1177214 - (CVE-2015-3113) Blocklist vulnerable versions of Flash Player plugin (18.0.0.194 and lower)

Status: RESOLVED FIXED

(Toolkit :: Blocklist Policy Requests, defect)

Description

[Jorge Villalobos [:jorgev] (he/him)]

New versions of the Flash Player plugin have been released in response to a 0-day disclosure: https://helpx.adobe.com/security/products/flash-player/apsb15-14.html

From the bulletin:

> Adobe recommends users update their product installations to the latest versions:
> * Users of the Adobe Flash Player Desktop Runtime for Windows and Macintosh should update
> to Adobe Flash Player 18.0.0.194.
> * Users of the Adobe Flash Player Extended Support Release should update to Adobe Flash 
> Player 13.0.0.296.
> * Users of Adobe Flash Player for Linux should update to Adobe Flash Player 11.2.202.468.

We need to block versions lower than those listed above.

Comment 1

[Jorge Villalobos [:jorgev] (he/him)]

The blocks have been staged:

Flash Player Plugin 13.0.0.269 to 13.0.0.295 (click-to-play) 
https://addons-dev.allizom.org/en-US/firefox/blocked/p730

Flash Player Plugin 16.0.0.305 to 18.0.0.193 (click-to-play)
https://addons-dev.allizom.org/en-US/firefox/blocked/p732

Flash Player Plugin on Linux 11.2.202.442 to 11.2.202.467 (click-to-play)
https://addons-dev.allizom.org/en-US/firefox/blocked/p734

Kamil, can you test these blocks or know who should do this?

Comment 2

[Kamil Jozwiak [:kjozwiak]]

Jorge, I'm getting the following link which doesn't exists when selecting "Update Now" once the plugin has been blocked:

* https://blocklist.addons.mozilla.org/en-US/firefox/blocked/p732

I'm guessing this is because the links are still being hosted under https://addons-dev.allizom.org. Is checking the end of the URL (example, making sure the correct P# is being used) sufficient enough relating to the link portion of testing?

Comment 3

[Kamil Jozwiak [:kjozwiak]]

I went through Win 8.1 and everything was working. However I did find Bug # 1177283. I'll complete the rest of the testing after today's dinner (Whistler).

Comment 4

[Jorge Villalobos [:jorgev] (he/him)]

(In reply to Kamil Jozwiak [:kjozwiak] from comment #2)
> Jorge, I'm getting the following link which doesn't exists when selecting
> "Update Now" once the plugin has been blocked:
> 
> * https://blocklist.addons.mozilla.org/en-US/firefox/blocked/p732
> 
> I'm guessing this is because the links are still being hosted under
> https://addons-dev.allizom.org.

That's correct.

> Is checking the end of the URL (example,
> making sure the correct P# is being used) sufficient enough relating to the
> link portion of testing?

That's sufficient. You can also change extensions.blocklist.itemURL accordingly, in order to be able to test the whole experience.

Comment 5

[Kamil Jozwiak [:kjozwiak]]

Windows 8.1 x64:
================

* Channel Used: http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2015-06-24-08-04-16-mozilla-central/

Vulnerable:

* loaded several flash video's in non-e10s/e10s and ensured they where being correctly blocked

File: NPSWF32_18_0_0_160.dll
Path: C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_160.dll
Version: 18.0.0.160
State: Enabled (STATE_VULNERABLE_UPDATE_AVAILABLE)
Shockwave Flash 18.0 r0

File: NPSWF32_17_0_0_188.dll
Path: C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_188.dll
Version: 17.0.0.188
State: Enabled (STATE_VULNERABLE_UPDATE_AVAILABLE)
Shockwave Flash 17.0 r0

Working:

File: NPSWF32_18_0_0_194.dll
Path: C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_194.dll
Version: 18.0.0.194
State: Enabled
Shockwave Flash 18.0 r0

Ubuntu 14.04.2:
===============

* Channel Used: http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2015-06-25-00-40-07-mozilla-aurora/

Vulnerable:

* loaded several flash video's in non-e10s/e10s and ensured they where being correctly blocked

File: libflashplayer.so
Path: /usr/lib/mozilla/plugins/libflashplayer.so
Version: 11.2.202.466
State: Enabled (STATE_VULNERABLE_UPDATE_AVAILABLE)
Shockwave Flash 11.2 r202

File: libflashplayer.so
Path: /usr/lib/mozilla/plugins/libflashplayer.so
Version: 11.2.202.460
State: Enabled (STATE_VULNERABLE_UPDATE_AVAILABLE)
Shockwave Flash 11.2 r202

Working:

File: libflashplayer.so
Path: /usr/lib/mozilla/plugins/libflashplayer.so
Version: 11.2.202.468
State: Enabled
Shockwave Flash 11.2 r202

OSX 10.10.4:
============

* Channel Used: http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/38.0.5/mac/en-US/

Vulnerable:

* loaded several flash video's in non-e10s/e10s and ensured they where being correctly blocked

File: Flash Player.plugin
Path: /Library/Internet Plug-Ins/Flash Player.plugin
Version: 18.0.0.160
State: Enabled (STATE_VULNERABLE_UPDATE_AVAILABLE)
Shockwave Flash 18.0 r0

File: Flash Player.plugin
Path: /Library/Internet Plug-Ins/Flash Player.plugin
Version: 17.0.0.188
State: Enabled (STATE_VULNERABLE_UPDATE_AVAILABLE)
Shockwave Flash 17.0 r0

Working:

File: Flash Player.plugin
Path: /Library/Internet Plug-Ins/Flash Player.plugin
Version: 18.0.0.194
State: Enabled
Shockwave Flash 18.0 r0

Summary:
========

* Bug # 1177283 created (Flash appearing as "Disabled" even though not vulnerable under non-e10s window in Nightly/Aurora)
* Flash 18.0.0.160 & 17.0.0.188 is being pointed to p94 rather than p732 on OSX 10.10.4 (reproduced twice)
** https://blocklist.addons.mozilla.org/en-US/firefox/blocked/p94

Jorge, other than the two issues mentioned under the summary portion, everything seems to be working correctly. The one that is directly affecting this ticket is that on OSX, 18.0.0.160 & 17.0.0.188 are being pointed to p94 rather than p732.

Comment 6

[Jorge Villalobos [:jorgev] (he/him)]

The second issue sounds related to bug 1129287, but I can't be sure. I'll check with Release Drivers tomorrow about pushing this block live.

Comment 7

[Kamil Jozwiak [:kjozwiak]]

We should probably push the blocklist first thing tomorrow. Looks like it's been packaged into the Magnitude exploit kit and infecting users as cryptoransomware:
 
* https://nakedsecurity.sophos.com/2015/06/29/latest-flash-hole-already-exploited-ransomware/

Comment 8

[Jorge Villalobos [:jorgev] (he/him)]

Pushed live:

Flash Player Plugin 13.0.0.269 to 13.0.0.295 (click-to-play) 
https://addons.mozilla.org/en-US/firefox/blocked/p928

Flash Player Plugin 16.0.0.305 to 18.0.0.193 (click-to-play)
https://addons.mozilla.org/en-US/firefox/blocked/p930

Flash Player Plugin on Linux 11.2.202.442 to 11.2.202.467 (click-to-play)
https://addons.mozilla.org/en-US/firefox/blocked/p932

Comment 9

[mainhack]

Firefox now disables version 17.0.0.190 as well but this version seems to be fixed for CVE-2015-3113 according to Adobe:
https://helpx.adobe.com/flash-player/release-note/fp_18_air_18_release_notes.html#id_62973
There is 17.0.0.190 listed with the other newest versions on June 23rd for APSB15-14.

However, Adobe doesn't list v17 in the linked bulletin at all.
http://helpx.adobe.com/security/products/flash-player/apsb15-14.html

Do they just want to abandon v17'a appearance or is it still unfixed even though it was realeased together with the "known" fixed versions?

Comment 10

[Jorge Villalobos [:jorgev] (he/him)]

(In reply to mainhack from comment #9)
> Do they just want to abandon v17'a appearance or is it still unfixed even
> though it was realeased together with the "known" fixed versions?

I just followed the security bulletin for the blocks. I don't know their reasons, but I'll stick to what the bulletin says. People should be updating to the latest version anyway. If they want an extended support branch they should be using the 13.* one.

Comment 11

[Enon]

The "update now" link in the Flash entry in the add-ons manager does not go to where it should. It links to: https://blocklist.addons.mozilla.org/en-US/firefox/blocked/p930 , which just says that the add-on has been blocked.

Comment 12

[Kamil Jozwiak [:kjozwiak]]

(In reply to Enon from comment #11)
> The "update now" link in the Flash entry in the add-ons manager does not go
> to where it should. It links to:
> https://blocklist.addons.mozilla.org/en-US/firefox/blocked/p930 , which just
> says that the add-on has been blocked.

AFAICT, that's the expected behavior. When users click on "Update Now", it will take them to a page that will summarize why the plugin has been blocked. Clicking on the "plugin check page" link under the "Why was it blocked?" summary will take users to Mozilla's Plugin Check site where the user will be pointed to the correct site(s) for updates. (https://www.mozilla.org/en-US/plugincheck/)

Comment 13

[Robert Kaiser]

(In reply to Kamil Jozwiak [:kjozwiak] from comment #12)
> AFAICT, that's the expected behavior. When users click on "Update Now", it
> will take them to a page that will summarize why the plugin has been
> blocked.

It might be "expected" in terms of how the code is designed, but it's not expected by the user and results in bad UX. Do you know if we have bugs filed for that?

Comment 14

[Kamil Jozwiak [:kjozwiak]]

(In reply to Robert Kaiser (:[e-mail]) from comment #13)
> (In reply to Kamil Jozwiak [:kjozwiak] from comment #12)
> > AFAICT, that's the expected behavior. When users click on "Update Now", it
> > will take them to a page that will summarize why the plugin has been
> > blocked.
> 
> It might be "expected" in terms of how the code is designed, but it's not
> expected by the user and results in bad UX. Do you know if we have bugs
> filed for that?


Bug # 798176, CC'd Jorge and yourself if you two want to jump into the conversation :)