Techsurvivors

Welcome to Techsurvivors => Tech => Topic started by: Paddy on June 07, 2010, 10:55:17 AM

Title: Critical vulnerability in Flash and Acrobat Reader *updated June 8*
Post by: Paddy on June 07, 2010, 10:55:17 AM
http://www.hardmac.com/news/2010/06/07/cri...ash-and-acrobat

http://www.adobe.com/support/security/advi.../apsa10-01.html

What is unclear, is whether or not the Mac version is actually vulnerable, since Adobe cites the .dll file in particular. The .dll file referenced in the Adobe article doesn't seem to exist on the Mac, though I found one by that name in my Applications->Adobe Contribute CS4->Configuration->flash player folder. What it's doing there, I don't know. Macs don't use .dll files so I'm not sure what it's doing there, if anything. There are a few others on my system, but they're all in cross-platform apps or things that are directly related to Windows in some way or other.
Title: Critical vulnerability in Flash and Acrobat Reader *updated June 8*
Post by: kimmer on June 07, 2010, 08:48:39 PM
Okay, I'm confused here.

Reader, I went to a back up and reinstalled Reader 8 (which I had just dumped!). So that's okay.

But the flash thing ... Adobe says "The Flash Player 10.1 Release Candidate does not appear to be vulnerable." As a "release candidate, it's beta, is it not? Is is stable? I don't want to install it and have worse problems.
Title: Critical vulnerability in Flash and Acrobat Reader *updated June 8*
Post by: Paddy on June 07, 2010, 09:11:30 PM
Release candidates are typically one step beyond beta - pretty close to actually being released, and rarely contain any major bugs.

http://en.wikipedia.org/wiki/Software_release_life_cycle
Title: Critical vulnerability in Flash and Acrobat Reader *updated June 8*
Post by: kimmer on June 07, 2010, 09:18:20 PM
Thanks, Paddy. I'll go ahead and install it.
Title: Critical vulnerability in Flash and Acrobat Reader *updated June 8*
Post by: krissel on June 08, 2010, 02:15:25 AM
Apparently only Reader and Acrobat 9 are the vulnerable ones for Macs. I have Acrobat 5 and Reader 7 which don't have the SWF related files.

More info here on how to track down the files and secure Acrobat and Reader.

http://antivirus.about.com/od/securitytips...finpdfonmac.htm

http://antivirus.about.com/b/2010/06/07/ye...day-exploit.htm
Title: Critical vulnerability in Flash and Acrobat Reader *updated June 8*
Post by: Jack W on June 08, 2010, 08:46:52 AM
Went to your first link Paddy.

Took the advice offered therein and deleted that little sucker.

 thanx.gif  , Jack
Title: Critical vulnerability in Flash and Acrobat Reader *updated June 8*
Post by: jchuzi on June 08, 2010, 10:05:04 AM
QUOTE(Jack W @ Jun 8 2010, 09:46 AM) <{POST_SNAPBACK}>
Went to your first link Paddy.

Took the advice offered therein and deleted that little sucker.

 thanx.gif  , Jack
I did it too. The article estimates that it takes 15 minutes but it's closer to one.
Title: Critical vulnerability in Flash and Acrobat Reader *updated June 8*
Post by: chriskleeman on June 08, 2010, 10:30:04 AM
QUOTE(jchuzi @ Jun 8 2010, 11:05 AM) <{POST_SNAPBACK}>
I did it too. The article estimates that it takes 15 minutes but it's closer to one.


Yup, pretty simple to find/navigate to... gone in 60 seconds! (or less...) coolio.gif

Thanks Paddy!

Chris K smile.gif
Title: Critical vulnerability in Flash and Acrobat Reader *updated June 8*
Post by: Xairbusdriver on June 08, 2010, 11:11:24 AM
REalized I still had some Reader Prefs laying around...searched and deleted everything that had "Acrobat" and "Reader" in them. rolleyes.gif
Title: Critical vulnerability in Flash and Acrobat Reader *updated June 8*
Post by: Paddy on June 08, 2010, 01:00:18 PM
Adobe has updated their advisory to include temporary fixes for the issues:

http://www.adobe.com/support/security/advi.../apsa10-01.html

I've removed the AuthPlayLib bundle file from both Acrobat Pro and Reader (use both - and require Acrobat Pro in my work) - though I cannot recall ever downloading or encountering a PDF with embedded Flash!

Will now update the Flash Player, though have Click to Flash and never click on ads or any untrusted sources. There will be a patch for Flash out on Thursday (10th) but the fixes for Acrobat and Reader won't be out until the end of June.
Title: Critical vulnerability in Flash and Acrobat Reader *updated June 8*
Post by: pendragon on June 09, 2010, 05:32:20 AM
Good info all, Paddy, thanks!

While I don't think I visit bad sites, even good sites can get infected. This nefarious stuff moves around the Internet in a flash. toothgrin.gif

Title: Critical vulnerability in Flash and Acrobat Reader *updated June 8*
Post by: jchuzi on June 10, 2010, 04:22:33 PM
The Adobe Flash Player update is now available. A word to the wise:  Repair permissions after installing it. The AFP installer messes up a permission (and this has happened consistently, as well as with this particular update).