Flash Player new version (new Zero-day discovered)

[Tookeri]

New Zero-day used by the Angler Exploit Kit: https://blog.malwarebytes.org/exploits-2/2015/01/new-adobe-flash-zero-day-found-in-the-wild/

Flash Player 16.0.0.287 available for download but no release notes yet.

Check your Flash Player version and download from: www.adobe.com/software/flash/about/
(for every browser that has Flash Player installed, except Chrome which has built in updater)

 

[Anak]

Is it my imagination or is Flash starting to resemble Java in the frequency of updates from vulnerabilities?

Link with security bulletin and release note links: https://1/22/2015 - Release - Flash Player 16 | forums.adobe.com

Neither the Forum link nor the security bulletin or the release note say anything about the amount of fixes they just say security fix. I didn't check this too closely, it may be in here: Flash Patch Targets Zero-Day Exploit

A week ago Java plugged 19: Java Patch Plugs 19 Security Holes


EDIT:
I'm glad I went back to check, check the security bulletin in the quote, .287 is just a partial patch :

Update 11:05 p.m. ET: Adobe just issued a bulletin confirming that this latest patch does not protect Flash users against all current, active attacks. The company says it plans to release an update the week of Jan. 26 to address this other security issue.

Source, bottom of: Flash Patch Targets Zero-Day Exploit

Yep, yep. Lookin' more like Java.....

 

[bej]

Surely, in the top 5 worst software programs ever written. I do a lot of YouTube using HTML5. If a video "requires" Flash, I'll just skip it. Uninstalled the "update king" months ago and will never install it again.

 

[Callender]

Flash Player current vulnerability

Anyone know if this exploit can be prevented by only allowing flash to run per element rather than the whole page?

 

[Borg 386]

Is it my imagination or is Flash starting to resemble Java in the frequency of updates from vulnerabilities?

Pretty much. They have a update just about every patch Tue now.

 

[andrew129260]

I dumped java, flash and adobe reader a long time ago. Never looked back.

Technically I still have flash, but in chrome(ish). With it's more sandboxed approach though, it is better than firefox and IE.

 

[Layback Bear]

I have Flash but keep it set to ask before using. That stops a lot of automatic Flash from opening when I go to a page. Only the one I want to see will open with my permission.
Flash get attack a lot because 3.6759 gazillion people use it. The crooks get more bang for their buck.

 

[Callender]

Adobe Flash 0-day exploit

Anyone know if this exploit can be prevented by only allowing flash to run per element rather than the whole page?

Okay so there's more info here:

New â

After some research I found and visited a site that drops this exploit and saw nothing to worry about but also saw a "suspect web bug removed" message from some software that I use.

Anak seems to have answered the question on allowing flash to run per element!

Source: Flash Patch Targets Zero-Day Exploit

 

[Phone Man]

Adobe has fixed the exploit in 16.0.0.287 and new version will be available soon.

UPDATE (January 24): users who have enabled auto-update for the Flash Player desktop runtime will be receiving version 16.0.0.296 beginning on January 24. This version includes a fix for CVE-2015-0311. Adobe expects to have an update available for manual download during the week of January 26, and we are working with our distribution partners to make the update available in Google Chrome and Internet Explorer 10 and 11.

Jim

 

[Tookeri]

Thanks for the updates people. A summary in case anyone's confused :

- The new Flash version already published was not a fix for this zero-day, but for another vulnerability.
- An additional fix and new version will be published next week.

Yep, yep. Lookin' more like Java.....

Indeed

 

[ThrashZone]

Actually Oracle only updates quarterly which is the worst possible thing to have installed,
If Adobe only does updates monthly it kicks Oracle's butt,
Then again both suck

 

[Tookeri]

I got an auto update today for ALL my Flash Players which was the first time that happened And note that you cannot even download the latest version manually yet.

Previously the auto-update has only worked for the Flash Player for my default browser, but I tried changing Flash Player Updates setting in Control Panel from recommended(auto) to Notify, and then switched it back again to auto. Amazing how just touching a setting can fix things!

PS. The Notify doesn't even work!

 

[Callender]

Flash Player download

That's odd! I did a clean install (of flash player) earlier today and downloaded the latest version without any issues.

Adobe Flash Player Distribution | Adobe

My preference is to set updates to "never notify" and do a clean install every time an update becomes available.

 

[Tookeri]

That's odd! I did a clean install (of flash player) earlier today and downloaded the latest version without any issues.

Ok, well I just checked the Flash about page where 296 isn't available. Not even if you click "Player Download Center". Why is Adobe doing it like this?!


About Never Notify, I used to have it that way but I learned it's easy to miss a critical update between patch Tuesdays.

 

[Callender]

Flash Player update checks

I don't know! It's funny that if I check for updates the latest version is reported as 16.0.0.287 but that's not right.

 

[Tookeri]

It was explained in a previous post that only the auto-updater will receive 296 ATM. Next week it will be public.

One more reason to have auto-update on

 

[Layback Bear]

When you download Adobe in the process you will get a screen you can choose how you want your updates. Auto is already selected. I change that to notify me of new updates. That way I can choose if or when I get the update.

 

[Tookeri]

As most Flash updates are security related I want the updates as soon as possible. And note that this latest update that fixes a zero-day exploit were only distributed to those with auto-update on. Others won't see it until next week.

If there's anything you should have on auto-update it's Flash. Just my opinion

 

[DavidE]

I don't use auto update for flash.
For me that's slower and less reliable than subscribing to http://www.sevenforums.com/browsers-mail/311-latest-version-adobe-flash-player.html and doing the update myself.

I updated to the latest version from here earlier today
Adobe Flash Player Distribution | Adobe

 

[Tookeri]

I use both methods. In case the auto-updater hasn't updated when I learn about a new version, I update manually. But for me to install it manually I have to temporarily change a few security settings since it uses temp files in temp folders which I'm not allowing either to execute or downloading stuff.
The auto-update however works perfectly, so I prefer that.

I've tweaked my mms.cfg settings which I think improves the auto update interval:
AutoUpdateDisable=0
SilentAutoUpdateEnable=1
AutoUpdateInterval=1

<0 (or absent) uses value from player settings.
0 checks for updates every time the player launches.
>0 specifies the minimum number of days between check for updates.

IT Administration | Configure auto-update notification | Flash Player