back to article Adobe emits emergency patch for Flash hole malware is exploiting right this minute

Adobe is advising folks to update Flash Player – as malware is right now exploiting a newly discovered hole in the internet's screen door to hijack Windows PCs. The emergency patch addresses a single vulnerability, CVE-2016-7855. The use-after-free() programming blunder allows an attacker to achieve remote code execution when …

  1. Doctor_Wibble
    Trollface

    Ha! Luddites exonerated

    And use of telnet for browsing is proven as justified.

    1. Robert Carnegie Silver badge
      Trollface

      Re: Ha! Luddites exonerated

      You really shouldn't be using telnet either, ...oh. I see what you did, now. \:!shutdown -frequency=daily -time=random

      1. BillG
        Devil

        Re: Ha! Luddites exonerated

        It's ironic that when you download the Adobe Flash updater you get the option to install a McAfee virus scanner.

        "If you install our Flash, you better use a virus scanner!"

        (El Reg needs an icon for irony)

  2. arctic_haze

    Unbelievable

    It's almost 2017 and people are still using Adobe Flash???

    1. Anonymous Coward
      Anonymous Coward

      Re: Unbelievable

      It's almost 2017 and people are still using Adobe Flash???

      Nope. I removed it about 6 months ago from all machines, but I must admit it is occasionally still a pain.

      That said, I found that setting browser ident to iOS (or basically anything not Windows, macOS or Linux) will happily work on most sites such as the BBC. Not all of it. but I consider that a benefit as it stops me from wasting too much time :).

    2. Anonymous Coward
      Anonymous Coward

      Re: Unbelievable, lets just correct this

      It's almost 2017 and sheeple (and the bbc) are still using Adobe Flash???

      1. Triggerfish

        Re: Unbelievable, lets just correct this

        There's so many websites still using it, it's not sheeple it's just people who are non techy do not know better, log in to my online banking fiirst message window/bar that comes up please enable flash, it doesn't actually have anything to do with the log in process ignore it you have no problems, far as I can see it's just so they can have a whizzy effect on an advert from them.

        Hows the average non tech, non cynical user going to know that? They probably trust their bank security explicitly and believe the bank expends plenty of money on making sure they are secure tech wise. So if they are using flash it must therefore be safe.

        It needs killing and companies and website operators need to be the ones sharpening the stakes.

        1. Anonymous Coward
          Anonymous Coward

          Re: Unbelievable, lets just correct this

          I tried the Amazon Prime web player, that runs html5. The audio went out of sync with the picture after about a minute and however much I tried to resync it never managed to stay that way. Unwatchable.

          This is the same pc I use for netflix, which uses flash, and works perfectly.

          Till HTML5 media works as well as flash it's never going to completely replace it.

          1. Updraft102

            Re: Unbelievable, lets just correct this

            There was a bug in the Amazon HTML5 player, your browser, one of the addons you use (if any), a driver on the system, or something similar. It's not a case of HTML5 not working as well as Flash. I've been using HTML5 video playing on many different sites for quite a while now, and I've never seen what you describe. It's dumb that sometimes I have to set the user-agent to iPad to get the site to serve an appropriately Flash-free version, but that's not a problem with HTML5 either.

        2. anthonyhegedus Silver badge

          Re: Unbelievable, lets just correct this

          That's the trouble with banks. People say "but the bank told me to install it" and they trust their bank. Banks have shown time and time again to not be trustworthy when it comes to their core function (banking) so why on earth would they be remotely trustworthy when it comes to things like computer security?

          They tell you to install things like that dreadful "Trusteer Rapport" software and time and time again I have to remove it from people's computers because they're unable to access the internet, or running slow, or not running at all, simply because of this thing the bank told them to install.

          But having a bit of flash on the intro screen of a bank login is crass to say the least. It shows utter contempt and disregard for the end user and for security as a whole.

        3. BillG
          Facepalm

          Re: Unbelievable, lets just correct this

          log in to my online banking fiirst message window/bar that comes up please enable flash, it doesn't actually have anything to do with the log in process

          Actually Flash sets its own persistent cookies that are independent of your browser's cookies. Unfortunately you can clear browser cookies and the Flash cookies are still there.

          And unfortunately, the greater irony here is that some websites use Flash cookies for security!!!

    3. Anonymous Coward
      Anonymous Coward

      Re: Unbelievable

      Just finished a compulsory company e-learning course - it required Flash, and also activating third-party cookies because the platform is a SAP one used by some outsourced entity...

      1. Anonymous Coward
        Anonymous Coward

        Re: Unbelievable

        "a compulsory company e-learning course" -- Bingo! Everyone of our compulsory courses are Flash-based. IT believes that firewalls, anti-virus, and in-house development suffice.

  3. MrDamage Silver badge

    Dear Adobe

    Just take it around the back o the shed and put a fucking bullet in it already.

    Regards,

    Everyone.

    1. Anonymous Coward
      Anonymous Coward

      Re: Dear Adobe

      Dear Everyone,

      I will happily kill Flash if you send me Dale.

      Thanks,

      Ming

      1. Anonymous Coward
        Anonymous Coward

        Re: Dear Adobe

        >I will happily kill Flash if you send me Dale.

        Dale who, Dale Winton ?

        1. Anonymous Coward
          Anonymous Coward

          Re: Dear Adobe

          Ok, we'll send you Dale Winton and keep Dale Arden... after all, anybody is entitle their own preferences... just kill Flash anyway.

          1. Anonymous Coward
            Anonymous Coward

            Re: Dear Adobe

            >Ok, we'll send you Dale Winton and keep Dale Arden... after all, anybody is entitle their own preferences... just kill Flash anyway.

            Thank you for clarifying that, we'd have hated to send the wrong Dale and suffered the terrible consequences of Larry Ellison's Ming's wrath.

            Sadly folks this means there will be no new series of Supermarket Sweep.

      2. Wiltshire

        Re: Dear Adobe

        Some say the Flash blocker's project code name is "Brian Blessed"

      3. Updraft102

        Re: Dear Adobe

        Forget it, Ming, Dale's with me.

    2. Wade Burchette

      Re: Dear Adobe

      A bullet is insufficient. It needs to be burned to the ground, its ashes thrown in a box, and the box hurled into the sun.

      1. 's water music

        Re: Dear Adobe

        It needs to be burned to the ground, its ashes thrown in a box, and the box hurled into the sun.

        Umm, no. The ashes need to be stored in in a place that has been specifically dedicated to this purpose. Apparently.

  4. Mage Silver badge

    Flash

    It's disabled by default, but I have it on Linux Mint + Mate + Firefox + Noscript.

    Just installed the Linux update to Flash, MySQL and Sudo

    I can't remember the last time I actually enabled it.

  5. Velv

    Why do Chrome and IE11 support it internally?

    Drop it now, and anyone who wants Flash can install it for themselves. Those of us who know it's unsafe don't need to worry about it existing in the background.

  6. Anonymous Coward
    Anonymous Coward

    "Adobe excretes emergency patch for Flash hole"

    FTFY

  7. Anonymous Coward
    Anonymous Coward

    I uninstalled it well over a year ago now. At the time, older YouTube vids wouldn't play sometimes and BBC, of course. More of the net is moving away from it and -frankly- sod those that aren't. Missing the occasional thing has been more than made up for by the peace of mind of not having to worry about the bastard. And, of course, there's the joy of pure, unfiltered schadenfreude reading the many and regularly-occurring articles like this one.

    Throw off your shackles. Nuke Flash from orbit. It's the only way to be sure.

  8. Anonymous Coward
    Anonymous Coward

    The online Olympics coverage required Flash, I was LIVID

  9. Delbert Grady
    Big Brother

    I refuse to install any Adobe crap, not done for years, never will again, like others say on here, if sites expect flash, i don't use them. flash used to work on iPlayer by setting the user agent to some other, i can't remember which though, or if it still works, as i block all BBC, Adobe (and many more) and all known related crap now, in HOSTS as i refuse to consume any of their shite .. i say let the BBC sink and take Adobe's flash with it.. maybe i'm a dreamer..

  10. Matt Bryant Silver badge
    Flame

    FTFY

    "Adobe emits emergency patch for Flash hole malware...." Adobe Flash is malware as far as I'm concerned. In professional terms I mentally write "cretin" in laundry marker on the forehead of anyone who suggests using it (yes, I am looking at certain people at the Beeb - you know who you are!).

  11. EveryTime

    It's easy to say "uninstall it". I have, multiple times. And Every Time, every Fing time, there is a critical website that requires Flash.

    You might say I don't "need" it, but when your health insurance web site requires it to sign up, that's a pretty good definition of "need".

    Adobe had a huge win on their hands with Flash. They dominated the market. It might have been expensive to rewrite it a decade+ ago, but if they had made that investment they would have made it back many times over. Instead Adobe just made it a bigger, buggier pile of crap.

    1. Flocke Kroes Silver badge

      When your health insurance web site requires flash

      That's a pretty good definition of "need" to find a different health insurance company.

      1. EveryTime

        Re: When your health insurance web site requires flash

        I say 'need' because my employer paid for the health insurance. I needed to register on the flash-enabled site. Of course I could have skipped benefits and just pay the big tax penalty for having no insurance,

        1. Danny 14

          Re: When your health insurance web site requires flash

          Phone them?

  12. JLV

    Insanity: doing the same thing over and over again and expecting different results.

    A. Einstein.

  13. Darren Forster

    Isn't it time we put Flash out of it's misery...

    Flash is yesterdays technology, there is much better technology out there now - Bootstrap and HTML5 are the future. Flash doesn't make mobile friendly sites (unless you hide all the flash content from mobile devices - but what's the point in doing that?? You might as well just show the content that works on mobiles on the main site too and have done with Flash).

    I've not used Flash in many years, even before HTML5 I found much better ways to design things than Flash that were compatible with mobiles and other devices. Adobe please just do the decent thing and instead of keep holding the thing together with sticky tape and patches (this thing's looking more, and more like a Blue Peter project everyday) - just put it out of it's misery and finish it off and get working on something decent like a good CMS or something.

  14. Pete 47

    HTML5 aint all roses for all people

    It's all very well saying kill Flash NOW!!! HTML5, HTML5, HTML5.....

    But a LOT of people (just Google it) have terrible performance issues with it, especially under Firefox and Flash just gives a better user experience in these cases.

    As for YT forcing 60FPS on HD content, well... Yes I know there are addons and user-side scripts to deal with it but even so.

    1. Anonymous Coward
      Anonymous Coward

      Re: HTML5 aint all roses for all people

      Also, "This latest exploit will only further underscore the arguments from the security community to get rid of the bug-prone Flash Player in favor of the newer, more secure HTML5 standard for multimedia web content."

      Spoiler alert: HTML5 isn't secure either; browsers are the new Flash. It's total crap, and the only reason we use it is because it's ubiquitous. Like Flash was.

      Flash was actually a better approach - a portable virtual machine for multimedia/interactive stuff. If only it had been properly architected, implemented, and maintained; and open source.

  15. Brian of Romsey

    Ask the BBC

    Is it time our intrepid hero reporters at The Reg asked the BBC for comment on when they will be removing the need for Flash? Enquiring minds want to know.

  16. theOtherJT Silver badge

    Whist simultaneously making updating it harder...

    This coming as it does a few weeks after Adobe pulled the "offline" flash installer from their downloads page and force you to apply for a "Distribution licence" to get it back. This application being a manual process where you fill in a form and they promise to email you back letting you know if your application has been successful, and then go silent.

  17. Anonymous Coward
    Anonymous Coward

    Did the original flash code contain anything that wasn't exploitable ? How many patches are we up to now ?

    1. Robert Carnegie Silver badge

      I think now we must be well into patching the holes crated by the previous patches.

      I have gardening clothes like that.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like