Topic 'Re: Adobe Flash Player 11.4.402.287' in forum 'Security' - dslreports.com

Re: Adobe Flash Player 11.4.402.287

Sat, 13 Oct 2012 10:18:07 EDT

Libra posted : Thank you StuartMW. I was reading your thread about Patch Tuesday and this flash update was mentioned. I've just downloaded it.

Sincerely, Libra

Re: Adobe Flash Player 11.4.402.287

Tue, 09 Oct 2012 07:02:15 EDT

Mele20 posted : I downloaded both exe's from your link which is the one I always use.

I have a new Fx 10 ESR profile and downloaded on it. Windows promptly blocked both files from being installed. I didn't realize that Mozilla NEVER, since the introduction of the stupid thing in Fx 3.5, has fixed this bug! The files are blocked because on the new profile I did not have the proper user created filters in about:config that stop this stupidity. I am really surprised at Mozilla for never fixing this bug. I only used Fx 3 a little and did the fix mentioned in the bug on it. Then I made Opera default for two years and it doesn't do IE zones on its downloads or double scanning by your antivirus program like Fx still does at ver 10 unless you add the proper filters to stop the behavior. My other two profiles are from Fx 1.5, 2 and 3 and carried over to Fx 10 so they all have the added filters from several years ago.

»bugzilla.mozilla.org/show_bug.cgi?id=499448

So, I had that stupid problem. I got that fixed but then I have another problem with the files. Evidently, IE 8 is missing some Intermediate certs so I am getting a warning that the Versign cert cannot be validated due to Windows not having enough information. I don't know how to add the missing certs using Microsoft download site for the certificate store latest update because that requires WGA and on principle I don't allow WGA on my computers. So, I guess I have to just trust those files are ok. UGH.
--
When governments fear people, there is liberty. When the people fear the government, there is tyranny. Thomas Jefferson

Re: Adobe Flash Player 11.4.402.287

Mon, 08 Oct 2012 20:14:53 EDT

Dustyn posted :

said by Boricua65:

Fracking great :uhh:!! Now I'm going to have users beckoning me to install this sh*t because they don't have admin rights (sigh).

Yup.
Flash is a platform that is continually exploited as it's so aparently easy to exploit.
There will be no end to these security updates. You either go along with the ride in updating ceaselessly...(similar to Oracle Java) or abandon ship.
--
Remember that cool hidden "Graffiti Wall" here on BBR? After the name change I became the "owner", so to speak as it became: Dustyn's Wall »[Serious] RIP

Re: Adobe Flash Player 11.4.402.287

Mon, 08 Oct 2012 19:47:20 EDT

Pentangle posted : Installed. Thanks StuartMW .

Re: Adobe Flash Player 11.4.402.287

Mon, 08 Oct 2012 19:35:10 EDT

lordpuffer posted : Thanks Stuart. :)

Re: Adobe Flash Player 11.4.402.287

Mon, 08 Oct 2012 19:22:45 EDT

siljaline posted : Or until the next Patch Tuesday, whichever comes first.

Re: Adobe Flash Player 11.4.402.287

Mon, 08 Oct 2012 17:00:12 EDT

StuartMW posted :

said by Blackbird:

I wonder if anybody's vetting their new-version code for overflows...

You answered your own question :D

quote:
other than users-in-the-field, of course.

World's longest beta...
--
Don't feed trolls--it only makes them grow!

Re: Adobe Flash Player 11.4.402.287

Mon, 08 Oct 2012 16:58:21 EDT

Blackbird posted :

said by therube:

"...These updates resolve buffer overflow vulnerabilities that could lead to code execution
..."

»www.adobe.com/support/security/b···-22.html

So... 15 years into Flash releases, and buffer overflows are still being uncovered in released code? I wonder if anybody's vetting their new-version code for overflows... other than users-in-the-field, of course.
--
"Is life so dear, or peace so sweet, as to be purchased at the price of chains and slavery? Forbid it, Almighty God!" -- P.Henry, 1775

Re: Adobe Flash Player 11.4.402.287

Mon, 08 Oct 2012 16:48:16 EDT

StuartMW posted :

said by Name Game:

..if its not one group its the other.

Yup. I think they confuse "sandbox" with sand castle.

»footage.shutterstock.com/clip-13···ach.html
--
Don't feed trolls--it only makes them grow!

Re: Adobe Flash Player 11.4.402.287

Mon, 08 Oct 2012 16:43:58 EDT

StuartMW posted : Well I'm sure Sun will release a new version of Java any day now. We'll then be able to use it until a 0-day exploit is announced a few days later.
--
Don't feed trolls--it only makes them grow!

Re: Adobe Flash Player 11.4.402.287

Mon, 08 Oct 2012 16:41:17 EDT

Name Game posted : I was always skeptical of this bit of fluff since they stuffed the turkey with it

Ubiquitous deployment via the Java Runtime Environment (JRE)
The JavaFX Runtime is installed with the Java Runtime Environment, ensuring its availability on more than 97% of enterprise desktops worldwide (Forrester, November 2009: Enterprise Platform Trends, H1 2009)
»en.wikipedia.org/wiki/Java_virtual_machine

and now we have adobe wanting us also to jump again...if its not one group its the other.
--
Gladiator Security Forum
»www.gladiator-antivirus.com/

Re: Adobe Flash Player 11.4.402.287

Mon, 08 Oct 2012 16:40:26 EDT

Boricua65 posted : Fracking great :uhh:!! Now I'm going to have users beckoning me to install this sh*t because they don't have admin rights (sigh).
--
Illegal aliens have always been a problem in the United States. Ask any Indian. Robert Orben

Re: Adobe Flash Player 11.4.402.287

Mon, 08 Oct 2012 16:37:46 EDT

StuartMW posted : True. This release actually seems to have fixed something--for a few weeks anyway.
--
Don't feed trolls--it only makes them grow!

Re: Adobe Flash Player 11.4.402.287

Mon, 08 Oct 2012 16:34:24 EDT

siljaline posted : Probably not a bad thing having a dupe of a bulletin in the same thread as Adobe seems to have been lacking these of late.

Re: Adobe Flash Player 11.4.402.287

Mon, 08 Oct 2012 16:30:33 EDT

StuartMW posted : Posted above :)

»Re: Adobe Flash Player 11.4.402.287
--
Don't feed trolls--it only makes them grow!

Re: Adobe Flash Player 11.4.402.287

Mon, 08 Oct 2012 16:29:17 EDT

siljaline posted : Security updates available for Adobe Flash Player
APSB12-22

Re: Adobe Flash Player 11.4.402.287

Mon, 08 Oct 2012 14:56:34 EDT

StuartMW posted :

said by Dustyn:

That was quick! :o

Maybe they're trying to "bake in" the latest flash before the Oct 26th Win8 release date.
--
Don't feed trolls--it only makes them grow!

Re: Adobe Flash Player 11.4.402.287

Mon, 08 Oct 2012 14:50:26 EDT

Buddel posted : Got it. Thank you.

Re: Adobe Flash Player 11.4.402.287

Mon, 08 Oct 2012 14:50:09 EDT

Dustyn posted :

said by StuartMW:

FYI Microsoft has released a patch for IE10 on Win8.

»www.microsoft.com/en-us/download···id=34812

»www.microsoft.com/en-us/download···id=34813

»www.microsoft.com/en-us/download···id=34816

That was quick! :o
Unlike the last one. :p
I was thinking they would not release it until as early as patch Tuesday. :huh:
--
Remember that cool hidden "Graffiti Wall" here on BBR? After the name change I became the "owner", so to speak as it became: Dustyn's Wall »[Serious] RIP

Re: Adobe Flash Player 11.4.402.287

Mon, 08 Oct 2012 14:44:55 EDT

gugarci posted : Thanks.

Re: Adobe Flash Player 11.4.402.287

Mon, 08 Oct 2012 14:44:17 EDT

StuartMW posted : FYI Microsoft has released a patch for IE10 on Win8/Server 2012.

»www.microsoft.com/en-us/download···id=34812

»www.microsoft.com/en-us/download···id=34813

»www.microsoft.com/en-us/download···id=34816
--
Don't feed trolls--it only makes them grow!

Re: Adobe Flash Player 11.4.402.287

Mon, 08 Oct 2012 14:31:09 EDT

MarkAW posted : [att=1]
Thanks StuartMW . :)

Re: Adobe Flash Player 11.4.402.287

Mon, 08 Oct 2012 13:48:01 EDT

StuartMW posted : Prolly because every man and his dog is hitting that page.
--
Don't feed trolls--it only makes them grow!

Re: Adobe Flash Player 11.4.402.287

Mon, 08 Oct 2012 13:47:09 EDT

La Luna posted : NP, sometimes it happens. Glad it's working for you now. :)

Re: Adobe Flash Player 11.4.402.287

Mon, 08 Oct 2012 13:46:12 EDT

Sindows 7 posted : It was my end sorry.

Re: Adobe Flash Player 11.4.402.287

Mon, 08 Oct 2012 13:46:02 EDT

La Luna posted : Nope, the link is fine, just downloaded from there.

Just a heads up, make sure to uncheck the McAfee scan thingy before you download if you don't want it.

Re: Adobe Flash Player 11.4.402.287

Mon, 08 Oct 2012 13:33:16 EDT

StuartMW posted :

said by Sindows 7:

I think that link croaked.

I downloaded from the page and just revisited it. The page is there. The link is good.
--
Don't feed trolls--it only makes them grow!

Re: Adobe Flash Player 11.4.402.287

Mon, 08 Oct 2012 13:31:23 EDT

Sindows 7 posted :

said by StuartMW:

The last release version was 11.4.402.278 and this is 11.4.402.287 to aid confusion.

It's available here.

»www.adobe.com/products/flashplay···on3.html

The Windows EXE's are signed with a certificate with the serial number

4d 4a a1 fd f2 6f 9f 33 53 d6 26 14 ed a6 62 37

and expiring 10/1/2015.

No idea what the changes are. It might just be the last version signed with a new certificate.

More info:

Flash Player 11.4.402.278.exe ==> 10,213,296 bytes
Flash Player 11.4.402.287.exe ==> 10,220,472 bytes (7,176 larger)

Flash Player 11.4.402.278 (IE).exe ==> 9,573,296 bytes
Flash Player 11.4.402.287 (IE).exe ==> 9,575,864 bytes (2,568 larger)

I think that link croaked.

Re: Adobe Flash Player 11.4.402.287

Mon, 08 Oct 2012 13:01:25 EDT

StuartMW posted :

"These updates resolve buffer overflow vulnerabilities that could lead to code execution
...

These updates resolve memory corruption vulnerabilities that could lead to code execution
..."

The usual then...
--
Don't feed trolls--it only makes them grow!

Re: Adobe Flash Player 11.4.402.287

Mon, 08 Oct 2012 12:43:48 EDT

StuartMW posted : Which is why I posted the certificate info above :)

»Adobe's code signing certificate has been stolen
--
Don't feed trolls--it only makes them grow!

Re: Adobe Flash Player 11.4.402.287

Mon, 08 Oct 2012 12:40:52 EDT

therube posted : Security Advisory: Revocation of Adobe code signing certificate

Re: Adobe Flash Player 11.4.402.287

Mon, 08 Oct 2012 12:39:51 EDT

therube posted : "Adobe has released security updates for Adobe Flash Player 11.4.402.278 and earlier versions for Windows, Adobe Flash Player 11.4.402.265 and earlier versions for Macintosh, Adobe Flash Player 11.2.202.238 and earlier for versions for Linux, Adobe Flash Player 11.1.115.17 and earlier versions for Android 4.x, and Adobe Flash Player 11.1.111.16 and earlier versions for Android 3.x and 2.x. These updates address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.

...

These updates resolve buffer overflow vulnerabilities that could lead to code execution
...

These updates resolve memory corruption vulnerabilities that could lead to code execution
..."

»www.adobe.com/support/security/b···-22.html

Re: Adobe Flash Player 11.4.402.287

Mon, 08 Oct 2012 12:38:58 EDT

Triple Helix posted : Thanks StuartMW

TH ;)

--
Triple Helix - Microsoft� MVP Consumer Security 2012
VIP Member Of ASAP - (Alliance of Security Analysis Professionals™)
Official Webroot SecureAnywhere (Prevx) Support Forum Helper.
(H59 Clan)

Re: Adobe Flash Player 11.4.402.287

Mon, 08 Oct 2012 11:41:43 EDT

Dustyn posted : Thanks!
That is also the only link I use to install Flash updates. :)
[att=1,l]

Re: Adobe Flash Player 11.4.402.287

Mon, 08 Oct 2012 11:00:28 EDT

art22gg posted : Thanks Stuart... :D

Adobe Flash Player 11.4.402.287

Mon, 08 Oct 2012 10:50:48 EDT

StuartMW posted : The last release version was 11.4.402.278 and this is 11.4.402.287 to aid confusion.

It's available here.

»www.adobe.com/products/flashplay···on3.html

The Windows EXE's are signed with a certificate with the serial number

4d 4a a1 fd f2 6f 9f 33 53 d6 26 14 ed a6 62 37