ie8 fix
madison

Zero Day

Ryan Naraine, Emil Protalinski and Dancho Danchev

Apple gives Mac users vulnerable Flash Player plugin

By | June 16, 2010, 8:08am PDT

Summary: The Adobe Flash Player plugin that was included in yesterday’s Mac OS X software update contains multiple vulnerabilities that expose users to malicious hacker attacks.

The Adobe Flash Player plugin that was included in yesterday’s Mac OS X software update contains multiple vulnerabilities that expose users to malicious hacker attacks.

Apple shipped a new Flash Player plugin (10.0.45.2) in the Mac OS X patch bundle but that version became outdated on June 10th when Adobe shipped Flash Player 10.1.53.64.

The Flash Player 10.0.45.2 software contains 32 vulnerabilities, most rated “critical.”   At least one of those flaws has been exploited on the Windows platform.

Apple plugs 28 Mac OS X security holes ]

Apple’s outdated Flash Player plugin problem was flagged publicly by Adobe’s Wendy Poland:

follow Ryan Naraine on twitter

Earlier today, Apple released security update 2010-004 / Mac OS X v10.6.4. This update includes an earlier version of Adobe Flash Player (version 10.0.45.2) than available from Adobe.com. While the Mac OS X v10.6.4 update does not appear to downgrade users who have already upgraded to Adobe Flash Player 10.1, Adobe recommends users verify they are using the latest, most secure version of Flash Player (10.1.53.64) available for download from http://www.adobe.com/go/getflashplayer.

To verify the Adobe Flash Player version number installed on your system (after applying the Mac OS X security update), Mac users can go to the About Flash Player page, or right-click on content running in Flash Player and select “About Adobe Flash Player” from the menu.

If you use multiple browsers, Poland recommends you perform the check for each browser you have installed on your system.

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

Topics

Ryan Naraine is a journalist and social media enthusiast specializing in Internet and computer security issues.

Disclosure

Ryan Naraine

The most important disclosure is of my employment with Kaspersky Lab as a member of the global research and analysis team. Kaspersky Lab is a global company specializing in anti-malware and secure content management technologies. I do not own stocks or other investments in any technology company.

Biography

Ryan Naraine

Ryan Naraine is a journalist and social media enthusiast specializing in Internet and computer security issues. He is currently security evangelist at Kaspersky Lab, an anti-malware company with operations around the globe. He is taking a leadership role in developing the company's online community initiative around secure content management technologies.

Prior to joining Kaspersky Lab, Ryan was Editor-at-Large/Security at eWEEK, leading the magazine's and Web site's coverage of Internet and computer security issues and managing the popular SecurityWatch blog, covering the daily threats, vulnerabilities and IT security technologies. He also covered IT security, hacker attacks and secure content management topics for Jupiter Media's internetnetnews.com.

Ryan can be reached at naraine SHIFT 2 gmail.com. For daily updates on Ryan's activities, follow him on Twitter.

71
Comments

Join the conversation!

Just In

RE: Adobe gives Mac users vulnerable Flash Player plugin
ryanstrassburg 17th Jun 2010
Normally I would like to say this is Adobe's fault, but honestly this is Apple's muck-up just the same. But it is also the users who want it thus this is what they get. Adobe Flash has underlying problems that will likely not disappear without a complete rework, not a bad plan since still I have no 64-bit flash player thus a handful (literally) of sites I use require this, though I strongly suggested to the admins they consider a different technology due to my own security concerns.
0 Votes
+ -
If Apple includes Flash by default, Apple takes responsibility for all of Flash's problems. End of story.
@NonZealot

Wrong. Apple didn't do anything wrong here. They prepped their release of their security update, which included the latest, Apple Tested version of Flash at the time. They were smart enough to NOT update the local flash version if it was a newer version then what they were going to install. I installed 10.1 the other day and 10.6.4 yesterday, and my flash version did not change.

Just because Adobe finds an issue after Apple has prepped and tested their update, doesn't mean Apple has to go back now and delay their release so they can integrate the new version of Flash, then submit it back to their testers to make sure nothing new breaks.

Again, Apple checks the already installed version and does NOT downgrade it. If you had a vulnerable version before, you have it still. If you updated your flash, you're OK.

This is either Adobe being cautious, or trying to point fingers at Apple, or a little of both.
0 Votes
+ -
@tk_77

Isn't it a bit of a leap to say that Adobe's trying to point fingers at Apple? Nowhere does it say that Adobe was blaming Apple for not including the latest Flash Player.
0 Votes
+ -
Mixed feelings about this
cornpie Updated - 16th Jun 2010
@tk_77 In the Windows world, we have Microsoft SUS which does a good job of allowing us to push updates out to all the Windows clients on our network. The problem is, that it only pushes the updates for Microsoft products.

For the never ending series of Adobe Acrobat and Flash updates, we have to build our own patch files and push them out separately via group policy. And Adobe does not make it easy. Their automatic updaters don't work becuase our users do not have permissions to install software and also their patches for Acrobat are not cumulative. The other day I was installing a new machine and went directly to the Adobe web site thinking I would get the most current version of the Acrobat Reader. Wrong. After downloading and installing, it still needed to be patched up to the current level.

So I often wish that Microsoft would push out other vendor's patches so that we could deploy them through SUS just like the Microsoft stuff. but if they did that, they would now be coming under the same criticism as Apple because their latest patch Tuesday release didn't include the most recent "patch of the day" for Adobe Products.

I'm generally not a fan of Apple, but I do think they handled this one correctly. At least it appears that in no case did they make it worse for anyone than it already was.
@NonZealot So now you see why Steve Jobs is right about not supporting Flash on iPhone & iPad
0 Votes
+ -
@NonZealot

Flash needs to get with the program and include an auto-updater for all platforms, including OS X.
@RealNonZealot - I agree.

Recent articles on zdnet and other sites have shown, outside of OS X, Flash is not so bad after all. However, Adobe would be doing themselves a lot of good to put in an auto-updater. It's technically not difficult to have the player see which browser and OS it's running under and grab the relevant code.

http://www.zdnet.com/blog/perlow/web-video-showdown-flash-vs-quicktime-vs-windows-media/13176

http://www.readwriteweb.com/archives/does_html5_really_beat_flash_surprising_results_of_new_tests.php

http://blogs.msdn.com/b/sprague/archive/2007/01/18/java.aspx

http://blogs.gartner.com/ray_valdes/2010/02/10/html5-and-flash/
@NonZealot

Du you have a life? why not live it somewhere else.
0 Votes
+ -
RE: Adobe gives Mac users vulnerable Flash Player plugin
The Danger is Microsoft 16th Jun 2010
@NonZealot You are such an arse wipe! Crawl into a hole and die already!
0 Votes
+ -
@The Danger is Microsoft Humm pot talking to the kettle?
  • Flagged
0 Votes
+ -
@NonZealot In a way I agree with you - Apple should have tested this more thoroughly and then taken Flash out of the patch. Also the things that needs to be taken from this is that this is even more proof that Adobe needs to get to work fixing their buggy and extremely vulnerable software and that Steve jobs was right about Flash and Adobe in the first place.
@athynz Steve Jobs shipped an outdated version of Flash, and that proves he was right about them in the first place?

Flash suffers the same problem that Microsoft does, something that Apple has yet to achieve, and that is ubiquity.
@athynz - Steve Jobs. Apart from his avoiding the fact that OS X has a lot of holes as well,

http://www.zdnet.com/blog/perlow/web-video-showdown-flash-vs-quicktime-vs-windows-media/13176

http://www.readwriteweb.com/archives/does_html5_really_beat_flash_surprising_results_of_new_tests.php

http://blogs.msdn.com/b/sprague/archive/2007/01/18/java.aspx

http://blogs.gartner.com/ray_valdes/2010/02/10/html5-and-flash/

He's told his figures for Flash performance solely regarding OS X and not for 90% of what the world uses, which is Windows. (the zdnet article deftly points out a few things.)

Along with the other articles I've included, which includes one where he says Java will die (which hasn't and is still in use by many major companies), he's just being a marketer and using words to manipulate the market with.

I've put Win7 on my MacBook Pro (mid-2009) and my Mac Pro, so for the latter I can finally upgrade the video card to an ATi 5870 and not wait for Apple to put out theirs (assuming they intend to). I prefer OS X, but I don't prefer Jobs' attitude on this whole escapade. He smudged some facts to provoke a cold war with Adobe, and even apologized in a loose way:

http://www.tomsguide.com/us/Steve-Jobs-Adobe-Flash-HTML5,news-6944.html

And since, with any programming language, poor coding is the root cause of most stability and other issues, any platform is only as strong as those who write for it take the time to do the work. Being cheap to get whatever out the door as quickly as possible leads to problems, and Adobe hardly started that trend...
0 Votes
+ -
@rtk Are you upset that Jobs was right about flash?

In light of Job's understandable dislike of flash I'm surprised that a Mac patch had a flash installer/ update contained within it albeit an older version. But that an outdated version was present in the patch is not what proves jobs to be right.

What proves that Jobs was right is the vulnerabilities present in Flash - and that it took over 6 months for them to fix prior issues. And that on a mobile platform it is a major battery hog.

IMHO Apple should have tested the entire patch, found the flaws in Flash, ripped Flash out of the patch, and THEN shipped the patch out - and leave Flash out of the patch until Adobe gets it right.
@athynz Steve shipped an outdated version of Flash, that proves he's right about Flash? You sure you don't work for the government?

He does the same thing with windows. Ships the crappiest, most bloated and crash prone software on Windows (namely iTunes) then turns the PR department on to advertise how crappy, bloated and crash prone Windows is.

He's a marketer, obviously. You're an easy target to market to, obviously. Good for Steve, too bad for you.
Apple pushed this out, not Adobe. They should have found vulnerabilities when they did internal tests and determined to include it in their package.

At the end of the day, Apple appears to be at fault.
@AllAroundIT

As I posted above to the troll, how is this apples fault? Is Apple expected to debug all the 3rd party software they install with their system?

No.

Apple did right here. If you have an older version of Flash installed, they update it to the latest version they gave their testing to. If you have a newer version installed, they leave it be.
0 Votes
+ -
@tk_77

Is Apple expected to debug all the 3rd party software they install with their system?

Yes they are. That's part of the customer's expectations. I use Gentoo and I am damned mad that they let a package with a trojan horse in their repository. You should be no less mad if you use OS X.
@tk_77
If they are pushing out software they accept resposibility for it.
Why they did a push of the non-latest I still do not understand. At the time of push if the current available version is > push version, don't.
0 Votes
+ -
This is always old news
Snooki_smoosh_smoosh 17th Jun 2010
@Michael Kelly & Zenwalker... People were pointing about this one other time. If you preparing a patch to update a series of software, are you going to stop what you are doing, and go back to rework the patch because a new version of a 3rd party plugin was released just days before you push? No. As the previous poster pointed out, it brought people who are farther behind in Flash updates to the version just before 10.1, which means those users were already at risk with or without the patch.

This is just simply fodder for the ABAers to scream about, which really means nothing at all.
@AllAroundIT - agreed
0 Votes
+ -
I do not like Apple, but they followed a reasonable release strategy in this case. It takes time and effort to prepare a release, and no vendor pushing such a large product can let their release dates be hostage to the developers of the individual components. Apple did well to acknowledge that the update shipped with an outdated Flash version, and this is much better than the prior incident where an Apple upgrade replaced newer Flash versions with the included (older) version.

All of that said, if Apple intends to provide Flash in their product, then they need to promptly push out Flash updates through their own update channels when a vulnerability is addressed. The same goes for Java and other bundled technologies.
@patrickwbarnes

The question is what does Apple do if you don't have flash already installed.

If you had a vulnerable one installed, and Apple updated it to a newer vulnerable version, then I don't see an issue. If you had a newer one installed, Apple doesn't touch it, again no issue.

Now if you did not have Flash installed, and Apple decided to install it for you, then I suppose that would be an issue they should resolve. Now we just need someone who did not have it installed speak up as to whether Apple then installed to the system.
0 Votes
+ -
@tk_77 Yes, that would be me. I uninstalled Flash some months ago, but yesterday it reappeared, and in the vulnerable version. I do regard this as Apple's error. I had no reason to expect that, having removed Flash from my system, that 10.6.4 would reinstall it.
  • Flagged
0 Votes
+ -
@alpha_server

Seems like a simply solution (for Apple) for future releases: if a plug-in is not installed, then don't install a new one.
Apple also gave its customers third-party software exposing them to security risks:
http://www.zdnet.com/blog/security/apple-gives-mac-users-vulnerable-flash-player-plugin/6720
0 Votes
+ -
@Tim Acheson All you did was link to this same article... WTF? Dude if you are gonna troll at least troll better.
Ah, the Contrarians are hard-at-work again! On the other hand, I applaud the nuanced post by "patrickwbarnes" - who appears to clearly understand & state Apple's responsibility.

So, I decided to check my own vulnerability by searching my hard drive for "flash player" -- I was appalled to discover multiple versions -- dating as far back as early 2008! Apparently, Adobe's updater does NOT consistently locate & update Flash Players installed by their own & other installers when those copies were included with misc. support files for other apps (CS 3, QuarkXPress, etc.).
0 Votes
+ -
The title is TOTALLY misleading
Steven Rogers 16th Jun 2010
Apple does NOT give users the vulnerable plugin. If you have the secure one, you'll still have it after the update. It doesn't update users automatically to the most recent Flash version - which is exactly the behavior you'd expect. These stupid hit-generating stories make ZDNet the "National Enquirer" of tech.
0 Votes
+ -
RE: Adobe gives Mac users vulnerable Flash Player plugin
The Danger is Microsoft 16th Jun 2010
@Steven Rogers Trust me, some people LOVE this aspect of ZDNET (NonZeal something or other)!
@Steven Rogers
It's not the folks who have the current updated version, it's those that don't have it at all that got the "updates" that were compromised.
0 Votes
+ -
@zenwalker

Right, and so Apple should just hold all sales of the Mac until Adobe gets their act together with the next update.

Get real.

This article is tabloid tales of the lowest common denominator. No OS sales should revolve around what version of Flash is released on a particular day or not. And yes, I'd even include windoze in that.
0 Votes
+ -
@Steven Rogers


In this case Apple DID give it to their users because it appears to be installing the Flash plugin if you don't already have it, which makes them the culprit here and not Adobe. As stated by other Apple users even if they have uninstalled the Flash Player plug in, this update installs it on their computer, causing that computer to be vulnerable to the holes in Flash. That is Apples fault, and not Adobe's as they have patched the version that APPLE is installing.
Since when is it Apple's job to provide the latest software other than it's own. It's up to Flash to provide a proper auto-update feature.
Plus given the latest tensions in between those two, ain't it a bit much to expect from Apple? Kind of like an ex, asking her old lover to give her a car ride, to her brand new boyfriend... or expecting that ex boyfriend not to have some fun on the road, "for old time's sake happy "
0 Votes
+ -
Apple DOES NOT take security and patching seriously. Their hideously slow response to known vulnerabilities in their own products continues to be a sore spot.

Apple is no different than that product manager in so many organizations. Forget about fixing bugs, that doesn't gain us revenue. We need new functionality, new marketing ploys, new excitement and our droves of clueless users will follow us. Well, news flash, not all Mac users are clueless Mr Jobs.

The growing number of vulnerabilities being reported in Apple products and increasing scrutiny their products are facing is becoming alarming.

Honestly, it was idiotic of Apple to include any version of Flash in their own package. Adobe does provide API's to do proxy updates. Would be a far safer way to handle it and ensure the most recent updates are in place.
@intechpc - in all fairness, the occasional zdnet article comes out saying "Microsoft's patch for security problem blah blah blah is still unresolved" or "Microsoft's patch created a new flaw, blah blah blah". Stuff happens, even during the best of times.

Thankfully I have Intego on my system, but with so many reports from PWN2OWN and OS X being quick to go under, I do worry - And with Apple's ads, the one I loathed was the one where they played the security card... ridiculous, some of us know that was empty marketing spin... of course, some of us are learning how to be marketers as well but I digress... (And Symantec for the Mac? Only if I *want* malware to slip through...)
0 Votes
+ -
(And Symantec for the Mac? Only if I *want* malware to slip through...

Let me fix that for you:

(And Symantec for the Mac? Only if I *want* malware to slip through, while slowing my machine to a crawl at the same time.)
I've shipped software and freezing it weeks before going 'golden' and doing in house testing is de rigour, however, considering what a player Adobe is (ok who can resist a good pun) there would be reasonable expectations on Apple's part that Adobe knew how to code such a venerable product. Frankly, I'd sooner see Flash join the tech history pile along with bernoulli drives and floppy disks. While Mr. Jobs can be testy at times, he's pretty much spot on, IMHO, in regard to Adobe sitting on its laurels. With the Mac being Intel based (for now) and OS X being a *nix open source currently gives Adobe a run for their money. GIMP pretty much does whatever I wanted PSx to do.
@dheady@... check one of my responses above. I've added a number of links that refute Jobs' claims. One link goes to a rather terrific zdnet article that did some fair comparisons.

Also, as one of my instructors said, he often says "Adobe is a venerable brand. Artists always tell me about what I did with Photoshop. I've yet to hear anybody bring up GIMP. It is not a professional product and it lacks the granularity."

I myself have used other programs (Paint Shop Pro, PhotoImpact, et al) that have some similarities. These apps do NOT go into the same level of detail as Photoshop. They work and can do the usual basic fluff many will need, but if graphics apps were computers, PSP and PI and GIMP are 1960s Univac models with little blue/yellow hippie flower stickers pasted on them, compared to Photoshop's 2010 12-core powerhouse. Period. Professionals do use Adobe software for quite valid reasons.
@dheady@... check one of my responses above. I've added a number of links that refute Jobs' claims. One link goes to a rather terrific zdnet article that did some fair comparisons.

Also, as one of my instructors said, he often says "Adobe is a venerable brand. Artists always tell me about what I did with Photoshop. I've yet to hear anybody bring up GIMP. It is not a professional product and it lacks the granularity."

I myself have used other programs (Paint Shop Pro, PhotoImpact, et al) that have some similarities. These apps do NOT go into the same level of detail as Photoshop. They work and can do the usual basic fluff many will need, but if graphics apps were computers, PSP and PI and GIMP are 1960s Univac models with little blue/yellow hippie flower stickers pasted on them, compared to Photoshop's 2010 12-core powerhouse. Period. Professionals do use Adobe software for quite valid reasons.
0 Votes
+ -
Apple doesn't WANT to give users Adobe Flash. They WANT to implement something safer. Users seem to want it. And, I've done enough beta testing (elsewhere) to know the minute something goes out the door someone 'out there' is going to spot a missed issue. Or a hacker will find a new way. Nature of the beast. Have you (the user) kept Flash current? If so, Apple didn't touch it.
Why should this be a problem? Macs don't get infected anyways! That's what Appholes have said for years.
0 Votes
+ -
@br1252@...

So far it's true, Macs aren't being infected, and the braying Winholes (and DOSholes before them) have been predicting the opposite since 1984....being predictably completely wrong for a few decades, so far.

Maybe it will happen eventually. Our sun's going to go supernova someday too. Keep on predicting, you may be right someday.

Having said that for the benefit of the Windows apologists and trolls, Apple does indeed need to do a better job at security, mainly accelerating their response to reported/discovered security issues and updating the open-source stuff that they bundle more often. It currently takes way too long, even if there's no super-compelling reason, they should act as if there was.
0 Votes
+ -
@RealNonZealot
I liked your reply, especially: ?Maybe it will happen eventually. Our sun's going to go supernova someday too. Keep on predicting, you may be right someday.? happy

Anyway, I think there were 40 something viruses for Mac OS. (?classic? before Mac OS X).
@RealNonZealot - well said. happy
@br1252@... LOL.

I'm a Mac user, and 65% proud to be one these days, but I'm no pre-programmed lemming. And given the events of the last few months, the fact it's still 65% is really impressive.
0 Votes
+ -
It's Obama's fault
josmyth 16th Jun 2010
Should have nationalized Apple and Adobe long ago wink
0 Votes
+ -
Gee. These people that keep screaming "IT'S APPLE'S FAULT! " at every little thing, including the fact they are constipated, remind me of the kid next door who's sister beat him up for lighting her doll on fire.
0 Votes
+ -
Sinister?
HugoM 16th Jun 2010
Steve Jobs has already said that Flash is a vulnerability and he doesn't want to support it. Now he has to prove it. Did he really stoop this low?
0 Votes
+ -
And I'd like to point out that the Mac version of the latest Flash plugin release does not support hardware acceleration while the Windows version does. What the hell is Adobe trying to do? Punish the Mac customer base for Apple telling it like it is about Flash? Or, is it their policy to keep inept coders under their employment? Given the current climate Adobe should be pounding on all cylinders to foster goodwill and support for THEIR products by putting out a secure, efficient and great product.

It also speaks volumes in favour of the Apple iOS's care-taken SDK and app approval process. If **** goes south with a buggy, iOS SDK'd 3rd party app, THEN there's probably no mystery as to who to blame: Apple. End of story. The last thing I want on my phone (and my Mac, for that matter) is the too common situation where one entity (say, Microsoft) points its finger regarding a customer tech problem at a 3rd party developer -- and the 3rd party points its finger BACK at Microsoft! I have been there, literally conference calling with a tech guy from MS AND a tech guy from Dell trying to get my sister's PC to play nice with her network card. It's a world of pain Windows users suffer through, Mac users suffer MUCH less of -- and, frankly, is a situation I do not want my critically important CELL PHONE and I to be a victim of.

At least these two arguments are SOMETHING to be gotten out this ZDnet post and its flame-bait headline. "APPLE gives users". PSHAW!

**EDIT** ZDNet changed the headline from "Apple gives" to "ADOBE gives Mac users". +1 for ZDNet -- but take away half a point for the editors allowing the original, inaccurate headline to make it to press.
0 Votes
+ -
Normally I would like to say this is Adobe's fault, but honestly this is Apple's muck-up just the same. But it is also the users who want it thus this is what they get. Adobe Flash has underlying problems that will likely not disappear without a complete rework, not a bad plan since still I have no 64-bit flash player thus a handful (literally) of sites I use require this, though I strongly suggested to the admins they consider a different technology due to my own security concerns.

Join the conversation!

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
ie8 fix
Click Here
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

White Papers, Webcasts, & Resources
ie8 fix
ie8 fix