Shockwave vulnerability - APSB10-12, who's really affected?

Hello,
In light of the recent update to the Adobe Shockwave player, 11.5.7.609, due to a critical vulnerability, I'm trying to identify whether non-admin users would be affected. If they don't have rights to run certain processes, would they need to patch?
The reason I ask is that in our organization we have a number of users, without admin rights, who we've installed the Adobe Shockwave player for, and are currently on version 11.5.6.606, or an earlier release. If they will not be affected by the exploits because they lack admin rights, we may change our approach on who we update, as it will be a manual process. We run in a Windows and Mac environment.
Thank you,
Jason

I cannot give you a direct answer to your question, and – as this is a user-to-user forum – you will probably not get an official reply from Adobe here.
However, you write "due to a critical vulnerability" – this is not exactly the case.  Looking at http://www.adobe.com/support/security/bulletins/apsb10-12.html I count no less than 18 critical vulnerabilities.
I do not know how likely any users may fall prey to any of these vulnerabilities, but if it was my organization, I would upgrade all users as soon as possible.

Similar Messages

  • I partially downloaded microsoft office to my mac. Its has really affected my mac and I want to remove it completely, I can't find it anywhere to remove it, please can someone help

    Hi. I partially downloaded microsoft office for mac, It has really affected my mac and I need to get rid of it completely. I cant find it anywhere to remove it. Please can someone help???

    How can a partially downloaded program affect your computer? If you don't find it in the Download folder or wherever you download to, then it's not on your computer.

  • I'm having problem  with my icloud account,I don't have access to the email i once used to set up my icloud account,this is really affecting me,I can't backup and restore anything from my phone and device..anybody can help?

    I'm having problem  with my icloud account,I don't have access to the email i once used to set up my icloud account,this is really affecting me,I can't backup and restore anything from my phone and device..Can somebody help?

    Hi Maastricht2014,
    Until and unless you remember the password to your old email address, you will not be able to access the eBooks as those eBooks are only authorized with your old email address only.
    The only workaround or alternative to access your eBooks will be to contact the eBook vendor and ask them to migrate the eBook from your old email to the new one.
    Hope that Helps!
    ~ Arpit

  • Does bending of iphone 6 really affect my phone?

    does bending of iphone 6 really affect my phone?

    With normal use, no.
    Don't subject it to abnormal amounts of pressure and you'll be fine.
    ~Lyssa

  • Who is really doing 802.1x wired

    I am creating a lab environment to test 802.1x prior to implementing it into production.
    I wanted to know what is the pros and cons of this security feature at layer 2?
    How does it really work behind the scenes?
    The reason why i want to implement this feature/function is becuase I'm just one of two network administrators who manage well over 800 networking device (totally cisco shop) and 62 remote sites, and we struggle with the moves, adds, and changes, port vlan assignment (management), users moving there workstations, users moving there voip phones, etc. If anyone can speak on implementing 802.1x wired in a medium to large large network i will be happy to hear about the real life pros and cons

    We implemented 802.1x in my previous company (similar size as yours)
    You are right it can brings lot of problems.
    Before we deployed management solution Cisco LMS 3.0... It really helped us with configuration, config backup, network overview, discrepancy reports, user tracking, troubleshooting (get rid of fake hubs etc..) ... It cleaned our network and saved lot of time .. I suggest to have good management solution before you move to 802.1x
    We also separated devices what are not able to authenticate via 802.1x (printers, faxes) to separate VLAN
    Than we started in one segment (vlan) which was most stable (no changes, no moves)...
    It worked fine.. Than we smoothly moved to other vlans step by step..
    The true is that it took lot of time (one of my colleagues was working only on this project for some time).. But we managed it and it works fine.. It would also asked your cisco vendor for consultancy and help
    Hope that helps
    M.

  • Is there anyone in this group who would really help me out...

    i need the output in alv.....anyone in this group plz help!!
    Selection Screen:
    Sales Org:
    Sales document number:
    YearPeriod: (Range) ( Mandatory) – YYYYMM to YYYYMM
    Output (Radio button)
    -     Screen
    -     Download
    Report Output:
    Sales Org:
    Sales Doc number:
    Forcast ID number:
    Sales Document Type:
    Net Value:
    Currency:
    Program Flow:
    1) Read Function modules FIRST_DAY_IN_PERIOD_GET and LAST_DAY_IN_PERIOD_GET to ge the first and last  dates of the periods entered on the selection screen. Here Year = First 4 characters and Period = Next two characters of YearPeriod field of the selection screen.
    2) Read VBAK and filter all the sales documents where VBAK - AUART is ZJE or ZJR and VBAK – AUDAT in the first and last dates of the periods detrmined from the above step.
    3) For Each of the sales documents disply the following on the output
      - Sales Org: VBAK – VKORG ( Display on the output)
      - Forcast ID Number: Read function module “READ_TEXT” where ID = Z001, Object = VBBK to get the Forcast ID. Display it on the output.
      - Sales Document Type: VBAK-AUART
      - Net Value: VBAK-NETWR
      - Currency : VBAK-WAERK
    3) For Each of the sales documents with VBAK-AURT = ZJE check the “Revenue amount in TC” in ZBLRV. Replace the vlaue VBAK-NETWR with REVTC and display the value in the report output.

    this requirement looks very familiar. I already wrote a report for Minas....and something, last night, and now you have the same requirement? Strange......Are you working on the same project 'together'?

  • I need help understanding the issues on why i can not download the latest version of shockwave player. this affecting all of my game play on any game i attemt to run.

    is there anyone who may be able to help with the issues at hand? my current version of shockwave crashes at will! this is affecting any and all games i try to run. i have tried several times to download the latest version with no luck. if there is something i have done wrong, or something i have not done...please feel free to direct the right course of action.

    See my response to your other question

  • Are we really vulnerable for plugins?

    Are we really vulnerable... or is the admonition to perform updates a catchall for out-of-date plugins? What I mean is, do these plugins really miss a new vulnerability every other week, or is the term "vulnerable" used to mean that there is a newer release available and you should just update it later, because maybe this release fixed something.
    I really want to know when cyber creeps have unleashed a new round of havoc via bad code in the plugins. However, I don't have the time to chase updates in Acroread or Java every week. Besides, after every series of updates, I always need to open up Microsoft Autoruns and disable their self-installed processes to call home and check versions whenever I boot up. I'm sorry, but any updating will be done by me when I'm not late for something at work. I can't say how many times my computer is stalled checking for new versions (and downloading and installing them while I'm trying to do accomplish something!)
    So if these vulnerabilities are just a reflection of there being a new version available, I'll research and weigh my options for the day and just avoid vulnerable sites for a couple weeks (that's a joke - I always avoid vulnerable sites and have never gotten a virus). However, if these really mean that bad guys are actively deploying malware, I'll take them more seriously. I know how to manage the risks if I know what this message means.
    One might wonder why plugins to display images and documents would be so vulnerable anyways. Is there really code in them that says "ok, the document is displayed, is there anything else the server side would like us to run on the client PC?" :) Looking at the recent Apple QT versions, they're not clear if the "arbitrary code" that gets run is that the PC will continue to execute random stuff in memory (which is more likely to lead to a crash) or if it's code placed in the image that will get executed.
    Thanks in advance for clarifying...

    hello, yes the updates from adobe and oracle for its plugins contain fixes for discovered vulnerabilities regularly. this should not be taken lightly since outdated plugins are the #1 infection vector for malware on the web nowadays...
    ''edit: you also might not be safe by just visiting known & "trusted" sites, since also ad-networks or content delivery networks might get hacked and used for the spreading of malware.''
    http://www.adobe.com/support/security/
    <br>http://www.oracle.com/technetwork/topics/security/alerts-086861.html

  • 64-bit vulnerability to APSB10-26

    The following critical vulnerability (APSB10-26) has been patched with version 10.1.102.64.
    However, has the 64-bit "Square"  pre-release (build date 27/9/10) contain this vulnerability? Its version number is greater than the versions which are listed as vulnerable, but given this was a 0-day vulnerability, Adobe would not have known about when the last 64-bit build was done.
    (see here:http://labs.adobe.com/downloads/flashplayer10.html)
    If not - any idea of when a patched 64-bit version will hit?

    Please post issues regarding the "Square" beta in the appropriate beta forum http://forums.adobe.com/community/labs/flashplayer10

  • Sun light affects the camera sensor?

    Hi
    I have a lumia 1520 and once driving, my phone's camera was exposed to sun light for about 5 hrs as i put it on my car's dashboard.
    after then when i take a photo i feel my images got worse in quality and color.
    Am i suspicious or sun light really affects the camera sensor?

    Hi, AmirTofighi. Any chance you can attach sample photos? The sunlight should not affect the camera sensor AFAIK. However, we like to further check on this since you have laid the scenario.
    BTW, if this is using the built-in camera app, try using lens app and compare. Also, if you have a friend who is using the same model of the device, it would not hurt to check and compare the images taken on both devices.
    Hope to hear from you soon. :-)

  • Who Is My Mac Talking To?

    I recently purchased an interesting little app called Little Snitch which shows when my Mac or any software on it "Phones Home". Firstly I was quite surprised how often it does this. Checking the date and time is fine, but does it really need to do it every 10 mins?
    Anyway, here are a couple that are a mystery to me - I've read the "official" definition but I'm still completely unclear as to why my Mac is contacting them:
    mDNSResponder
    DirectoryService
    Would blocking these really affect my Mac in any way, I mean. surely there muct stillbe some Mac users who aren't even connected to the Net?
    Simon (London UK)

    mDNSResponder is part of the service called Bonjour. Bonjour makes a broadcast periodcally to the local network to advertise that the computer is turned on and it responds to requests from the local network to list what services it has to share (file sharing, iTunes sharing, iPhoto sharing, etc.) This is how printers are automatically found, computers on your network pop up in sidebar in Finder, etc. It's not "phoning home".
    DirectoryService serves a number of functions, some of which are part of Bonjour, like mDNSResponder. It's also involved in an aspect of handling file shares, managing user identities (e.g., for controlling access to file shares, etc.). If you have a Directory or access a directory (in the sense of LDAP or Microsoft Active Directory), it also deals with that. Again, it's not phoning home, but providing and looking for services on the local network.
    PubSubAgent is a service for handling and keeping up-to-date RSS feeds and feed status information. Both Apple Mail and Safari use it, and it's also used to synchronize bookmarks between Macs and Apple's MobileMe (aka DotMac) service. Basically, it acts as a single conduit for querying feeds and notifying applications of new articles/items. This prevents multiple applications from having to keep their own copy of the information, parse it, etc. This isn't phoning home per se, but if you have the MobileMe service and turned on the MobileMe sync features, it will send and retrieve data from MobileMe. If you don't, it will only fetch data from RSS feeds that your applications have requested it to fetch data from. Be default, Mail comes configured with several news-feeds set up, so does Safari. There's also a screensaver that uses RSS to pull down news headlines.
    You can block any of these things and you Mac will still function. Blocking DirectoryService or mDNSResponder will make your Mac undiscoverable by other Macs and it won't find services or other computers on your local network.
    If you block PubSubAgent, you'll disable bookmark synching (if you use that), and disable RSS feeds (so you can't get updates from Internet sites).

  • PO qty reduced who brings the cart into cockpit

    Hi all
    scenario
    sc created with 2 qty
    PO created by Buyer 2 qty via cockpit .
    Again Buyer received a call from requestor that requestor needs only 1 qty rather than 2.
    then again BUYER changed the qty to 1 from 2 via me23n. Now again shopping cart venture into cockpit due to mismatch between sc qty and PO qty .
    no good receipt done so far since so far buyer did not send the PO to vendor.
    how sc comes to cockpit after some time? who is really doing this wotk get status - variant which data plays important role here. or clean job brings... confusion.
    can you clarify this trivial things to me..
    sc folow on docuemnts updates with PO qty as 1 . but still sc did not come to cockpit.
    i am sure it will come shortly i.e sc comes to cockpit. i wanted to who does this job?
    if possible answer this.
    item guid and header guid sc where it stored in ECC table. i am pretty sure , they were stored in some tables.
    br
    Muthu

    PR -2 qty --> soco -> sc 2 qty --> PO 2 Qty -->changed to PO 1 QTY
    status run and clean run well.
    still i am looking for this sc 1 qty in the cockpit. Waitinting and waiting...
    Muthu
    works
    sc 2 qty -PO 2 Qty -
    po 1 qty -
    sc comes to cockpit.
    SG:- Stop the get status job . reduce the PO qty 1 from 2 qty thought the sc comes to cockpit. inscrutable.
    thanks
    Finally, I tried putting 0 in last.. days and running BBP_GET_STATUS_2 in debug mode. From what I see it is looking at all the SC's in the system and trying to update status for each of them. We normally run this job with 30 days on a hourly basis.
    Yes. during that time all locks will happen .did you notice in sm12 . no one can perform any activity.
    i am looking for dalily updates happened in ECC and it must be updated in SRM - with which variant.
    since i ahve some special request .
    kindly advise.
    How long it took in production . hope it may take lot of time. i am interested to know when do you run this job ? at night no business hours ..since our volume of carts are more...it runs more than 3000 secs in testing envt it self.
    Muhtu

  • Is SSH safer or more vulnerable with password auth?

    I've been having a fight with the university IT people about SSH being unsafe because of the possibility of a brute-force password attack. Of course (as I explain to them) there are myriad ways to thwart this, some of which I had already taken before the fight began (only allow a short time to connect successfully, for example). (Although, I haven't been able to figure out if SSH can simply decide to refuse a connection after a certain number of failed passwords, but that's another issue..). On the other hand, I have seen a few sites in my SSH googling that hint that the RSA key authentication is less secure than password authentication.
    So, my question I would like to submit for discussion is this: Is a passwordless RSA key authentication more or less secure than password authentication, and why? Or, if you would rather, under what circumstances are each method more vulnerable?

    I think it really depends on the attack vector you are looking at.
    Assuming mutually exclusive for the sake of this discussion (either key-based auth with password login disabled, or password login and key based auth disabled). A password-less ssh key is likely more vulnerable to an endpoint exploit -- as if an attacker has your sshkey without a password, he has access. Password-over-ssh is likely more vulnerable to a server-side exploit -- opens the password-guess vector, and if you aren't paying attention to the 'fingerprint doesn't match' message and someone hijacks your dns, you could attempt to login to a compromised system, thus giving away your password. Key-based auth would fail if they did not have your public key on the compromised server (you would still see the fingerprint difference message though).
    You can do things to increase the security of the above vectors, from using a passphrase on your ssh-key and using ssh-agent (so you only have to auth once per session and it simply 'unlocks' your key, and doesn't leave it laying around open)..to using something like knockd or fail2ban on the server side.
    Personally, I use a passphrase protected ssh key (along with ssh-agent), and disable interactive (password) authentication on my boxes anytime they are exposed to a public network (along with adding root to the denyusers ssh list).
    Last edited by cactus (2009-07-08 01:52:11)

  • Mail app memory leak affecting business productivity

    Ever since upgrading both my 27" iMac (late 2012, i7, 3.4 Ghz, 32 Gb RAM, 3 Tb hybrid HDD) and my 15" MBP (late 2011, i7, 2.5 Ghz, 8 Gb RAM, 750 Gb HDD) using Mail has become almost impossible. Both machines experience severe memory issues when using Mail. It is not uncommon that Mail hogs between 90 and 95 Gb of memory (seen in Activity Monitor). The app crashes several times every day, sometimes multiple times per hour.
    Going on more than four weeks since the upgrade and the problem started, this is really affecting my business productivity.
    I have tried many of the suggested solutions found on different forums, e.g. checking for add-ons, which I don't have. Also checking my one GoDaddy account settings which is using IMAP port 993 and never changed during installation, which some have experiences. Use SSL is checked.
    Today Mail crashed multiple times and a 49 page crash report was generated.
    I need this issue solved. If anyone has a real solution, I would greatly appreciate if it could be shared here.

    I don't know if there's a "real" solution yet. There seems to be a very specific problem with the Mail application and GoDaddy's IMAP service. That it happens _only_ with GoDaddy would maybe indicate that the GoDaddy server is doing something strange (i.e. operating differently to other IMAP servers), and whatever it's doing causes Mail to go berserk.
    Probably best to sit tight and hope that Apple fixes this in an OS X release. It seems like in the past there has been a first update out around a month give or take after an OS release, so fingers crossed.
    Stuff you could probably do in the interim:
    * Disable the GoDaddy IMAP account in Mail and use their webmail
    * Use another IMAP client (Mailmate looks nice) in 30-day trial mode and hope it gets you through
    There are probably more options, but they're all variations on the same theme.

  • Ios 5 in ipodtouch4G ,really not smooth!!

    In IOS 5,Appl e added some new features:Icloud,Messages with iMessage,Notification Center,newsstand and so on.seems pretty cool,but consider  a palyer only for music ,games,video with 256 ram,i don't think it can afford that much.
    thoes apps can't uninstall,and some apps( for me that don't need like Notification)must be running ,really affect it's performance of game。
    recently i was playing fruit ninja and Puss in Boots,in touch4 with ios5 ,and the effects
    really not good:not smooth and the Notification......
    since we can't downgrade,i think apple should consider these think.256M RAM !!!
    did any one have the same feeling?

    It just says 4.3.5... =( Do i have to update to that first??

Maybe you are looking for