2

Ubuntu Linux makes it easy to install Flash as soon as you encounter it. Just like Firefox on Windows really! Using Ubuntu's package it even provides security updates through the standard OS method[1].

But is Flash confined on Ubuntu, i.e. using AppArmor?

Because if Ubuntu doesn't provide any confinement, it's less protected than on Windows :(.


[1] Instead of Adobe code that tricks you into installing Chrome or Google toolbar or something, deterring you from installing necessary security updates.

Note this is specific to Ubuntu. Debian don't provide an automatic updater, <facepalm>. OTOH Debian doesn't make it as easy to install in the first place.

  • 2
    The better way to fight against Flash vulnerabilities is to stop using flash altogether, as advised by some websites encouraging people to try to disable the module and see. It all depends upon personal requirements of course, but the usual need to access media streaming websites (whether it is online radio or video streaming) can be natively fulfilled by newer browsers (HTML 5 support and so on). Flash is then just a bad habit to be forgotten and the world will be better... – WhiteWinterWolf Jul 18 '15 at 8:12
  • UK -> BBC iPlayer. They have some questionable tech decisions :(. – sourcejedi Jul 18 '15 at 11:07
  • Yes, that's why the article mentions that Alex Stamos asked Adobe to set an end-of-life date or Flash. – WhiteWinterWolf Jul 18 '15 at 12:44
  • It was the same story before with Java web plugins: they were used to play media, add animations, interactivity, etc. to websites but also brought a lot of insecurity as a side effect. Now we managed to nearly get rid of this (AFAIK Java web plugins are mostly limited to some specific corporate web applications), next step will be to get rid of Flash the same way... – WhiteWinterWolf Jul 18 '15 at 12:47
1

Usually Flash exploits need to be specifically targeted at an OS (Linux v.s. Windows v.s. whatever). An attacker can choose to shove as many into one exploit, which would likely cause suspicion if my exploit crashes while exploiting, or make something reliable, I can use and re-use. This means the law of averages: "How many people use Windows, and how many use Linux. Where would my exploit yield better results?" If I am not specifically targeting you per-se.

Flash is usually used to deliver another payload. Whether or not the payload is specifically aimed at Windows, is what is relevant. Most Flash based exploits on their own (non payload deliverable) still need to be specifically targeted at you. Let's look at an advisory:

CVE-2014-8441

Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0576, CVE-2014-0581, and CVE-2014-8440.

If I as an attacker tried to make an exploit to send to you, there are multiple ways to get it to you. But here are the hurdles I would face trying to exploit you.

  • Step 1) create shellcode to do the harm I need to do
  • Step 2) obfuscate this shellcode so it is not detected by AV

Before I even do this, I have an altogether different choice... Pick my target to exploit: Will I focus on Linux, or Windows?!? Because each is a different operating system, my payloads will differ.


IOW you're confusing how attackers use Flash to exploit an operating system. Flash is usually nothing more than a vehicle to deliver something more malicious.

ANALOGY

Imagine if you can a country named Chickenphobia where everyone is allergic to chickens. If anyone comes in contact with a chicken, they will become sick. Now imagine a bus, airplane, boat or truck delivering Chickens (with the intentions of making people in Chickenphobia sick) to the wrong town. The vehicles (bus, truck, boat, train, plain) are Flash. It is nothing more than a delivery mechanism.

-- END OF ANALOGY

  • Feel free to provide question edits to make it less over-broad. You're not wrong (though pushing this as a reason to switch, as ubuntu.com does, is I think questionable). But if you admin systems - which I do - you're a higher-value target and the math changes. There's a judgement, and there's the facts. The main question I was looking up here was the facts. – sourcejedi Dec 19 '14 at 23:03
  • 1
    Those are facts: Using Flash on Ubuntu does not equate to being any more exploitable than it would on Windows. If you admin systems, you would have proper patch management procedures in place, with defense in depth to worry even less about Flash on Linux. – munkeyoto Dec 19 '14 at 23:07
  • Just because I admin systems doesn't mean I'm perfect! A friend does commercial webdev - i.e. he has admin access to websites. His workstation's on Firefox/Ubuntu; there's not any extra security. I don't think it's a high risk. But there's obviously some point where it'd become a problem. So where's the line between the two? If you don't consider those judgements, you won't find the lines. – sourcejedi Dec 19 '14 at 23:25
  • IOW. Those are nice buzzwords. Someone defined them from first principles. If I can't follow their working out, I can't assess new claims (ex. from marketing of alleged security solutions). – sourcejedi Dec 19 '14 at 23:39
0

Ubuntu Linux makes it easy to install Flash as soon as you encounter it.

Things have changed since. Nowadays, even when it is installed, Flash is disabled by default. If you are talking only about Flash player plugin and security then you need to know it is no longer recommended (Facebook calls for end to Flash as Firefox blocks it over hacking holes). HTML5 is the recommended technology instead (Comparison of HTML5 and Flash)

  • I'm not sure I was right that "Ubuntu makes it easy to install Flash", which was the initial premise for my concern. But to nitpick - is there really a system that disables Flash by default?! I think you're thinking of "known-vulnerable" versions being blacklisted in Firefox. Once you have an up-to-date version with security fixes, it's enabled by default. – sourcejedi Sep 17 '15 at 9:54
  • Yes, I am running Ubuntu and Kali Linux: both of them are disabling Flash by default because the browsers vendors decided so @sourcejedi – user45139 Sep 17 '15 at 9:58
  • Firefox decided to disable Flash? What's the enable method? I would have assumed what you're seeing is that Flash isn't installed by default. Which is generally true for both Linux and Windows installs of Firefox, including Ubuntu of any version. As I say, my concern mainly arose from how easy Flash was install - which I'm no longer so sure about. – sourcejedi Sep 18 '15 at 21:09
-1

Yes. Flash is unconfined on Ubuntu (by default).

https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/AppArmorProfiles

Also Flash NPAPI on Linux is a maintenance release. It's hard to tell whether it's getting backports for every new security feature.

http://googleprojectzero.blogspot.co.uk/2015/07/significant-flash-exploit-mitigations_16.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.