[solved] 0-day Flash Player vulnerability - ALL PLATFORMS

sultanoswing · 2010-10-29 21:52:24

Couldn't post this on the security announcements obviously, so here goes:

There is a critical 0-day exploit in Adobe Flash, meaning PDF's are potential vectors since they can allow embedded flash files.

Adobe planning a patch in 2 WEEKS at this time (unless prompted or necessitated to do so sooner).

http://www.zdnet.com/blog/security/adob … o-day/7598

Recommended action at this time is to uninstall flashplayer until the vuln. is patched.

http://www.adobe.com/support/security/a … 10-05.html

Last edited by sultanoswing (2010-12-18 00:46:04)

ewaller · 2010-10-29 21:59:28

Unless I am missing something, the attack vector is against Reader / Acrobat and the patch is to spike the autoplay capability in Reader / Acrobat.

hokasch · 2010-10-29 22:20:59

Flash autoplay inside pdf's?! madness

graysky · 2010-10-29 22:21:44

Thanks for posting. Use the pre-release package from the AUR. As I read it, that is not affected.

http://aur.archlinux.org/packages.php?ID=32072

Affected software versions
* Adobe Flash Player 10.1.85.3 and earlier versions for Windows, Macintosh, Linux and Solaris operating systems

hokasch · 2010-10-29 22:22:45

better yet, don't install adobe reader/acrobat

adobe bulletin wrote:

Adobe is not currently aware of attacks targeting Adobe Flash Player.

Last edited by hokasch (2010-10-29 22:23:57)

sultanoswing · 2010-10-30 04:35:01

graysky wrote:

Thanks for posting. Use the pre-release package from the AUR. As I read it, that is not affected.
http://aur.archlinux.org/packages.php?ID=32072
Affected software versions
* Adobe Flash Player 10.1.85.3 and earlier versions for Windows, Macintosh, Linux and Solaris operating systems

You'd probably be reading it wrong, since Adobe was only aware of the exploit a day or two ago - well after even that pre-release build. Hence they would have had no reason to include any as-yet-to-be-coded patch.

Last edited by sultanoswing (2010-10-30 04:36:06)

sultanoswing · 2010-10-30 04:40:17

hokasch wrote:

better yet, don't install adobe reader/acrobat
adobe bulletin wrote:
Adobe is not currently aware of attacks targeting Adobe Flash Player.

But others are. This is Adobe covering to prevent mass panic. The 'vuln. exists in Flash primarily. Believe me, with a patch 2 weeks away and the ubiquity of Flash, you better believe it's going to get hit by the end of this weekend. Do you feel lucky?

Anonymo · 2010-10-30 05:31:09

I use Okular + Okularplugin-git anyways

litemotiv · 2010-10-31 12:28:23

Not an Arch Discussion, moving to Workstation User.

R00KIE · 2010-10-31 23:12:43

From the announcement it would seem that authplay.dll is needed for the exploit and that is shipped with reader not flash ... but who knows.

I'd guess that any new security problem affects all flash versions ... it seems to be a bottomless pit of security holes

aardwolf · 2010-11-01 19:20:36

I hope the chances that someone would make a Flash file that exploits this on LINUX are pretty slim.

sultanoswing · 2010-11-03 06:54:11

litemotiv wrote:

Not an Arch Discussion, moving to Workstation User.

And not to Security Announcements?

litemotiv · 2010-11-03 22:00:19

sultanoswing wrote:

And not to Security Announcements?

That is up to the maintainers to decide, if they feel the matter is urgent enough they will pull the package (like they did before).

sultanoswing · 2010-11-04 07:09:23

update:

Fix for Flashplayer hopefully arriving tomorrow... but how long it takes to get into Arch, or the AUR flashplugin-prerelease package is another matter.

The PDF 'sploit via Adobe Reader still won't be patched until 9th November.

moljac024 · 2010-11-04 11:25:30

So don't use Adobe reader?

sultanoswing · 2010-11-05 00:16:40

moljac024 wrote:

So don't use Adobe reader?

At least not until the patch has been implemented. There are plenty of other non-vulnerable, opensource pdf readers out there.

sultanoswing · 2010-11-05 08:07:20

A patch has been released by Adobe, but not yet for 64-bit versions. Sigh.

http://www.adobe.com/support/security/b … 10-26.html

sultanoswing · 2010-12-18 00:45:40

Patched versions for 64-bit "Square" Prelease 3 now available from Adobe Labs: http://labs.adobe.com/downloads/flashpl … quare.html

Confirmed as patching APSB10-26: http://forums.adobe.com/thread/744888?tstart=0

skunktrader · 2010-12-18 01:43:49

sultanoswing wrote:

Patched versions for 64-bit "Square" Prelease 3 now available from Adobe Labs: http://labs.adobe.com/downloads/flashpl … quare.html
Confirmed as patching APSB10-26: http://forums.adobe.com/thread/744888?tstart=0

Its been in the AUR for more than 2 weeks

Arch Linux

#1 2010-10-29 21:52:24

[solved] 0-day Flash Player vulnerability - ALL PLATFORMS

#2 2010-10-29 21:59:28

Re: [solved] 0-day Flash Player vulnerability - ALL PLATFORMS

#3 2010-10-29 22:20:59

Re: [solved] 0-day Flash Player vulnerability - ALL PLATFORMS

#4 2010-10-29 22:21:44

Re: [solved] 0-day Flash Player vulnerability - ALL PLATFORMS

#5 2010-10-29 22:22:45

Re: [solved] 0-day Flash Player vulnerability - ALL PLATFORMS

#6 2010-10-30 04:35:01

Re: [solved] 0-day Flash Player vulnerability - ALL PLATFORMS

#7 2010-10-30 04:40:17

Re: [solved] 0-day Flash Player vulnerability - ALL PLATFORMS

#8 2010-10-30 05:31:09

Re: [solved] 0-day Flash Player vulnerability - ALL PLATFORMS

#9 2010-10-31 12:28:23

Re: [solved] 0-day Flash Player vulnerability - ALL PLATFORMS

#10 2010-10-31 23:12:43

Re: [solved] 0-day Flash Player vulnerability - ALL PLATFORMS

#11 2010-11-01 19:20:36

Re: [solved] 0-day Flash Player vulnerability - ALL PLATFORMS

#12 2010-11-03 06:54:11

Re: [solved] 0-day Flash Player vulnerability - ALL PLATFORMS

#13 2010-11-03 22:00:19

Re: [solved] 0-day Flash Player vulnerability - ALL PLATFORMS

#14 2010-11-04 07:09:23

Re: [solved] 0-day Flash Player vulnerability - ALL PLATFORMS

#15 2010-11-04 11:25:30

Re: [solved] 0-day Flash Player vulnerability - ALL PLATFORMS

#16 2010-11-05 00:16:40

Re: [solved] 0-day Flash Player vulnerability - ALL PLATFORMS

#17 2010-11-05 08:07:20

Re: [solved] 0-day Flash Player vulnerability - ALL PLATFORMS

#18 2010-12-18 00:45:40

Re: [solved] 0-day Flash Player vulnerability - ALL PLATFORMS

#19 2010-12-18 01:43:49

Re: [solved] 0-day Flash Player vulnerability - ALL PLATFORMS

Board footer