Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New Adobe Flash 0day, have a nice weekend

adobe.com

Post reply on HN
Print view View original

61–70 of 74 posts

Re: New Adobe Flash 0day, have a nice weekend

#61

Post by Niten »

JoachimSchipper wrote: post #34
rmorrison wrote: post #6

Adobe has desensitized me to updating their software, since every time I open Acrobat it asks me to download a new version. It's like the boy who cried wolf, but since this sounds serious maybe I'll get over this mental hurdle.

Actually, every time you open Acrobat it's had a new security issue. At least, it's that way for me (though Windows is not my primary OS, so I don't open Acrobat that often).

Even if Windows is your primary OS, there's no reason for the typical user to have to run Adobe Reader on a regular basis. Just use a nice lightweight viewer like PDF-XChange, Sumatra, or Foxit instead.

Windows is my primary OS, and I don't even have Adobe Reader installed.

Re: New Adobe Flash 0day, have a nice weekend

#62

Post by mish »

sans-serif wrote: post #52
DrewHintz wrote: post #27

Earlier quoted context omitted.

Apple's 'Preview' PDF viewer has lots of security vulnerabilities. Simple fuzzing will quickly find plenty of 0day.

That's a bold claim waiting to be backed up.

I think the poster was referring to Charlie Miller's CSW 2010 presentation, where he finds a number of trivial, exploitable vulnerabilities in Preview. You can see the slide deck here: http://securityevaluators.com/files/slides/cmiller_CSW_2010....

Re: New Adobe Flash 0day, have a nice weekend

#63

Post by icefox »

ihodes wrote: post #2

Shouldn't a fix come out with that announcement? If they're offering a temporary fix, shouldn't they at least push that temp fix as an update, and fully update the issue later? This leaves the non-technically inclined out in the cold, and informs those who may not know of the exploit of its existence. Just something as simple as removing authplay.dll for Acrobat and Reader, and even upgrading the current version of F…

flash block?

Re: New Adobe Flash 0day, have a nice weekend

#64

Post by endtime »

gojomo wrote: post #29

They suggest addressing the Flash vulnerability by installing the prerelease 10.1 version, which "does not appear to be vulnerable". But the first step of installing 10.1 (on Windows and MacOS) is to run an uninstaller, also available on the download page: http://labs.adobe.com/downloads/flashplayer10.html Perhaps the prudent should stop after that uninstall step, for safety from other future exploits, as well.

Are you sure about the uninstallation part? I was able to install 10.1 without uninstalling anything. Took about 10 seconds. And http://www.adobe.com/software/flash/about/ tells me "You have version 10,1,53,64 installed".

Re: New Adobe Flash 0day, have a nice weekend

#65

Post by nitrogen »

Niten wrote: post #61
JoachimSchipper wrote: post #34

Earlier quoted context omitted.

Actually, every time you open Acrobat it's had a new security issue. At least, it's that way for me (though Windows is not my primary OS, so I don't open Acrobat that often).

Even if Windows is your primary OS, there's no reason for the typical user to have to run Adobe Reader on a regular basis. Just use a nice lightweight viewer like PDF-XChange, Sumatra, or Foxit instead. Windows is my primary OS, and I don't even have Adobe Reader installed.

I've found Sumatra to render extremely slowly when zoomed in past 100%, particularly on PDFs with high-res images and/or vector images. Are the other non-Adobe readers better at this?

Re: New Adobe Flash 0day, have a nice weekend

#66

Post by gojomo »

endtime wrote: post #64
gojomo wrote: post #29

They suggest addressing the Flash vulnerability by installing the prerelease 10.1 version, which "does not appear to be vulnerable". But the first step of installing 10.1 (on Windows and MacOS) is to run an uninstaller, also available on the download page: http://labs.adobe.com/downloads/flashplayer10.html Perhaps the prudent should stop after that uninstall step, for safety from other future exploits, as well.

Are you sure about the uninstallation part? I was able to install 10.1 without uninstalling anything. Took about 10 seconds. And http://www.adobe.com/software/flash/about/ tells me "You have version 10,1,53,64 installed".

The preview version's Release Notes say to run the uninstaller first, but perhaps it's not necessary.

Re: New Adobe Flash 0day, have a nice weekend

#67

Post by natch »

tptacek wrote: post #50
natch wrote: post #25

Perfect headline. It straddles the ambiguity between the two possible meanings: the sarcastic one, about IT personnel scrambling to put fixes in place over their 'nice' weekend, and the non-sarcastic one, addressed to hackers who could have some fun with this. In any case, Adobe, the timing has exactly the level of thoughtfulness we have come to expect from the Flash team. The only way you could have done more damage…

It is unlikely that anybody at Adobe controlled the timing of this release.

Sucks for them. They should get their code base under control. Or their web site, if that's what you meant.

Re: New Adobe Flash 0day, have a nice weekend

#68

Post by tomlin »

ihodes wrote: post #2

Shouldn't a fix come out with that announcement? If they're offering a temporary fix, shouldn't they at least push that temp fix as an update, and fully update the issue later? This leaves the non-technically inclined out in the cold, and informs those who may not know of the exploit of its existence. Just something as simple as removing authplay.dll for Acrobat and Reader, and even upgrading the current version of F…

It would be nice to know we're not just beating up on them because it's trendy and perhaps hold them accountable on the same level as other software companies.

It's possible that they were in the right by announcing an issue, rather than ignoring it.

Re: New Adobe Flash 0day, have a nice weekend

#69

Post by elblanco »

ptomato wrote: post #57
elblanco wrote: post #48

Earlier quoted context omitted.

Lots of software has security problems. It's pretty rare that any of them show up on the front page of HN. They just tend to blend into background noise as "not interesting" unless it's particularly interesting to the community for some reason. Given that one of Job's major points for not allowing Flash on iDevices was the security of the platform, the only conclusion one can draw for having a security notice show up…

"Yet the fact that that link is providing uncomfortable information contrary to that provided by Jobs has caused it to be annihilated by downvotes" No, I think it was mostly the irrelevancy that got you downvoted. "you successfully made the connection between Adobe and Apple." Umm, what you posted was a link to something about Apple, so yeah, I think I could be justified in believing that was the connection you were…

I was going to post a protracted point for point response, but decided I wasn't in the mood for yet another lengthy internet battle with an obvious zealot which will probably end up in a Godwin law violation or a comparison of digital phalli or some such.

You've made some good points, some bad, I disagree with most, agree with others (and learned a few things from your response, thanks for the corrections). You've successfully demonstrated using a search engine for finding archived posts without demonstrating that those posts reached the front page. Well done.

It's obvious that Adobe is a sorry pitiful place that produces slipshod software that blights the Internet and our computers with its presence -- from the 150 slider widgets in Photoshop to Flash. This has been true for a decade or more. You'll get no argument from me.

However, Apple also has a lot to answer for. Just because its principle computing platform isn't terribly popular, so it's less likely to be a target, doesn't make it more secure ("we're secure because nobody uses us!" is not a terribly good selling point). The sec community has long standing grievances with the slow pace of security patches Apple puts out. Jobs has likewise generally remained silent on this matter.

You may continue feeling slighted by even the slightest of finger-pointing at Apple even if it's not intended as Apple bashing. A strong and vibrant Apple, as a viable competitor, is good for several industries. Hanging off of every word Steve Jobs says as perfect and without flaw is not.

Enjoy the rest of the weekend.

Re: New Adobe Flash 0day, have a nice weekend

#70

Post by ptomato »

elblanco wrote: post #69
ptomato wrote: post #57

Earlier quoted context omitted.

"Yet the fact that that link is providing uncomfortable information contrary to that provided by Jobs has caused it to be annihilated by downvotes" No, I think it was mostly the irrelevancy that got you downvoted. "you successfully made the connection between Adobe and Apple." Umm, what you posted was a link to something about Apple, so yeah, I think I could be justified in believing that was the connection you were…

I was going to post a protracted point for point response, but decided I wasn't in the mood for yet another lengthy internet battle with an obvious zealot which will probably end up in a Godwin law violation or a comparison of digital phalli or some such. You've made some good points, some bad, I disagree with most, agree with others (and learned a few things from your response, thanks for the corrections). You've su…

"...lengthy internet battle with an obvious zealot which will probably end up in a Godwin law violation or a comparison of digital phalli or some such."

There should probably be some law about those who attempt to preemptively invoke Godwin's law.

"You've successfully demonstrated using a search engine for finding archived posts without demonstrating that those posts reached the front page."

Up until fairly recently in the history of HN, at least, pretty much any post with point count > 10 has been on the front page. Looking at the front page currently there's a couple at 3 or 6. I think most of the examples I linked were 20+ which means they were almost certainly on the front page for a while.

"Apple also has a lot to answer for."

You're the one who keeps trying to make this be about Apple. It's not, it's about a Flash exploit. Trying to force the relationship says far more then you then anything else.

"You may continue feeling slighted by even the slightest of finger-pointing at Apple even if it's not intended as Apple bashing."

I'm not slighted, I'm just pointing out that you're not really communicating in a relevant manner to the thread.

"Hanging off of every word Steve Jobs says as perfect and without flaw is not."

I agree with some things Apple does and not others. (No Flash on iPad/iPhone: agree, Adobe has yet to demonstrate the capability for Flash to run in a good manner on mobile devices, and if either of those were waiting for that neither would have been released yet. 3.3.1: sticks in my craw, even though I have a sneaking suspicion it may be best for the platform certainly not best for developers. App Store as only distribution channel: Again, good for the platform and endusers, not for developers, sideloading should be allowed.) Certainly the HN community as a whole, I'd say, has a few more vocal critics of Apple of late than vocal supporters.

Post reply on HN