RealPlayer 6.0.12.775, fixes various vulnerabilites.

Today there's a new version of RealPlayer that fixes a bunch of critical vulnerabilies. The latest version is 6.0.12.775, although it's not always straightforward. One of the vulnerabilities is is CVE-20and I'm trying to understand this snippet10-2996, which was fixed today, but was reported 16 months ago:

• 2009-04-15 - Vulnerability reported to vendor
• 2010-08-26 - Coordinated public release of advisory

Overall, the vulnerabilites fixed in this version are:

• CVE-2010-2996, reported 2009-04-15
• CVE-2010-3001, reported 2009-12-04 
• CVE-2010-0116, reported 2010-02-11
• CVE-2010-0117, reported 2010-02-18
• CVE-2010-0120, reported 2010-02-23
• CVE-2010-3001, unknown date yet.

Secbrowsing can help you get the latest version. Disabling the plugin is also an option

Shockwave plugin v11.5.8, fixes 20 vulnerabilities from the past 15 weeks.

Adobe has released a version of Shockwave plugin today, Aug 24, 2010, that fixes 20 critical vulnerabilities in the plug-in: http://www.adobe.com/support/security/bulletins/apsb10-20.html. That's more than 1 vulnerability per week, since the last update of this plugin, on May 11, 2010, just 15 weeks ago. In a previous post we have some answers to common questions such as "What is Shockwave?"

Here's a timeline of the vulnerability reports that went into the latest release:

• May 11, 2010: 
• Shockwave 11.5.7 is released
• Unknown date: As of Aug 24, I could not find details for these vulnerability reports: 
• CVE-2010-2863
• CVE-2010-2864
• CVE-2010-2865
• CVE-2010-2868
• CVE-2010-2869
• CVE-2010-2880
• CVE-2010-2881
• CVE-2010-2882
• May 27, 2010: 
• CVE-2010-2866
• CVE-2010-2867
• CVE-2010-2870 example 
• Jun 30, 2010: 
• CVE-2010-2871
• CVE-2010-2872
• CVE-2010-2873
• CVE-2010-2874 example
• Jul 7, 2010: 
• CVE-2010-2875 example
• Jul 20, 2010: 
• CVE-2010-2876 example
• Aug 11, 2010:  
• CVE-2010-2877
• CVE-2010-2878
• CVE-2010-2879 example
• Aug 24, 2010: 
• Shockwave 11.5.8 is released

In this release, the plugin correctly identifies itself as v11.5.8 in Javascript, so SecBrowsing will start warning about Shockwave again, but once you update, the warning will go away.

---
Why update and disable plugins?
Exploits in the browser and its plugins are the most common way people's computers get malware. It happens simply by browsing to a site, without any user interaction. It can be triggered by

• Randomly browsing the web, landing on a site that has been hacked.
• Browsing a site that runs a malicious banner ad. The ad only needs to run for a few minutes on a popular site to get thousands of people infected.
• Following a URL sent by a friend, whose email/IM account was compromised. This can also be a targeted attack against your organization.

Most plugins have a really bad security history, and are not required for most websites. Disabling them is many times a good option.

Chrome's bundled Flash results in much faster update

Chrome's bundling of Flash resulted in a dramatic drop of out-of-date users after the latest update, according to our stats.

On Aug 10, 2010, Adobe released a security update for Flash. On the same day, Chrome shipped the security update to the bundled Flash plugin as well. SecBrowsing started warning about the new version of Flash, as well as the new version of the Quicktime plugin (7.6.7) on Aug 13, 2010.

We compared the number of users with up-to-date Flash, as well as the traffic to our site around the past two releases of Flash (10.1.82 on Aug 10 and 10.1.53 on June 10), and the difference is significant in both cases.

Visitors with out-of-date Flash

Graph 1: Percentage of users running out-of-date Flash on the last two security releases. For the latest release, within 2 days, fewer than 30% of Chrome users were running an out-of-date Flash.  In comparison, it took 14 days for this to happen in the previous release.

Total visitors

This method is less accurate, because many visitors came to the site because of either Flash or Quicktime (see below)  -- but the results are still significantly different than before. 

Graph 2: The relative traffic to our site around the two releases of Flash. For the first release (of 10.5.53), it took 16 days for traffic to come down to within 25% of normal, but for the latest one (of 10.1.82), only 6 days. This would have been even lower if there wasn't an update for Quicktime about on the same day (about 40% of Chrome users also have Quicktime installed).  

Notes

We track visits to http://secbrowsing.appspot.com/. 98% of the website's traffic is "direct", i.e. from users of the SecBrowsing extension (when the extension shows a warning, users click on the "red plugin" which brings them to the website). Neither the website nor the extension track the visitors' plugins, with the exception of Flash, which is tracked by Google Analytics by default. (tip: you can try to reproduce Graph 1 on your site, if you use Google Analytics).

The traffic to the site is very steady, except when a new plugin version is released. About 50% of visitors are new and 50% are returning, and this ratio has remained stable since the beginning of 2010.



Disclaimer
I work on Google's Security team -- the views expressed on this blog are personal. 

How to update Adobe Reader

Update, Sept 10: Download the latest version of Adobe Reader (9.3.4) here.

Usually secbrowsing links to the installer of the latest version for vulnerable plugins. However, the latest version Adobe Reader (9.3.4) is not always available for download directly until August 31, 2010.

Meanwhile, please update your Reader plugin, using one of the following two options:

Trigger an update yourself:

• Open Adobe Reader 
• Start -> All Applications -> Adobe Reader -> Adobe Reader
• Click on the "Help" menu
• Click on the "Check for Updates" menu item.

Or, download the incremental patch for 9.3.3:

• Download the incremental patch (9.3.3 to 9.3.4) here   
• Install the incremental patch by running it directly.
• If your current version of Adobe Reader is older than 9.3.3, you need to download it and install it  first at http://get.adobe.com/reader/

All versions of Adobe Reader 9.3.3 (and earlier versions) have critical vulnerabilities: http://www.adobe.com/support/security/bulletins/apsb10-17.html.

Comments and questions are welcome as always.

On Backward compatibility and security bugs

One of the 6 critical vulnerabilities reported on Aug 12, 2010 for Adobe Flash is CVE-2010-0209. US-CERT shares some interesting details:

Adobe Flash supports two main types of ActionScript, which is the scripting language for Flash. ActionScript 3.0 is supported by the ActionScript Virtual Machine 2 (AVM2), while previous versions are supported by the ActionScript Virtual Machine 1 (AVM1). Flash 9 and later provide both AVM versions for compatibility with both ActionScript varieties. The AVM1 implementation provided with Flash 10.1 contains a vulnerability...

Backward compatibility is the source of the security bug in this case. If the developers had only to maintain AVM2, this bug would have not emerged. Apparently, backward compatibility is a common source of security problems. In the first chapter of the book Beautiful Security, the author explains how the developers' psychology often contributes to overlook the security of the functionality that's only there for backward compatibility. In some cases, it's also just the accumulation of code. More code means more bugs, simply because the rate with which developers generate bugs is pretty much constant.

Some more examples
In general, supporting old formats is only a source for more security bugs -- even if, in theory, libraries that handle these old formats have matured. CVE-2010-0041 and CVE-2010-0042 from a recent iOS vulnerability report are caused by libraries handling BMP and TIFF images respectively. Another vulnerability in Adobe Reader for Windows, Mac and Unix (CVE-2010-0188) was again related to how Adobe Reader handles TIFF images.

Browser plugins

In a sense, a lot of the web browser plugins today are still around for backward compatibility. Many websites were built to stream audio or video with RealPlayer, Windows Media Player, or Quicktime. These days, most websites use Flash instead. 

In the new operating systems that have been introduced in the past 3 years, such as Apple's iOS, Android and ChromeOS, browser plugins are either completely unsupported or there is only limited support for them. You are probably familiar with the Apple/Adobe debate on Flash on iOS, and that Android, Chrome and ChromeOS support/bundle Flash. 

No matter what your position is on Flash's role on the web today, if you take Flash out of the picture, there is very low demand for porting the traditional plugins (Java, Windows Media, Shockwave, RealPlayer, DivX, Silverlight, Quicktime) to the modern OSes. Either via native apps, or by means of HTML5, services find ways to reach their audiences. 

Backward compatibility is everywhere

Old code (by definition) accumulates as time goes on. Why do Adobe Reader and iOS have support for TIFF, a standard first developed in the 1980s? Probably because nobody was encouraged to take the time to analyze its (lack of) usage, and support a case that it should no longer be supported. 

Even if your iOS, Android or future ChromeOS device is in theory a brand new OS, it is bundling code that's quite old, and is only getting older.

If you are a developer, think of dropping features that are only there for backward compatibility. Try to make a case that nobody uses them. My favorite argument is that, once we drop them, if users need them, they'll ask for them. How many iPhone would complain if their browser could not render BMP images? And out of the myriads of feature requests for the iPhone, how far on the top would this complaint rank?

If you can't eliminate old features, can you make them load on-demand? Maybe the user needs to run the program with a different configuration in order to get the old features. This way, you can protect the majority of users and still support the minority's needs. How many Flash movies run only on AVM1? Is it mostly sites built in 1995, and are these movies mostly their "intros"? In that case, disabling AVM1 could be thought of as a pretty good feature, actually :). 

As a user, take a minute and uninstall old software, old plug-ins and old browsers from your system. And keep the rest up-to-date with security updates.

Quicktime 7.6.7 security update for Windows

For 39% of all Chrome users on Windows who have the Quicktime plug-in install, it's time to update  -- version 7.6.7 fixes a critical security problem that allows all websites to take over your machine: http://support.apple.com/kb/HT4290

Download the latest version here http://www.apple.com/quicktime/download/ (no, don't give them your email, it's not required).

Or just disable the plugin and only enable it on pages you trust to show you Quicktime movies. Why have arbitrary pages including arbitrary third-party widgets attempt to show you (potentially malicious) movies?

The SecBrowsing page and our Chrome extension are already warning users with vulnerable versions. Chrome's "about:plugins" page should also show a warning, soon (Chrome beta, v6 and later).

Update: I expect this to be exploited pretty soon, as Metasploit has released sample exploit code already.

Google on browser and plugin attacks and defenses

Chris Evans of Google presented a talk on browser and plugin attacks. Ian Fette (also of Google) talked about the blacklisting approach and its value in browser security in the same talk (at 30:00).

Some interesting highlights:

• The plugin distribution for users of Chrome v4.1 is shared:
• 97%: Flash
• 86%: Adobe Reader
• 66%: Java (only 14% were fully uptodate)
• 53%: Windows Media Player
• 49%: Silverlight Plug-in
• 39%: Quicktime Plug-in
  
• The speaker has most of his plugins disabled, to reduce the vulnerability surface in his browser -- he recommends the same for users.
  
• Websites can request an old version of Java to be installed on the fly, basically allowing websites to put security holes in your system that you did not have. Java is so powerful that it's essentially impossible to sandbox, and its cross-platform capabilities means you can write an exploit once, and it will work on every OS. Only 14% of users were fully up-to-date with Java.
  
• All browsers are working on various defenses against these attacks, including sandboxing, warning about out-of-date plugins, or bundling some plugins so they can auto-update them. Ian talks extensively about the blacklist approaches (such as Google Safe Browsing on Firefox, Safari and Chrome, and SmartScreen Filter for IE8) to mitigate against zero-days, and social engineering malware.
  
• There's approximately 500,000 URLs in the Google Safe Browsing lists at any time, and the lists are delivered to hundreds of millions of users.
  
• About 50% of users ignore the phishing or malware warnings on Chrome, even though Google has very high confidence when it adds something on the lists, since it uses virtual machines to verify eg malicious websites.

Full video here

SecBrowsing becoming an official part of Chrome

Last month the Chrome team announced a number of security features regarding plug-ins, including the integration of the SecBrowsing features in the browser.  Here's the relevant snippet from the blog post (http://blog.chromium.org/2010/06/improving-plug-in-security.html): 

Protection from out-of-date plug-ins: Medium-term, Google Chrome will start refusing to run certain out-of-date plug-ins (and help the user update).

The blog post enumerates all the current and upcoming security features in Chrome regarding plugins: 

• More powerful plug-in controls
• Autoupdate for Adobe Flash Player
• Integrated, sandboxed PDF viewing
• Protection from out-of-date plug-ins
• Warning before running infrequently used plug-ins
• A next generation plug-in API

As of Chrome v6.0.466.0 (developer channel as of July 15, 2010), SecBrowsing is partly integrated in Chrome. In "about:plugins", any plugins missing security updates are shown with a warning and a link to get the latest version. There is no active warning anywhere yet, but that's definitely coming up soon.

Beyond SecBrowsing with Secunia

I've tested Secunia PSI, a free vulnerable software manager. I recommend it.

What is Secunia
It extends beyond SecBrowsing's checks for out-of-date browser plugins, and identifies known vulnerabilities in software such as media players, office, IM, Skype, and other  applications that don't run in your browser.

Why
Malicious attachments, sent over email or IM, can attack your applications. Vulnerabilities in internet-connected apps such as IM clients or Skype may allow attackers to install malware on your machine without any interaction. You really don't want to run applications with known security holes on your machine.

A review
Last week I had the chance to try it out on a PC. It took a while to scan the machine (see say about 5 minutes) but it identified various software that were unpatched, such as OpenOffice, Skype and VLC. In an ideal world, Secunia would also update this software for me. Or Windows! Anyway, it looks like something is in the works already for this.

I was glad (and kind of surprised actually) to see that as soon as I was able to update a certain application, secunia picked it up immediately and even notified me that it was now up-to-date. On the downside, it took me a lot of time and effort to update all the software.

Take OpenOffice, for example. Secunia says it's unpatched, what next? Start -> Programs -> OpenOffice ... I see apps like Writer, Spreadsheets, but no "updater" or anything. I took an educated guess and opened one of the applications (Writer). Help -> Check for Updates ... yes, that's it. 20 minutes later or so it has downloaded and installed the new version. Why so slow!

In any case, Secunia also has links to their forum, I'm sure they explain how to update your applications. Or maybe you can Google it. Auto-update sure sounds exciting.

I installed Secunia on my brother's machine, hoping he will act upon the warnings. I told my father to install it too, but I really really doubt he can act upon the warnings. It all boils down to automatic, silent updates. This should be the responsibility of the Operating System (Ubuntu, Android, iPhone OS all do this, to a certain degree), but not OS X or Windows, which makes third-party apps such as Secunia essential.

So Windows users, try out Secunia.

Latest Chrome brings sandboxed, auto-updated PDF support

With the latest Chrome version (developer channel for Windows and Mac for now: http://dev.chromium.org/getting-involved/dev-channel) Chrome provides native support for rendering PDF documents in a seamless, and more importantly, secure way: http://blog.chromium.org/2010/06/bringing-improved-pdf-support-to-google.html


According to the blogpost, PDF rendering will be contained within the security sandbox Chrome uses for web page rendering. Users will automatically receive the latest version of Chrome’s PDF support; they won’t have to worry about manually updating any plug-ins or programs.

The plug-in can be enabled by going to chrome://plugins/ and clicking on "Enable" for the "Chrome PDF Viewer" plug-in. While you are at it, I would recommend you disable any other PDF plugins.

Quicktime warnings on Mac Snow Leopard (10.6)

Executive summary: If you have Snow Leopard and Quicktime < 7.6.6, upgrade your OS to 10.6.3.

We've had quite a few reports on our extension homepage about Quicktime X, which is available only for Mac OS 10.6, and its incompatibility with Quicktime 7. The solution we offer (a link to download the latest version of Quicktime) is problematic.

A user reports:

Secbrowsing keeps telling me that I need to update my quicktime plugin for 7.6.3 to 7.6.4 though 7.6.4 is not available for my operating system OSX 10.6 (Snow Leopard).

One of our users has even shared a screenshot with us:

There's very little documentation about this on the web, so I thought I'd write something down about potential workarounds.

It seems like in 10.6.3, Quicktime 7 (and X) is bundled with the OS. This creates confusion when there's a security fix for Quicktime 7, but no apparent way to get the new version in OS 10.6.

I have not investigated previous security fixes (7.6.4, 7.6.5), but I have investigated 7.6.6:

The security fixes in 7.6.6 also went into the security fix for Snow Leopard: 10.6.3 http://support.apple.com/kb/HT4077. I've also verified that a newly bought 10.6 laptop reports "Quicktime 7.6.6" as a plugin in Chrome and Firefox. So if you have 7.6.5 or 7.6.3 or earlier on Snow Leopard, you can only get 7.6.6 by installing the Snow Leopard security updates.

Security Update: Flash 10.1 r53

http://secbrowsing.appspot.com/ was just updated to point to version 10.1 r53, which fixes several critical security vulnerabilies.

Flash and PDF zero-day, expect a new version soon.

http://www.zdnet.com/blog/security/adobe-warns-of-flash-pdf-zero-day-attacks/6606?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed:+zdnet/security+(ZDNet+Zero+Day)

Really, disable PDF from your browser. Also consider allowing Flash only for select websites ...

How to update / disable / uninstall Shockwave for Director

On Aug 24, 2010 a new set of critical vulnerabilities was fixed for Shockwave for Director. [http://www.adobe.com/support/security/bulletins/apsb10-20.html].

To Update Shockwave for Director:

• You can download the latest version at http://get.adobe.com/shockwave/
• The latest version is 11.5.8, and SecBrowsing can now detect this version accurately.

To disable Shockwave for Director:
On all platforms, in Google Chrome, you can disable the plugin:

• Type "about:plugins" (without the quotes) in your browser window
• Click "disable" on the plugin named "Adobe Shockwave for Director" (not Flash)

To uninstall Shockwave for Director:
Windows:

• Control Panel
• Add/Remove Programs
• Find Shockwave for Director (not Flash) and uninstall it. If you have an "ActiveX" and a "plugin" it's because they ship two different products, one for IE and one for Firefox/Chrome, so remove them both.

Mac:

• The installer also contains the uninstaller: 
• Save the uninstaller to your desktop and launch it (Shockwave_Uninstaller)

Some common questions I get asked about Shockwave:

• Do I have Shockwave for Director?
• Probably. According to Adobe, over "450 million desktops have installed Adobe Shockwave Player".
• Shockwave is the same Flash? 
• No. Adobe Flash is what we all know as Flash. Adobe Shockwave Player or Shockwave for Director is something else - completely unrelated.
• If I uninstall Shockwave, will my browsing experience be affected?
• Probably not, for the most part. See the discussion below from users who list a few sites that require Shockwave.
• Why does SecBrowsing keep telling me my Shockwave is out of date? I'm sure I just updated it.
• This is no longer the case as of 11.5.8. Please restart your browser, and the warning will go away.

Providing Warnings for Adobe Acrobat

We've recently started tracking version information for Adobe Reader. Versions before 9.3.2 did not export their version number so it was difficult to tell if the installed plugin was out-of-date or not. This means that if you're running a version of Reader older than 9.3.2 and using our Chrome Extension, you'll see an out-of-date message.

As mentioned in a previous post, older versions of Adobe Reader have critical security problems. Please download and install the newest version from http://get.adobe.com/reader. Note that you may need to launch Reader and run the Updater manually to force the upgrade from 9.3.0 to 9.3.2.

New Security Problems in Adobe Reader, new version.

According to a new security bulletin by Adobe, there's critical security problems in Adobe Reader, and you should update immediately to Adobe Reader 9.3.2 or 8.2.2


Adobe Reader users on Windows can also find the appropriate update here:
http://www.adobe.com/support/downloads/product.jsp?product=10&platform=Windows.

Adobe Reader users on Macintosh can also find the appropriate update here:
http://www.adobe.com/support/downloads/product.jsp?product=10&platform=Macintosh.

Adobe Reader users on UNIX can find the appropriate update here:
http://get.adobe.com/reader/.

A Java vulnerability & update

Yesterday, Oracle announced a new update for Java which fixes the serious vulnerabilities announced earlier this month. All Java versions prior to version 6 U20 are vulnerable and are being exploited in the wild.

For more information see: http://www.oracle.com/technology/deploy/security/alerts/alert-cve-2010-0886.html

Download the latest version of Java here: http://java.sun.com/javase/downloads/index.jsp

New QuickTime and Java vulnerabilities & updates

Yesterday, Apple announced multiple vulnerabilities in QuickTime and provided a new update (7.6.6).  This update fixes vulnerabilities which, "may lead to an unexpected application termination or arbitrary code execution". For more information see Apple's announcement: http://support.apple.com/kb/HT4104.

Java also announced that they found and fixed 27 new security related bugs in their newest version of Java (6 U19). From Oracle's website: "Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply CPU fixes as soon as possible. This Critical Patch Update contains 27 new security fixes across all products.". For more information see: http://www.oracle.com/technology/deploy/security/critical-patch-updates/javacpumar2010.html

We have updated SecBrowsing to warn users that run earlier, vulnerable versions of QuickTime and Java plugins in their browser.

How to disable plugins in Chrome

Disable specific plugins

1. Type "about:plugins" in the address bar of Chrome, and hit enter.
2. In the list of plugins that appears, disable the ones you don't recognize and need. 

[Advanced] Disable all plugins, and allow specific sites only

1. Click the Tools (wrench) menu.
2. Options.
3. Under the Hood.
4. Content settings in the "Privacy" section.
5. Plug-ins tab.
6. Select "Do not allow any site to use plug-ins." You can make exceptions for specific websites by clicking Exceptions.
7. Click Close to save your setting.

New Adobe Reader vulnerability, open Adobe Reader -> Help -> Update.

Quoting http://www.adobe.com/support/security/bulletins/apsb10-07.html

A critical vulnerability has been identified in Adobe Reader 9.3 and Acrobat 9.3 for Windows, Macintosh and UNIX, [...] As described in Security Bulletin APSB10-06, this vulnerability (CVE-2010-0186) could subvert the domain sandbox and make unauthorized cross-domain requests. In addition, a critical vulnerability (CVE-2010-0188) has been identified that could cause the application to crash and could potentially allow an attacker to take control of the affected system.

Adobe recommends users [...] update to Adobe Reader 9.3.1.

Note that this allows any website you visit to take over your machine, it's not required that you eg open a bad PDF file that was emailed to you, websites embed evil PDFs all the time (especially hacked websites).

SecBrowsing does not track Adobe Reader yet because its version is not exposed in the browser. So please go ahead and update Adobe Reader manually:

• Launch Adobe Reader
• Help
• Check for Updates