Yet another Adobe Flash patch is out:
Here is where they are all located: http://helpx.adobe.com/security.html
Yesterday 2 patches (fixing vulnerabilities found) were released
“Successful exploitation could cause a crash and potentially allow an attacker to take control of the affected system. We are aware of reports that this vulnerability is being actively exploited in the wild via drive-by-download attacks against systems running Internet Explorer and Firefox on Windows 8 and below.”
“Adobe has released security updates for Adobe Flash Player for Windows, Macintosh and Linux. These updates address a vulnerability that could be used to circumvent memory randomization mitigations on the Windows platform. ” Priority 2 or 3 depending on platform
You can see that there is no prescribed date for these patches, since unlike Microsoft Adobe has decided to create patches for vulnerabilities as they come out (especially for critical vulnerabilities.
In case you don’t know Microsoft has decided some time ago to make the 2nd Tuesday of the month patch Tuesday. (which was January 13th this month)
So these patches are considered “out-of-band”. because of the large concentration of Microsoft devices this 2nd Tuesday planning for installing new patches has become an industry standard, although that may be changing.
Look at the platforms and versions for Adobe Flash:
|Product||Affected versions||Platform||Priority rating|
|Adobe Flash Player Desktop Runtime||220.127.116.117 and earlier||Windows and Macintosh||2|
|Adobe Flash Player Extended Support Release||18.104.22.1680 and earlier||Windows and Macintosh||2|
|Adobe Flash Player for Google Chrome||22.214.171.1247 and earlier||Windows, Macintosh and Linux||2|
|Adobe Flash Player for Internet Explorer 10 and Internet Explorer 11||126.96.36.1997 and earlier||Windows 8.0 and 8.1||2|
|Adobe Flash Player||188.8.131.529 and earlier||Linux||3|
The landscape is fragmenting with more people running mobile Operating systems, although the 2nd Tuesday patch timing may be with us security folks for some time to come.
Of these 2 vulnerabilities, the first one (apsa15-01) has a critical nature to it. If you do click on malware or run across a website that takes advantage of the vulnerability your machine will run whatever the criminal hacker has in store for you. (viruses, ransomware, key loggers, adware, or something new)
Right now Cryptolocker3.0 is the bad guy on the block, so if you have an old version of Adobe Flash, then you are susceptible to getting hacked and then all your files will be encrypted. How about having to pay for getting the “right to use your files” to the tune of $500. And sometimes that is not even in the cards, as the anonymous methods of payment do not always work. It is also curious… the criminal hacker does not have tech support in case his decryption method or payment method does not work. So pretty much you better have a backup of your files. Otherwise you can start from scratch to rebuild stuff.
So yes the patches do matter – when will you patch?
There are of course more than just the Adobe Flash “out-of-band” patches:
Oracle came out with its patch rollup:
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html the POODLE fix is in here, there are many(169) software patches for different versions of Oracle Products.
“This Critical Patch Update contains 169 new security fixes across the product families listed below. Please note that a blog entry summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at https://blogs.oracle.com/security.”
Google paid $88.5k in bounties as security researchers found flaws in Chrome. So version 40 is now here. Patched 62 security flaws.
Here is an interesting paragraph:
“In contrast, Microsoft has yet to provide a single security patch for its Internet Explorer browser in 2015, while Mozilla’s Firefox 35 had nine security advisories attached to it.”
I am sure there is more coming for Microsoft on February 10th (2nd Tuesday)
If you only have a certain number of resources then be judicious of which patches to implement first, like the critical nature patches which can take over your machine.
So my headline of Patches, “I don’t need those stink’ patches” (stems from movie: Blazing Saddles) is of course the opposite of what needs to be done. The trick is to implement correctly, test the patch in your environment and then implement to production systems in a reasonable amount of time.
In the meantime… be careful out there.