• Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
    Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.

Adobe Working to Fix Security Bug

H

HardOCP News

[H] News
Joined
Dec 31, 1969
Messages
0
According to this report, Adobe is working on a fix for the recent glitch found in its download manager.

Adobe’s Download Manager -- a small program Adobe uses to speed up the initial installation of its products -- can be misused to force victims to install unwanted software on their computers. Because of an undisclosed flaw in the way Download Manager works, the "attacker can force an automatic download and installation of any executable he desires."
Click to expand...
 
As soon as they're done patching that, we'll hear about two more vulnerabilities.
 
I can't wait until the point where Adobe's bugs reach critical mass and enterprises ditch Adobe Reader, Flash, and Shockwave for alternatives that either aren't as riddle with holes, or can be mass-patched more easily, and have better performance.

I'm going to dicsuss the idea of using Sumatra or Foxit as a PDF-reader replacement in my organization soon; I'm sick and tired of this. Adobe just can't get its !@#$ together.
 
I've seen that stupid download manager of theirs cause a lot of issues on computers when it is work "correctly".

I say they drop that program and go back to a normal download for programs.
 
Wait, what? It can download and run programs with out the user's consent? How the fuck does that even work? Adobe are sloppy as hell, but this kind of idiocy is unforgivable. I have no idea why anyone trusts their software these days, or how they ever became standards in the first place.
 
This is from an employee's Malwarebytes log today:

Malwarebytes' Anti-Malware 1.44
Database version: 3763
Windows 6.1.7600
Internet Explorer 8.0.7600.16385

2/19/2010 2:46:29 PM
mbam-log-2010-02-19 (14-46-29).txt

Scan type: Full Scan (C:\|)
Objects scanned: 231697
Time elapsed: 1 hour(s), 19 minute(s), 0 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\GoogleUpdateBeta (Backdoor.IRCBot) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Users\****\AppData\Local\Temp\setupwin.exe (Trojan.VkHost) -> Quarantined and deleted successfully.
C:\Windows\Tasks\Acrobat Update.job (Malware.Trace) -> Quarantined and deleted successfully.
Click to expand...

I was called over to her desk when she complained that her search results keep redirecting her to unrelated web sites in Bing, Google and Yahoo.

Still trying to figure it out. Just thought I'd give you guys a heads up. This is a Windows 7 Pro machine, so watch your back.
 
sear said:
Wait, what? It can download and run programs with out the user's consent? How the fuck does that even work? Adobe are sloppy as hell, but this kind of idiocy is unforgivable. I have no idea why anyone trusts their software these days, or how they ever became standards in the first place.
Click to expand...

Maybe Adobe programmers are the ones that are also the ones using the "exploits" to take over peoples computers? It's a nefarious inside job.
 
"a small program Adobe uses to speed up the initial installation "

a simple exe file was faster and alot more secure.

i would love to know the real reason and purpose of adobe's special packaging techniques on their installers.

because i do not know how much more efficient you can get than simple exe setup and or a zip file.
 
chaos4u said:
"a small program Adobe uses to speed up the initial installation "

a simple exe file was faster and alot more secure.

i would love to know the real reason and purpose of adobe's special packaging techniques on their installers.

because i do not know how much more efficient you can get than simple exe setup and or a zip file.
Click to expand...
I think the Download Manager was Adobe's attempt to make it possible for Flash to be updated in the enterprise without mass-patching by sysadmins (tough to do with Adobe software).

Problem though is, the Download Manager only works for Flash --Shockwave still uses an independent installer, and Adobe Reader uses Adobe Updater. There's no consistency at all in how Adobe does its patching. Also, Adobe often makes you install incremental patches (e.g., in Reader) one-at-a-time, rather than just coming up with a freaking cumulative patch like they ought to do.

The icing on the cake is that Adobe DLM has this security hole, and Adobe's CEO coming out to say "None of our products or updates have holes we know of at the time of their release". Bull. There are issues that have remained unfixed several revisions at a time. Add that to the CPU-hogging usage of Flash, the slow speed and resource hog that Reader is compared to other PDF readers, and you've got Windows admins everywhere praying for Silverlight to succeed.
 
phide said:
What was the UAC situation on it?
Click to expand...

Prompt, no screen dim. I also change secpol.msc on employee computers to require them to enter their domain user name and password to acknowledge UAC.
 
I'm in no way defending them but I think people are jumping down their throats a little bit unjustly. One the one had they are in the forefront son everyone is going to gun for them, however... they are in the forefront with a substantial lead and they aren't a poor company their support should be better.

Actually Adobe downloader has been wonderful for me! Because I skip it and go to the bottom of the page and hit the link to download the exe and that make my admin life wonderful!

from there you can run installer.exe /s and it install flash silently. Before they wanted you to sign some agreement to get the exe installers. I often wondered why certin "staples" of programs like these couldn't partner with MS to be included as third party updates for MS update, that would be just peachy
 
You must log in or register to reply here.
Back
Top