Close
  • Latest News
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
Read Down
Sign in
Close
Welcome!Log into your account
Forgot your password?
Read Down
Password recovery
Recover your password
Close
Search
Logo
Logo
  • Latest News
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
More
    Home Cybersecurity
    • Cybersecurity
    • Blogs
    • Security Watch

    Mozilla Blocks Flash in Firefox Thanks to Unpatched Zero-Days

    By
    Sean Michael Kerner
    -
    July 14, 2015
    Share
    Facebook
    Twitter
    Linkedin
      Firefox

      With two currently unpatched zero-day vulnerabilities in Adobe’s Flash Player, Mozilla has decided that enough is enough and it’s blocking Flash usage in the Firefox Web browser.

      “All versions of Adobe’s Flash Player plugin are currently deactivated by default, until Adobe releases an updated version to address known critical security issues,” Mozilla states in a support note.

      The latest two zero-days in Flash were discovered by security vendors FireEye and Trend Micro by going through materials obtained via the breach of Italian security vendor Hacking Team. Adobe says it plans on patching the flaws identified as CVE-2015-5122 and CVE-2015-5123 this week. The two new zero-days are on top of 36 other identified vulnerabilities that Adobe has already patched this month.

      Flash has been identified by multiple security vendors this year as being a leading path to exploitation, with Intel Security’s McAfee Labs reporting a 317 percent increase in the volume of Adobe Flash malware samples detected, while Trustwave has found that Adobe Flash is now the most exploited application. Both the Intel Security and Trustwave reports came out before the latest round of Flash exploits, which would seem to indicate that there is no end in sight to Flash’s troubles.

      Mozilla is the first vendor to actually block Flash after this latest round of zero-days, and it’s not clear if others can or will follow Mozilla’s lead. Alex Stamos, the new chief security officer at Facebook, has publicly called for an end to Flash usage in a Twitter message.

      “It is time for Adobe to announce the end-of-life date for Flash and to ask the browsers to set killbits on the same day,” Stamos wrote.

      Blocking Flash in browsers other than Firefox is a task that is easier said than done. Microsoft’s Internet Explorer 11 and Google’s Chrome both directly integrate Flash with the browser. The benefit of the integration is that users only need a single update to get an updated browser/Flash combination. The risk is that when Flash is found to be vulnerable like it is now, IE and Chrome users are exposed to the risk by default.

      Certainly both IE and Chrome users can choose to disable Flash. For Chrome users, Google has a helpful page that describes the process. Microsoft provides information on how to disable add-ons in general (including Flash) inside of IE 11 on its own support page as well.

      Given that the two new Flash zero-days were found in the Hacking Team data breach, there should be no doubt whatsoever that the exploits are not theoretical and represent a real and present danger to Flash users today. As such, Mozilla’s decision to block Flash is the right thing to do to protect users.

      Certainly anti-malware and Web Application Firewall (WAF) technologies can also help limit the risk of Flash zero-day exploits, but Mozilla’s move to block Flash altogether for now is likely the best protection for users.

      Sean Michael Kerner is a senior editor at eWEEK and InternetNews.com. Follow him on Twitter @TechJournalist.

      Sean Michael Kerner
      Sean Michael Kerner is an Internet consultant, strategist, and contributor to several leading IT business web sites.

      MOST POPULAR ARTICLES

      Cybersecurity

      Visa’s Michael Jabbara on Cybersecurity and Digital...

      James Maguire - May 17, 2022 0
      I spoke with Michael Jabbara, VP and Global Head of Fraud Services at Visa, about the cybersecurity technology used to ensure the safe transfer...
      Read more
      Cloud

      Yotascale CEO Asim Razzaq on Controlling Multicloud...

      James Maguire - May 5, 2022 0
      Asim Razzaq, CEO of Yotascale, provides guidance on understanding—and containing—the complex cost structure of multicloud computing. Among the topics we covered:  As you survey the...
      Read more
      Big Data and Analytics

      GoodData CEO Roman Stanek on Business Intelligence...

      James Maguire - May 4, 2022 0
      I spoke with Roman Stanek, CEO of GoodData, about business intelligence, data as a service, and the frustration that many executives have with data...
      Read more
      IT Management

      Intuit’s Nhung Ho on AI for the...

      James Maguire - May 13, 2022 0
      I spoke with Nhung Ho, Vice President of AI at Intuit, about adoption of AI in the small and medium-sized business market, and how...
      Read more
      Applications

      Cisco’s Thimaya Subaiya on Customer Experience in...

      James Maguire - May 10, 2022 0
      I spoke with Thimaya Subaiya, SVP and GM of Global Customer Experience at Cisco, about the factors that create good customer experience – and...
      Read more
      Logo

      eWeek has the latest technology news and analysis, buying guides, and product reviews for IT professionals and technology buyers. The site’s focus is on innovative solutions and covering in-depth technical content. eWeek stays on the cutting edge of technology news and IT trends through interviews and expert analysis. Gain insight from top innovators and thought leaders in the fields of IT, business, enterprise software, startups, and more.

      Facebook
      Linkedin
      RSS
      Twitter
      Youtube

      Advertisers

      Advertise with TechnologyAdvice on eWeek and our other IT-focused platforms.

      Advertise with Us

      Menu

      • About eWeek
      • Subscribe to our Newsletter
      • Latest News

      Our Brands

      • Privacy Policy
      • Terms
      • About
      • Contact
      • Advertise
      • Sitemap
      • California – Do Not Sell My Information

      Property of TechnologyAdvice.
      © 2021 TechnologyAdvice. All Rights Reserved

      Advertiser Disclosure: Some of the products that appear on this site are from companies from which TechnologyAdvice receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. TechnologyAdvice does not include all companies or all types of products available in the marketplace.

      ×