Adobe Flash Player and AIR Critical Security Updates

To contact us Click HERE
Tweet This

Adobe Flash Player was updated to address critical security vulnerabilities.  These updates address a vulnerability that could cause the application to crash and potentially allow an attacker to take control of the affected system.

Update Information

The newest versions are as follows:

Windows XP, Windows Vista, Windows 7:  11.5.502.146
Windows 8:  11.3.378.5
Macintosh:  11.5.502.146
Linux: 11.2.202.261

Release date: January 8, 2013
Vulnerability identifier: APSB13-01
Priority: See table below
CVE number: CVE-2013-0630
Platform: All Platforms

Flash Player Update Instructions

Flash Player for Windows, Macintosh and Linux

Although Adobe suggests downloading the update from the Adobe Flash Player Download Center or by using the auto-update mechanism within the product when prompted, if you prefer, direct download links are available.

• Flash Player For Internet Explorer 7, 8 & 9:  http://download.macromedia.com/get/flashplayer/current/licensing/win/install_flash_player_11_active_x.exe
  
  Flash Player for Internet Explorer 10: Microsoft updated Security Advisory 2755801.  If you do not have Automatic Updates enabled, the Flash Player update can be downloaded from the Download Center at Update for Internet Explorer Flash Player for Windows 8 Release Preview (KB2758994).
  
  
• Non-IE (Opera, Firefox, Etc.):  http://download.macromedia.com/get/flashplayer/current/licensing/win/install_flash_player_11_plugin.exe
• Flash Player Uninstaller:  http://download.macromedia.com/get/flashplayer/current/support/uninstall_flash_player.exe

Notes:

• Adobe AIR 3.5.0.880 and earlier versions for Windows, Adobe AIR 3.5.0.890 and earlier versions for Macintosh and Adobe AIR 3.5.0.880 for Android.  See Determine version | Adobe AIR runtime. 
• Beginning with Adobe Flash Version 11.3, the universal 32-bit installer will include the 32-bit and 64-bit versions of the Flash Player.  
• If you use the Adobe Flash Player Download Center, be careful to uncheck the optional McAfee Security Plus box.  It is not needed for the Flash Player update.
• Uncheck any toolbar offered with Adobe products if not wanted.
• If you use alternate browsers, it is necessary to install the update for both Internet Explorer as well as the update for alternate browsers.
• The separate 32-bit and 64-bit uninstallers have been replaced with a single uninstaller.

Adobe Flash Player for Android

The latest version for Adobe Flash Player for Android is available by downloading it from the Android Marketplace by browsing to it on a mobile phone.

Verify Installation

To verify the Adobe Flash Player version number installed on your computer, go to the About Flash Player page, or right-click on content running in Flash Player and select "About Adobe Flash Player" from the menu. 

Do this for each browser installed on your computer.

To verify the version of Adobe Flash Player for Android, go to Settings > Applications > Manage Applications > Adobe Flash Player x.x.

References

• Adobe Priority Ratings
• Adobe Security Advisory: Security updates available for Adobe Flash Player
• Release Notes:  Flash Player® 11.5 AIR® 3.5

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Java Zero-Day (Again), Time To Disable/Remove Java

To contact us Click HERE
Tweet This


Once again there are reports of a Java zero-day vulnerability being actively exploited in the wild.  All versions of Java are impacted, including the most recent release, JRE 7, Update 10.

With any version of Java installed on your computer, visiting a malicious link can result in a serious malware infection.  Significantly, the exploit is not operating system and, although currently targeting Windows systems, can also run the same code on Mac OS X or Linux.

Edit Note:  The recent Java update 11 did little other than adjust the settings to the Java Control Panel.  Additional vulnerabilities have been found in that latest Java update.  See Java, The Never-Ending Saga for additional information on removing or disabling Java. 

Recommendations

1.  Uninstall Java. 

First and foremost, most home computer users do not need Java installed on their computer.  In the past, Java was needed for websites to be properly displayed. However, that is generally not the case now.  I uninstalled Java several years ago and have not had a need for it.

To remove Java, navigate to Control Panel\All Control Panel Items\Programs and Features (Add/Remove Programs on Windows XP). Select for removal all instances of Java, including:

Java 7 Update 10 (or earlier)
Java Auto Updater
JavaFX 2.2.4 (or earlier)

Confirm that the folders shown below have also been removed.  If not, delete the folders manually.

C:\Program Files\Java
C:\Users\%UserName%\AppData\LocalLow\Sun

2.  Disable Java

The update to Java JDK 7u10 includes the option to disable Java in the browser.  Thus, if you have a business need to use Java, play online games or use OpenOffice, disable Java.  All you need to do is uncheck the box "Enable Java content in the browser" in the Java Control Panel.

(Image via Sophos Naked Security Blog)

In the event Java is needed for software installed on your computer, there should be a prompt for it.  In that situation, launch the Java Control Panel and re-check the option to enable Java.  Then, remove the check again when finished.

References

• Protect against latest Java zero-day vulnerability right now: Mal/JavaJar-B | Naked Security
• Nasty New Java Zero Day Found; Exploit Kits Already Have It | threatpost
• Kill that Java plugin now! New 0-day exploit running wild online • The Register

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Out-of-Band Oracle Java Critical Security Update Released

To contact us Click HERE
Tweet This




 The advice of the U.S. Department of Homeland Security, US-CERT, security software vendors and others advising that Java be uninstalled appears to have spurred the early release of an out-of-band security update for Java SE.

Ahead of the Critical Patch Update Pre-Release Announcement which had the update scheduled for Tuesday, January 15, 2013, the update for Java version 7 update 11 has been released.

Edit Note:  Additional vulnerabilities have been found in the latest Java update, which did little other than adjust the settings to the Java Control Panel.  See Java, The Never-Ending Saga for additional information on removing or disabling Java.

If you uninstalled Java, consider that you really may not need it on your computer.  On the other hand, if there are programs you use or websites that you visit that require Java, it is strongly advised that the update be applied as soon as possible.  

Java Security Recommendations

1)  In the Java Control Panel, set the security to high.
2)  Keep Java disabled until needed.  Uncheck the box "Enable Java content in the browser" in the Java Control Panel.

(Image via Sophos Naked Security Blog)

3)  If you use Firefox, install NoScript and only allow Java on those sites where it is required.

Instructions on removing older (and less secure) versions of Java can be found at http://java.com/en/download/faq/remove_olderversions.xml

Download Information

Download link:  Java Version 7 Update 11

Verify your version:  http://www.java.com/en/download/testjava.jsp

Note: UNcheck any pre-checked toolbar and/or software options presented with the update. They are not part of the software update and are completely optional.

Critical Patch Updates

For Oracle Java SE Critical Patch Updates, the next scheduled dates are:

• 19 February 2013
• 18 June 2013
• 15 October 2013

References

• Java SE 7 Update Release Notes
• Critical Patch Updates, Security Alerts and Third Party Bulletin 
• Oracle Critical Patch Update Pre-Release Announcement - January 2013
• Oracle Security Alert CVE-2013-0422

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Advance Notification for Update to Address Security Advisory 2794220

To contact us Click HERE
Tweet This


On Monday, January 14, 2013, Microsoft is planning to release an out-of-band critical security update for the issue described in  Security Advisory 2794220.

The update is to address an issue that affects Internet Explorer versions 6, 7 and 8.  Internet Explorer versions 9 and 10 are not affected. 

Although Microsoft has seen only a limited number of customers affected by the issue, the potential exists that more could be affected.  Thus, it is advised that the update be installed as soon as possible. 

Even with the update, if your operating system is Windows Vista or Windows 7, update to Internet Explorer 9.  For Windows XP, your system will be more secure if you update to Internet Explorer 8.

If you applied the Fix it released in Security Advisory 2794220, it will not need to be uninstalled before applying the security update.

References

• MSRC Blog:  Advance Notification for Update to Address Security Advisory 2794220
• Tech Net Advisory: Microsoft Security Advisory (2794220) Vulnerability in Internet Explorer Could Allow Remote Code Execution

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Mozilla Firefox 18.0.2 Release Includes Massive Bug Fixes

To contact us Click HERE
Tweet This



Firefox 18.0.2 was sent to the release channel today by Mozilla.  Although this update does not include any security updates, the massive list of bug fixes suggests that it is advisable to install this update sooner rather than later.

Update:  Thanks to a tip from a friend, I discovered that the update to version 18.0.2 added a check to the option to allow 3rd party cookies.  If you, like me, do not want to accept 3rd party cookies, you can reverse the change at Firefox > Options > Privacy.

What's New

• FIXED --18.0.2: Fix JavaScript related stability issues
• FIXED --18.0.1: Problems involving HTTP Proxy Transactions (Associated bugs)
• FIXED --18.0.1: Unity player crashes on Mac OS X (bug 828954)
• FIXED --18.0.1: Disabled HIDPI support when using external monitors to avoid rendering glitches (bug 814434)
• NEW --Faster JavaScript performance via IonMonkey compiler
• NEW --Support for Retina Display on OS X 10.7 and up
• NEW --Preliminary support for WebRTC
• CHANGED --Experience better image quality with our new HTML scaling algorithm
• CHANGED --Performance improvements around tab switching
• DEVELOPER --Support for new DOM property window.devicePixelRatio
• DEVELOPER --Improvement in startup time through smart handling of signed extension certificates
• HTML5 --Support for W3C touch events implemented, taking the place of MozTouch events
• FIXED --Disable insecure content loading on HTTPS pages (62178)
• FIXED --Improved responsiveness for users on proxies (769764)

View the incredibly long list of Bug Fixes for version 18.0.2 in the link listed below.

Update

To get the update now, select "Help" from the Firefox menu at the upper left of the browser window, then pick "About Firefox."  Mac users need to select "About Firefox" from the Firefox menu.

If you do not use the English language version, Fully Localized Versions are available for download.

References

• Common questions after updating Firefox
• Security Updates
• Mozilla Firefox Release Notes
• Bug Fixes 

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

MS13-008 Released for Security Advisory 2794220

To contact us Click HERE
Tweet This


Microsoft released an out-of-band security update to address the issue described in  Security Advisory 2794220.

The update is to address an issue that affects Internet Explorer versions 6, 7 and 8.  Internet Explorer versions 9 and 10 are not affected.  

This update is critical if you have Internet Explorer versions 6, 7 or 8 installed on your computer.  Windows XP users of IE6 or IE7 should update to IE8 as soon as possible.  Windows Vista and Windows 7 users should be using IE9.

Note:  The Advance Notice for this update to Internet Explorer versions 6-8 indicated if the Microsoft Fix it was applied, it was not necessary to uninstall it prior to updating IE. 

The advice provided now is to disable the Fix it after updating as it is no longer required.

	Disable
	Fix this problem       Microsoft Fix it 50972

References:

• MSRC Blog:  MS13-008 Released for Security Advisory 2794220
• Microsoft Security Bulletin MS13-008 - Critical : Security Update for Internet Explorer (2799329)]

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Mozilla Firefox 18.0.1 Released

To contact us Click HERE
Tweet This



Firefox 18.0.1 was sent to the release channel today by Mozilla to solve several bugs. 

What's New

• FIXED -- 18.0.1: Problems involving HTTP Proxy Transactions (Associated bugs)
• FIXED -- 18.0.1: Unity player crashes on Mac OS X (bug 828954)
• FIXED -- 18.0.1: Disabled HIDPI support on external monitors to avoid rendering glitches (bug 814434)

The Release Notes include additional changes and fixed features in version 18.  For a complete note of all fixes, see the Bug Fixes in the link below in References.

Update

To get the update now, select "Help" from the Firefox menu at the upper left of the browser window, then pick "About Firefox."  Mac users need to select "About Firefox" from the Firefox menu.

If you do not use the English language version, Fully Localized Versions are available for download.

References

• Common questions after updating Firefox
• Security Updates
• Mozilla Firefox Release Notes
• Mozilla Security Blog:  Revoking Trust in Two TurkTrust Certificates
• Bug Fixes 

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...