the field, any one of them wins a commanding majority of browser installs for an attacker."

first it will download any necessary software updates that have come out since the disc was pressed

(from http://daringfireball.net/linked/2009/08/28/murphy)

Does anyone know if this covers Flash?

It does not.

They should stop shipping Flash with the OS. Anyone know if Windows 7 is going to ship with Flash, too?

Windows 7 doesn't ship with flash. In fact, Windows has never shipped with flash.

I don't know if it ships with Windows 7 but it's certainly shipped with Windows before.

http://www.pcworld.com/businesscenter/article/146623/windows...

Googling around you can also find announcements that Flash 5 will ship with Windows XP.

That was a downloadable service pack, and it was an optional component.

At any rate, I'm using Windows 7 right now. I assure you I'm not lying.

http://www.adobe.com/macromedia/proom/pr/2001/fp5_msxp.html

Windows has shipped with Flash. I didn't say you're lying, I said 'Windows has never shipped with Flash' is inaccurate.

Oh, you're right. It looks like Windows XP was the first and last version of Windows to include Flash.

But nearly every OEM ships Flash in their Windows install, though usually only the ActiveX version for IE.

It probably ships with Moonlight, or Darklight or whatever it is.

Are there actually any not vulnerable Flash players? Or at least not yet vulnerable?

Ugghh... i wish flash would just go the fuck away.

Mine isn't outdated as the article says.

You know, this could be an elaborate phishing scam. The download page for the new Flash player is not secure. You could be installing a Trojan horse if you "upgrade."

A phishing scam where someone (1) compromised Adobe's web server, (2) persuaded Apple that there is a security problem that isn't really there, and (3) got ZDnet to report on it. Yeah, that's really likely.

Reply on news.ycombinator.com