Archive for September 14th, 2010

The Adobe Flash Player, current version and below, is affected by a critical vulnerability which, according to Adobe's Security Advisory APSA10-03, is being actively exploited in the wild. A patch won't be available until September the 27th, which means the 3 or 4 Flash users out there are left in the cold, under attack for two weeks at least.

In the meanwhile, the only mitigation measures available are either disabling Flash outright or using NoScript.
At any rate, relying on the "FlashBlock" extensions for your security is not a good idea, neither on Firefox nor on Chrome: these toys are great against annoyances, but too easy to circumvent to be hacker-proof. Unfortunately you can always find naive advices in the press...

If you believe that building your whitelist of websites trusted to run scripts is too tiresome, please consider this: after 2 or 3 days of training, NoScript will know enough about your browsing habits to amost vanish in the background. Moreover, latest versions feature a true "one click" UI which further reduces your initial effort, because now the contextual menu is shown as soon as you just hover over NoScript's icon, allows you to switch multiple permissions at once and disappears as your mouse moves away. However, if you're an irreducible who wants JavaScript to run free everywhere, you can still emulate a safer "FlashBlock mode" by using NoScript's (not recommended) Allow Scripts Globally command after having checked NoScript Options|Embeddings|Apply these restrictions to trusted sites as well.

Talking about mitigation, I heard much fanfare (even on ./) about Microsoft's Enhanced Mitigation Toolkit (EMET) 2.0 being able to prevent exploitation of another 0 day affecting Adobe Acrobat Reader. Unfortunately at this moment I had no success at downloading this fabulous tool by following the available links, but this probably just means I'm low on caffeine. Could anybody point me to a working and trusted EMET 2.0 download source? Update: the link from the MS blog was actually broken this morning, but now it's reachable as pointed out by a commenter.

Update 2010-09-20

Adobe rushed out version one week earlier than scheduled to patch this hole.

Bad Behavior has blocked 969 access attempts in the last 7 days.