Secunia.com

Secunia

Community Login

VIM Login

Partner Login

Overview

Advisories

Research

Forums

Create Profile

Our Commitment

All Threads

PSI

PSI API

CSI

OSI

Vulnerabilities

Programs

Open Discussions

My Threads

Create Thread

Statistics

About

Forum Thread: Recurrent false-positive on Adobe?

You are currently viewing a forum thread in the Secunia Community Forum. Please note that opinions expressed here are not of Secunia but solely reflect those of the user who wrote it.

This thread was submitted in the following forum:
Programs

Relating to this vendor:
Adobe Systems

And, this specific program:
Adobe Reader 9.x

This thread has been marked as locked.

TiranaNeal	Recurrent false-positive on Adobe?
	28th Mar, 2010 17:18
Ranking: 3 Posts: 3 User Since: 28th Mar, 2010 System Score: N/A Location: US	Lately I've been getting alerts on Adobe Acrobat 8.x and Adobe Reader 9.x. I update these programs regularly and just got them up to spec a couple weeks ago, as I recall. Today, PSI listed them as Insecure. I re-scanned them and they cleared. This has happened three times in the last week without any updates necessary. It's annoying, not earth-shattering or anything, just annoying. Any reason this should keep happening? Is there a fix or should I just get used to it? Thanks. Neal

E.Petersen	RE: Recurrent false-positive on Adobe?
	29th Mar, 2010 10:09
Score: 649 Posts: 1,892 User Since: 1st Jul 2009 System Score: N/A Location: Copenhagen, DK	Hi, Could I please ask you to confirm that: You've done a full rescan, which shows the programs to be insecure. Then you did a localized rescan of just that application which shows the program to be insecure. Is this correct? If so, this is a know bug, where the PSI will pick up it's version numbers from a unrelated file somewhere else on your hard drive that matches our rules. The localized rescan gives the correct results in this case. Hope this helps. -- Kind regards, Emil R. Petersen Secunia PSI Support Secunia PSI http://secunia.com/vulnerability_scanning/personal

Dedek	RE: Recurrent false-positive on Adobe?	[+]
This reply has been minimised due to a negative Relevancy Score.

Maurice Joyce	RE: Recurrent false-positive on Adobe?	[+]
This reply has been minimised due to a negative Relevancy Score.

Maurice Joyce

RE: Recurrent false-positive on Adobe?

[-]

29th Mar, 2010 10:52

Score: 8623
Posts: 6,660
User Since: 4th Jan 2009
System Score: 100%
Location: UK
Last edited on 29th Mar, 2010 10:53

Your problem is somewhat different to the original post. Try this:

UPDATING ADOBE FLASH
====================
Works with Windows XP,Vista & Windows 7 - 32 & 64 Bit systems.

Adobe have not fully mastered(unlike many other vendors) the art of stopping elements of Flash from working prior to the updating of a new version. The result is that an "in use" flash ocx file will not be uninstalled. Nor, have they widely publicised the fact that they do not support removal of older versions by using Control Panel>Add/Remove or other 3rd party uninstallers.

Advanced users just need to install the new version(s),then find the old OCX file(s) & zap it/them having closed down anything using Flash

The default file locations for deletions are:
32 Bit Systems - C:\Windows\system32\Macromedia\Flash
64 Bit Systems - C:\Windows\sysWOW64\Macromedia\Flash

Others may wish to take a longer route to successfully remove a vulnerability from Adobe Flash you should:

1. Download & use the Flash Uninstaller from here:

#####Before actually running the uninstaller it is a good idea to close all browsers,PSI and any other programme U think may be using Flash #####

http://kb2.adobe.com/cps/141/tn_14157.html

2. Reboot to clear out any left over ocx files.

3. Rescan using PSI - if there are any insecure Flash elements left what is the path to them? U should not proceed to stage 4 until all U clear any problems found.(The PSI overview page may look a little odd because it uses Flash for the pictorials)

Note: At this stage,if PSI finds any elements of Flash in the C:\i386 folder or on any drive other than C that is an OEM reinstallation partition (normally D drive) or a drive U use solely to backup your work U can safely create an ignore rule. It may also be in the Recycle Bin.

4. Reinstall the latest Internet Explorer Flash Player from here:

http://www.filehippo.com/download_flashplayer_ie/ (I strongly advise U not to select the Beta version unless an advanced user). The latest stable & secure version is: 10.0.45.2

4A.If U are also using Firefox, Opera and other Gecko-based browsers U need this link as well:

http://www.filehippo.com/download_flashplayer_fire... (Again, I strongly advise U select the stable & secure version: 10.0.45.2)

Security.
Adobe also have a very bad habit of changing your Flash settings each time they plug vulnerabilities. To change the security settings to your liking & regain control of your PC click here:

http://www.macromedia.com/support/documentation/en...

Bloat ware.
If you used the Adobe site, rather than FileHippo to update you will also find they try or have installed an unnecessary Download Manager.

It is bloat ware by a third party Company called NOS. If found I would uninstall it via Add/Remove.

Revision 4.

--
Maurice

Windows 7 SP1 64 Bit OS
HP Intel Pentium i7
IE9
16GB RAM

Was this reply relevant?

-5

Dedek	RE: Recurrent false-positive on Adobe?	[+]
This reply has been minimised due to a negative Relevancy Score.

TiranaNeal

RE: Recurrent false-positive on Adobe?

29th Mar, 2010 11:19

Score: 3
Posts: 3
User Since: 28th Mar 2010
System Score: N/A
Location: US

Correct. Each morning (or so it appears) PSI has identified the two programs as insecure (Acrobat Reader 9.3.0.148 & Acrobat 8.2.0.81). I verified that the file version (in Windows Explorer) identified by PSI is the same as the identified path reported in PSI. However, when I open the programs and check Help - About, Reader identifies itself as 9.3.1 and Acrobat 8 as 8.2.1.

When I re-scanned local, both cleared (congratulations!). I ran a new manual scan and have no insecure programs. Oddly enough, PSI last ran a full scan on 23 March and wasn't scheduled to run another one until 30 March. So... why is it reporting it as insecure? If it's not from a full scan, when is it obtaining this info? How much you want to bet tomorrow (or sometime soon at any rate) I'll have two more "insecurities?"

Was this reply relevant?

-0

Maurice Joyce	RE: Recurrent false-positive on Adobe?	[+]
This reply has been minimised due to a negative Relevancy Score.

Dedek	RE: Recurrent false-positive on Adobe?	[+]
This reply has been minimised due to a negative Relevancy Score.

Maurice Joyce	RE: Recurrent false-positive on Adobe?	[+]
This reply has been minimised due to a negative Relevancy Score.

Dedek	RE: Recurrent false-positive on Adobe?	[+]
This reply has been minimised due to a negative Relevancy Score.

TiranaNeal

RE: Recurrent false-positive on Adobe?

30th Mar, 2010 07:56

Score: 3
Posts: 3
User Since: 28th Mar 2010
System Score: N/A
Location: US

Right on schedule: Adobe Acrobat 8 and Adobe Reader 9 are listed as insecure, again. This thread got off track into other Adobe products. Any chance of a relevant reply? :-)

Was this reply relevant?

-0

E.Petersen	RE: Recurrent false-positive on Adobe?
	30th Mar, 2010 08:44
Score: 649 Posts: 1,892 User Since: 1st Jul 2009 System Score: N/A Location: Copenhagen, DK	on 30th Mar, 2010 07:56, TiranaNeal wrote: Right on schedule: Adobe Acrobat 8 and Adobe Reader 9 are listed as insecure, again. This thread got off track into other Adobe products. Any chance of a relevant reply? :-) Hi, This is a know bug, and is in the hands of our developers. The problem is caused by old versions of Acrobat/Reader on other drives, and the PSI using version info from files in their subdirs instead of the version that belongs to the detected instance. Thank you for reporting it, and sorry for the trouble. In the mean time, using the local rescan should produce accurate results. hope this helps. -- Kind regards, Emil R. Petersen Secunia PSI Support Secunia PSI http://secunia.com/vulnerability_scanning/personal

hanmeng

RE: Recurrent false-positive on Adobe?

1st Apr, 2010 23:27

Score: 1
Posts: 1
User Since: 30th Oct 2009
System Score: N/A
Location: N/A

How do I do a "localized scan"?

Was this reply relevant?

-0

Andy68

RE: Recurrent false-positive on Adobe?

2nd Apr, 2010 08:14

Score: -2
Posts: 8
User Since: 2nd Apr 2010
System Score: N/A
Location: JP

After using the bloated Adobe Reader for years, I got fed up with all the security issues. This must be one of the most patched and potentially vulnerable mainstream programs used.

I have been using the free, much smaller and far more secure FOXIT for the past six months, and think it's great. Fully compatible with all PDF's. (and more)

Regarding Adobe flash player/active x control, there isn't really much choice, but to update it often.

Was this reply relevant?

-0

This thread has been marked as locked.

Forum Thread: Recurrent false-positive on Adobe?

Secunia Customer Login

Not a customer already?