Flash Security Hole

otterpop378 wrote to us about a From report on CNN about a new security hole in Flash. Evidently, it's pretty big, as Macromedia wants everyone to update - sounds like the sandbox isn't quite working as it should.

If you use gentoo...

[JimDabell]

This is already fixed in gentoo:

emerge sync; emerge -u netscape-flash

Re:If you use gentoo...

[Wolfrider]

--Using Opera 6.1, www.macromedia.com shows a blank page. :(

Nice irony...

[$rtbl_this]

...accompanying a story about a serious security hole in Flash with a Flash-based popup advert.

conspiracy theorist

[Anonymous Coward]

The conspiracy theorist in me can't help but think this security update -- which doesn't specify anything other than a buffer overflow -- is an attempt to get people to upgrade to the latest version of Flash, which I believe is now required to properly interact with the new Macromedia.com.

Re:conspiracy theorist

[Khalidz0r]

Heh, a big company wouldn't give up their reputation in security to simply get you to update, there are better ways to do that.

The worst thing a company would think of doing is announcing that their software is not secure, for whatever reason.

Khalid

Re:conspiracy theorist

[MarkGriz]

Funny thing though... there is no mention of this huge security hole on their web page. If they were so interested in security,
you'd think they would at least announce a "New version of Flash available - now with improved security. Click here to download"

Re:conspiracy theorist

[Dudio]

I didn't see anything posted to the lists (Bugtraq, Vulnwatch, Full Disclosure, etc.) about this either, until the Gentoo announcement [netsys.com] yesterday. For an issue Macromedia calls critical [macromedia.com], they sure are being quiet about it.

Any easy way to temporaily disable flash in IE?

[Palos]

This is kind of offtopic, but with a lot of sites using flash for ads that adblockers don't seem to block well, is there a way to disable it temporaily easily? I've seen some sites that show how to get rid of it, but that just brings up a popup anytime you go to a site with it. I swear 95% of the flash out there now is crap, but the other 5% is cool games I want to play :)

Re:Any easy way to temporaily disable flash in IE?

[oyenstikker]

www.homestarrunner.com completely justfies flash on its own.

Re:Any easy way to temporaily disable flash in IE?

[waylander]

Google turned up this link on Macromedia's site: http://www.macromedia.com/support/flash/ts/documen ts/remove_player.htm [macromedia.com]

Macromedia Site tells nothing

[Anonymous Coward]

I visited the site only to find nothing about the security hole. Crisis by denial? Download section also had nothing to tell you there was a security hole. Just one big nothing.

Re:Macromedia Site tells nothing

[zero_offset]

Actually I gave up searching and just guessed the URL, and it worked: http://www.macromedia.com/security [macromedia.com]

More info

[Gogo Dodo]

For those looking for details on the vulnerability, see MPSB03-03 Security Patch for Macromedia Flash Player [macromedia.com].

The short answer is that you need to upgrade to Player 6,0,79,0 [macromedia.com] (why the heck Macromedia uses commas instead of periods is beyond me).

Macromedia Flash Player RPMS

[Laven]

http://macromedia.mplug.org [mplug.org]

Hi, I am the maintainer of the Macromedia Flash Player RPMS for Linux. The RPM packages have been updated a few days ago, available in apt and urpmi repositories for various Linux distributions.

The site has instructions for Gentoo and Debian Linux installation too.