5 ms·

Snow Leopard ships with vulnerable Flash Player

28 points by there 17y ago

harpastum 17y ago
Really spotty story in terms of actual facts. Ok, it's an outdated version. How outdated? Are there any documented exploits that were fixed in the new version? The story never goes into detail about what exactly makes this version "vulnerable". I just installed snow leopard on my computer today. I haven't checked to see if my flash is in fact out of date (I'm typing this on my iPod touch), and I'll certainly upgrade if it is, but I see no reason to get excited about it.
- pvg 17y ago
  While it's light on details, it's unfortunately something worth getting somewhat excited about. A couple of very nasty vulnerabilities have been found in Flash over the last year or so - vulnerabilities exploitable across OSes. You can read about last year's stuff in exhaustive detail here: http://documents.iss.net/whitepapers/IBM_X-Force_WP_final.pdf http://documents.iss.net/whitepapers/IBM_X-Force_WP_final.pd... A more recent advisory is http://www.adobe.com/support/security/advisories/apsa09-03.html http://www.adobe.com/support/security/advisories/apsa09-03.h... There was a blog post by Thomas Ptacek of Matasano security discussing the importance of Flash exploits recently but it seems to have disappeared temporarily in some sort of blog meltdown. Key quotes are still floating around the net though - "We have different versions of the OS, and we have Mac users. But we’ve only got one Flash vendor, and everyone has Flash installed. Why do you care about Flash exploits? Because in the field, any one of them wins a commanding majority of browser installs for an attacker."
- colinprince 17y ago
  first it will download any necessary software updates that have come out since the disc was pressed (from http://daringfireball.net/linked/2009/08/28/murphy http://daringfireball.net/linked/2009/08/28/murphy) Does anyone know if this covers Flash?
  - eli 17y ago
    It does not.
lisper 17y ago
You know, this could be an elaborate phishing scam. The download page for the new Flash player is not secure. You could be installing a Trojan horse if you "upgrade."
- gjm11 17y ago
  A phishing scam where someone (1) compromised Adobe's web server, (2) persuaded Apple that there is a security problem that isn't really there, and (3) got ZDnet to report on it. Yeah, that's really likely.
johnnybgoode 17y ago
They should stop shipping Flash with the OS. Anyone know if Windows 7 is going to ship with Flash, too?
- wyday 17y ago
  Windows 7 doesn't ship with flash. In fact, Windows has never shipped with flash.
  - pvg 17y ago
    I don't know if it ships with Windows 7 but it's certainly shipped with Windows before. http://www.pcworld.com/businesscenter/article/146623/windows_xp_sp3_includes_vulnerable_flash_player.html http://www.pcworld.com/businesscenter/article/146623/windows... Googling around you can also find announcements that Flash 5 will ship with Windows XP.
    - wyday 17y ago
      That was a downloadable service pack, and it was an optional component. At any rate, I'm using Windows 7 right now. I assure you I'm not lying.
      - pvg 17y ago
        http://www.adobe.com/macromedia/proom/pr/2001/fp5_msxp.html http://www.adobe.com/macromedia/proom/pr/2001/fp5_msxp.html Windows has shipped with Flash. I didn't say you're lying, I said 'Windows has never shipped with Flash' is inaccurate.
        wyday 17y ago
        Oh, you're right. It looks like Windows XP was the first and last version of Windows to include Flash.
  - blasdel 17y ago
    But nearly every OEM ships Flash in their Windows install, though usually only the ActiveX version for IE.
jpcx01 17y ago
Ugghh... i wish flash would just go the fuck away.
raquo 17y ago
Are there actually any not vulnerable Flash players? Or at least not yet vulnerable?
joubert 17y ago
Mine isn't outdated as the article says.
rimantas 17y ago
The best upgrade for my Flash experience on Mac: http://rentzsch.github.com/clicktoflash/ http://rentzsch.github.com/clicktoflash/

28 points by there 17y ago

Really spotty story in terms of actual facts. Ok, it's an outdated version. How outdated? Are there any documented exploits that were fixed in the new version? The story never goes into detail about what exactly makes this version "vulnerable". I just installed snow leopard on my computer today. I haven't checked to see if my flash is in fact out of date (I'm typing this on my iPod touch), and I'll certainly upgrade if it is, but I see no reason to get excited about it.

pvg 17y ago
While it's light on details, it's unfortunately something worth getting somewhat excited about. A couple of very nasty vulnerabilities have been found in Flash over the last year or so - vulnerabilities exploitable across OSes. You can read about last year's stuff in exhaustive detail here: http://documents.iss.net/whitepapers/IBM_X-Force_WP_final.pdf http://documents.iss.net/whitepapers/IBM_X-Force_WP_final.pd... A more recent advisory is http://www.adobe.com/support/security/advisories/apsa09-03.html http://www.adobe.com/support/security/advisories/apsa09-03.h... There was a blog post by Thomas Ptacek of Matasano security discussing the importance of Flash exploits recently but it seems to have disappeared temporarily in some sort of blog meltdown. Key quotes are still floating around the net though - "We have different versions of the OS, and we have Mac users. But we’ve only got one Flash vendor, and everyone has Flash installed. Why do you care about Flash exploits? Because in the field, any one of them wins a commanding majority of browser installs for an attacker."
colinprince 17y ago
first it will download any necessary software updates that have come out since the disc was pressed (from http://daringfireball.net/linked/2009/08/28/murphy http://daringfireball.net/linked/2009/08/28/murphy) Does anyone know if this covers Flash?
- eli 17y ago
  It does not.

lisper 17y ago

You know, this could be an elaborate phishing scam. The download page for the new Flash player is not secure. You could be installing a Trojan horse if you "upgrade."

gjm11 17y ago
A phishing scam where someone (1) compromised Adobe's web server, (2) persuaded Apple that there is a security problem that isn't really there, and (3) got ZDnet to report on it. Yeah, that's really likely.

johnnybgoode 17y ago

They should stop shipping Flash with the OS. Anyone know if Windows 7 is going to ship with Flash, too?

wyday 17y ago
Windows 7 doesn't ship with flash. In fact, Windows has never shipped with flash.
- pvg 17y ago
  I don't know if it ships with Windows 7 but it's certainly shipped with Windows before. http://www.pcworld.com/businesscenter/article/146623/windows_xp_sp3_includes_vulnerable_flash_player.html http://www.pcworld.com/businesscenter/article/146623/windows... Googling around you can also find announcements that Flash 5 will ship with Windows XP.
  - wyday 17y ago
    That was a downloadable service pack, and it was an optional component. At any rate, I'm using Windows 7 right now. I assure you I'm not lying.
    - pvg 17y ago
      http://www.adobe.com/macromedia/proom/pr/2001/fp5_msxp.html http://www.adobe.com/macromedia/proom/pr/2001/fp5_msxp.html Windows has shipped with Flash. I didn't say you're lying, I said 'Windows has never shipped with Flash' is inaccurate.
      - wyday 17y ago
        Oh, you're right. It looks like Windows XP was the first and last version of Windows to include Flash.
- blasdel 17y ago
  But nearly every OEM ships Flash in their Windows install, though usually only the ActiveX version for IE.

jpcx01 17y ago

Ugghh... i wish flash would just go the fuck away.

raquo 17y ago

Are there actually any not vulnerable Flash players? Or at least not yet vulnerable?

joubert 17y ago

Mine isn't outdated as the article says.

rimantas 17y ago

The best upgrade for my Flash experience on Mac: http://rentzsch.github.com/clicktoflash/ http://rentzsch.github.com/clicktoflash/