CVE-2010-1297: Security Advisory for Flash Player, Adobe Reader and Acrobat

Until there's a fix from Adobe, I'd recommend that an update that deletes/chmods 000 /opt/Adobe/Reader9/Reader/intellinux/lib/libauthplay.so.0.0.0 should be released.

Adobe has release 10.1 which resolves this security issue. Sadly there seem to be some compatibility problems with nspluginwrapper. It works for the most part, but certain operations, like right clicking are failing. But there aren't a lot of options here. 64-bit flash isn't released, and nspluginwrapper is apparently unmaintained.

By the way, now would be a good time to include the patch I provided in bug 314637

This bug was fixed in the package flashplugin-nonfree - 10.1.53.64ubuntu1

---------------
flashplugin-nonfree (10.1.53.64ubuntu1) maverick; urgency=low

  * SECURITY UPDATE: New upstream release 10.1.53.64 (LP: #591001)
    - debian/config, debian/postinst: Updated sha256sums and path
    - CVE-2010-1297
 -- Marc Deslauriers <email address hidden> Thu, 10 Jun 2010 16:06:31 -0400

Maybe some day my patch will get in.

The instability is still there, but I guess it's a bug in nspluginwrapper, which is pretty much dead it seems. I'll go file the bug there just for kicks.

@Joel: sorry about that, I had already started building the packages.

I'll take a look at your patch for the next update.

Any reason flashplugin-nonfree (10.1.53.64ubuntu1) isn't available for Hardy LTS? I just saw an update for flashplugin-nonfree to 10.0.1.218+really9.0.277.0ubuntu1 that said it was a security fix, but according to Adobe this version doesn't have the fix. This page:

https://wiki.ubuntu.com/Releases

says that Hardy is supported until at least April 2011. I thought security fixes was the one major point of LTS releases.

I've nominated this bug for Hardy, but I'm new here so I don't now the correct process to get flashplugin-nonfree (10.1.53.64ubuntu1) on Hardy. Please let me know the correct process.

@Hans Ridder:

The hardy update is version 9.0.277.0. That version contains the latest fixes that Adobe released last thursday.

Please see:

http://www.adobe.com/support/security/bulletins/apsb10-14.html

@Marc Deslauriers:

Ok, apparently one needs to read carefully to see that it is fixed. After saying repeatedly that the vulnerability affects "Adobe Flash Player version 10.0.45.2 and earlier" which would appear to rule out 9.0.277.0, the last paragraph under Solution for Flash Player says "For users who cannot update to Flash Player 10.1.53.64, Adobe has developed a patched version of Flash Player 9, Flash Player 9.0.277.0".

Perhaps off topic for this bug, but is there any reason 10.1 is not available for Hardy? There are more and more sites that don't support Flash 9. Adobe has a 10.1 .deb that seems to work on Hardy.

I think there were some problems with v10 on hardy, which is why it got reverted to v9. I think it was sound problems, but I don't recall off-hand.

If you want 10.1 on hardy, you can install the "adobe-flashplugin" package out of the partner repo.

Flash 10 wasn't included in Hardy because on 64-bit systems, ia32-libs was missing a bunch of newly required libraries. Possibly nspluginwrapper needed an update too.

I was getting Firefox crashes with the Hardy update version, 9.0.277.0, so I'd say there is still a problem with the CVE fix on Hardy that needs to be addressed. I don't know how to gather data to diagnose the crash or if anyone is willing to work on it.

To try 10.1, I didn't have the partner repository mentioned previously, despite the claim the Hardy Release Notes that it should have been added during an upgrade:

https://wiki.ubuntu.com/HardyReleaseNotes#Commercial/partner%20repository

I have upgraded this system "automatically", all the way from Breezy.

I added the partner repository using Synaptic: Settings -> Repositories -> Third-Party Software -> Add. Enter the APT line from the above web page, click on Add Source, then click Close. If a warning dialog pops up, click Close. Click the Reload button. Search for "adobe" and install the "adobe-flashplugin" package.

This currently gets you adobe-flashplayer version 10.1.53.64-1, which is the same as you would find at:

http://get.adobe.com/flashplayer/

It hasn't crashed, so far, and it supports those sites that require Flash 10+.