Java and Flash both vulnerable—again—to new 0-day attacks

[Chiefcrowe]

http://arstechnica.com/security/201...ace-from-hacking-team-combine-with-java-0-day

 

[balloonshark]

So another flash patch in coming later this week. I'm glad I waited.

 

[Elixer]

Flash should be disabled by default.

 

[TheRyuu]

Flash should be disabled by default.

Also remember that you shouldn't use "click to play" in Chrome. You should set plugins to "disabled by default" or whatever the wording is. This still allows you to use them but you have to right click them and hit run (or use the icon in the omnibar). This actually acts as a security barrier since click to play can be bypassed and flash stuff can still run.

 

[Spacehead]

So another flash patch in coming later this week. I'm glad I waited.

Would still be a good idea to update as the last patch was for a zero day. This new one is for the Hacking Team hack that exposed another zero day.

 

[MustISO]

One of these days everyone will wake up and stop using/requiring flash on their sites. Sure the next method of displaying cat videos will be exploited when flash goes away but it's time for it to die or rewrite it from the ground up.

 

[Spacehead]

I see now that Firefox won't let Flash run without specifically allowing it on a site.
Good for them.

 

[John Connor]

Flash should be disabled by default.

I set mine to ask for activation since the Hacking Team BS. Too bad Hulu and other sites can't go HTML5 already. Most people use Chrome or Firefox so there's no reason not to.

 

[Auric]

I use ESR and Axe to Activate but maintaining it is still a chore. With two releases in ten days already there's yet another vulnerability? D:

 

[Murloc]

I always browse the same websites anyway, only few of which use flash, so I guess it won't be a problem for me.

 

[Ketchup]

New version this morning, possible fix:
http://forums.anandtech.com/showthread.php?t=2439274
http://news.softpedia.com/news/adob...a-blocks-all-versions-in-firefox-486813.shtml

After updating I still see the warning in the Plugin Status page of FF.

 

[PliotronX]

Facebook's new chief security officer wants to set a date to kill Flash

 

[mikeymikec]

I already had version 18...203 on my PC, apparently it was updated on the 9th of July. FF still is warning me about it though.

 

[mikeymikec]

Facebook's new chief security officer wants to set a date to kill Flash

Surely it's easier for FB to simply ban Flash and help fuel a boycott?

 

[Spacehead]

After updating I still see the warning in the Plugin Status page of FF.

No more warning here. Did you restart your browser?
After updating to the latest version it said to restart which is not normally needed.

 

[Spacehead]

I already had version 18...203 on my PC, apparently it was updated on the 9th of July. FF still is warning me about it though.

18.0.0.209 is the latest for FF & IE.

What you have installed & latest versions page
https://www.adobe.com/software/flash/about/

 

[bruceb]

Flash updated this morning to: 18.0.0.209 ... Shockwave is now at: 12.1.9.159 .... Java is still showing 8 Update 45 on their site

 

[Ketchup]

No more warning here. Did you restart your browser?
After updating to the latest version it said to restart which is not normally needed.

I am not sure why it did that on the desktop this morning. No warnings after the update on my laptop. Will look at it later this evening.

 

[mikeymikec]

Ah, my bad; I thought I had read the version number as 203 as well as mine. Updated, no more warnings.

 

[PliotronX]

So Mozilla is taking it upon themselves to timebomb Flash just as Java does itself? I wonder how long it will be before they tire of adjusting the acceptable builds and just block it out completely. Afterall, infections always reflect poorly on the browser and OS but never browsing habits nor paid-for AV :whiste:

 

[Elixer]

I always browse the same websites anyway, only few of which use flash, so I guess it won't be a problem for me.

Not true!
They can infect you still, like for example if the advertiser gets hijacked which happen more often than you think...

So, ANY flash based item can screw you big time.

 

[Chiefcrowe]

https://threatpost.com/mozilla-disables-flash-in-firefox/113763

 

[bruceb]

It can be bypassed in About:Config

This article describes the preference
http://kb.mozillazine.org/Extensions.blocklist.enabled

About:Config: extensions.blocklist.enabled
Set it to False and it will not check the blocklist

 

[John Connor]

After updating I still see the warning in the Plugin Status page of FF.

That happened to VLC as well and I think it's fixed. Mozilla was blaming VLC and VLC was blaming Mozilla. Also, the plugin check page showed recently that flash was updated, but it wasn't. I wouldn't depend on the plugin check page and the Dev for my main browser Pale Moon took that link out of the plugins page.

 

[Ketchup]

That happened to VLC as well and I think it's fixed. Mozilla was blaming VLC and VLC was blaming Mozilla. Also, the plugin check page showed recently that flash was updated, but it wasn't. I wouldn't depend on the plugin check page and the Dev for my main browser Pale Moon took that link out of the plugins page.

Yes. Got back on the desktop this evening and all is (reporting) well.