navigation bar left navigation bar right

Secunia CSI7
navigation left tab Advisories navigation right tab
navigation left tab Research navigation right tab
navigation left tab Forums navigation right tab
navigation left tab Create Profile navigation right tab
navigation left tab Our Commitment navigation right tab
PSI
PSI API
CSI
OSI
xSI
Vulnerabilities
Programs
Open Discussions
My Threads
Create Thread
Statistics
About

Forum Thread: Latest version of Adobe Flash not detected by PSI after installation

You are currently viewing a forum thread in the Secunia Community Forum. Please note that opinions expressed here are not of Secunia but solely reflect those of the user who wrote it.

This thread was submitted in the following forum:
Programs

Relating to this vendor:
Adobe Systems
And, this specific program:
Adobe Flash Player 10.x

This thread has been marked as locked.
bjkeefe Latest version of Adobe Flash not detected by PSI after installation
Member 21st Sep, 2010 15:18
Ranking: 3
Posts: 12
User Since: 29th Aug, 2010
System Score: N/A
Location: US
Last edited on 21st Sep, 2010 15:21

When I turned on my computer this morning, Secunia PSI notified me that Adobe Flash was insecure. I checked my version at Adobe's site:

http://www.adobe.com/software/flash/about/

and sure enough, there was a newer version available.

I had 10.1.82.76, and the latest is 10.1.85.3.

I downloaded and installed the new version -- separately for Firefox and Internet Explorer. Both installed correctly, and re-visiting the above link showed that I had the new version installed in both browsers, as far as that Adobe About page could tell, at least

However, PSI continued to insist that my version of Flash was insecure. Thinking that this might be one of those cases where Adobe's installation procedure doesn't properly uninstall the old version(s) when installing a new version, though I thought they had fixed that, I followed the PSI suggestion to download the Adobe Flash uninstaller program from here:

http://kb2.adobe.com/cps/141/tn_14157.html

I then ran the uninstaller and confirmed with both browsers that Flash was no longer installed. I then repeated the installation procedure for the new version of Flash, again for both browsers, and revisited the Adobe Flash About page to check that the latest version had been properly installed. It was, for both browsers.

However, PSI continues to insist that Flash is out of date, even after clicking the PSI "Re-Scan Program" button AND after rescanning the entire machine.

This same problem in all particulars manifests on my other computer, in which I also did the full Adobe Flash uninstallation before installing the new version of Flash for my two browsers. The problem persists even after rebooting that second machine and re-running PSI.

Finally, looking at Add/Remove Programs on both machines shows only the latest version of Flash.

Machine one is running Windows XP SP3, and is fully patched. Machine two is running Windows Vista, and is also fully patched. Except, in both cases, PSI still thinks Adobe Flash 10.1.82.76 is installed, even though Adobe's site and Windows's Add/Remove Programs say differently.

[Added complication] Looking over things a bit more before posting, I noticed that PSI says that it is detecting "10.1.82.76 (ActiveX)," which I believe is the IE version of Flash. However, PSI also tells me that "2 browsers are insecure." Following that latter link from the PSI interface leads to the "Secure Browsing" tab, where I see that Firefox is considered "insecure" for a different reason (SA41244) for which no patch is currently available, and PSI indicates on this page that Flash is properly patched for Firefox.

Thus it really appears as though PSI is not detecting the new IE version of Flash only, although it does take some burrowing into the PSI interface to make this apparent -- the top page of the report, so to speak, leads one to believe that Flash is out of date system-wide.

This user no longer exists RE: Latest version of Adobe Flash not detected by PSI after installation
Member 21st Sep, 2010 15:29
Hi,

I have been unable to reproduce this issue. On my systems, installing 10.1.85.3 lets the PSI detect the proper versions, removes the old versions, and generally works as expected.

Which version is the PSI currently showing? And in which path? To obtain the path, click "+" to expand the entry, and copy the "Installation Path" field here.

The ActiveX version is, as you correctly assumed, the Internet Explorer version. NPAPI is for every other browser.

Have you tried applying the solution from within the PSI? The links we provide should allow you to update to the newest version without any problems.

hope this helps.
Was this reply relevant?
+0
-0
bjkeefe RE: Latest version of Adobe Flash not detected by PSI after installation
Member 21st Sep, 2010 15:42
Score: 3
Posts: 12
User Since: 29th Aug 2010
System Score: N/A
Location: US
Last edited on 21st Sep, 2010 15:43
Thanks for the rapid response.

on 21st Sep, 2010 15:29, wrote:
Which version is the PSI currently showing? And in which path? To obtain the path, click "+" to expand the entry, and copy the "Installation Path" field here.

When clicking the + next to "Adobe Flash Player 10.x" on the Insecure tab, PSI shows this path:

C:\WINDOWS\system32\Macromed\Flash\Flash10i.ocx

The value in the Version Detected field is: 10.1.82.76 (ActiveX)

on 21st Sep, 2010 15:29, wrote:
The ActiveX version is, as you correctly assumed, the Internet Explorer version. NPAPI is for every other browser.

Thanks for confirming.

on 21st Sep, 2010 15:29, wrote:
Have you tried applying the solution from within the PSI? The links we provide should allow you to update to the newest version without any problems.

hope this helps.

Will try now and will report back. Thanks again.
Was this reply relevant?
+0
-0
This user no longer exists RE: Latest version of Adobe Flash not detected by PSI after installation
Member 21st Sep, 2010 15:43
Hi,

One minor addition.
It seems the issue with the Adobe Installers leaving behind old versions has not been definitively fixed.
Do you have an instance of Adobe Flash in both the Insecure and Patched tabs?
If so, have a look at Adobe's own instructions for removing older versions of Flash: http://kb2.adobe.com/cps/141/tn_14157.html

hope this helps.
Was this reply relevant?
+0
-0
TiMow RE: Latest version of Adobe Flash not detected by PSI after installation
Dedicated Contributor 21st Sep, 2010 16:02
Score: 737
Posts: 728
User Since: 26th Jun 2009
System Score: N/A
Location: CH
Last edited on 21st Sep, 2010 16:12
C:\WINDOWS\system32\Macromed\Flash\Flash10i.ocx

This is the old ActiveX control (10i.ocx) for the v.10.1.82.76 (ActiveX)

Navigate to this locaction using Windows Explorer, or Open Folder from PSI.

Find the Flash10i.ocx icon on the r.h.s., right click and delete - the latest update is Flash 10k.ocx, which should also be present - leave this.

Re-boot and PSI re-scan may be required.

TiMow

EDIT: Having just updated myself using Filehippo download 2x (IE and non-IE accordingly), my PSI scan has just finished, with both insecurities cleared and new versions correctly showing under Patched tab.
N.B. It is important that all programs that use flash, including PSI (right click tray icon and exit), are closed before running uninstall flash and update installation for IE (ActiveX). This may be why the old 10i.ocx file wasn't removed.

--
Computing is not yet a perfect science - it still requires humans.
Was this reply relevant?
+2
-0
bjkeefe (SOLVED) RE: Latest version of Adobe Flash not detected by PSI after installation
Member 21st Sep, 2010 16:29
Score: 3
Posts: 12
User Since: 29th Aug 2010
System Score: N/A
Location: US
Last edited on 21st Sep, 2010 16:33
Following suggestion from E.Petersen above ...

on 21st Sep, 2010 15:29, wrote:
Have you tried applying the solution from within the PSI? The links we provide should allow you to update to the newest version without any problems.

... the short version is everything now appears to be fixed. Thanks!

And thanks also to TiMow, to whom I'll reply in a bit more detail momentarily.

Following are some notes of what I did in response to EP's suggestion, for anyone who might be interested.

I clicked on the appropriate button/link within the PSI interface to fix the problem. (I forget exactly what it was labeled.) PSI's solution had me download install_flash_player_ax.exe from

http://fpdownload.adobe.com/get/flashplayer/curren...

Downloaded it, closed browsers, ran it. Installation failed, saying some other program might still be using it (Flash?). Closed PSI, because it was the only application still open, re-ran installer, this time it reported success. PSI did not update to reflect this.

Clicked "Re-scan Program" button. (Forget exact label here, too, sorry, but that's close.) Re-scanning pop-up message appeared. Then, after a few moments, another PSI pop-up window appeared, saying "This program no longer appears to be on your computer!" Dismissed that second pop-up window (by clicking "OK" or whatever the button was). PSI then persisted in displaying the first pop-up window. ("Re-scan of Adobe Flash Player 10.x in progress.") Let it go for about five minutes, finally exited PSI using right-click menu on icon in System Tray.

Restarted PSI. PSI now reports "0 insecure."

On other machine (laptop running Vista -- above describes desktop running XP), also downloaded same file. Also closed Firefox after download, and made sure IE was not running. Ran Adobe Installer program, got same failure message. Closed PSI, re-ran installer, success reported. Re-started PSI, reports "0 insecure."

In conclusion, everything about Adobe Flash sucks. ;)

Thanks very much for noticing my report, EP. No idea why downloading that specific .EXE for the Active X version did the trick when the usual Web-based/through-the-browser procedure did not, but as long as PSI and the Adobe Flash About page now agree I'm running the latest version for both browsers, I can't ask for anything more at this point. (Except for more rapid development of whatever HTML 5 thing is supposed to be the Flash-killer, but that's hardly Secunia's responsibility.)

Was this reply relevant?
+1
-0
bjkeefe RE: Latest version of Adobe Flash not detected by PSI after installation
Member 21st Sep, 2010 16:37
Score: 3
Posts: 12
User Since: 29th Aug 2010
System Score: N/A
Location: US
on 21st Sep, 2010 16:02, TiMow wrote:
C:\WINDOWS\system32\Macromed\Flash\F lash10i.ocx

This is the old ActiveX control (10i.ocx) for the v.10.1.82.76 (ActiveX)

Navigate to this locaction using Windows Explorer, or Open Folder from PSI.

Find the Flash10i.ocx icon on the r.h.s., right click and delete - the latest update is Flash 10k.ocx, which should also be present - leave this.

Re-boot and PSI re-scan may be required.

TiMow

EDIT: Having just updated myself using Filehippo download 2x (IE and non-IE accordingly), my PSI scan has just finished, with both insecurities cleared and new versions correctly showing under Patched tab.
N.B. It is important that all programs that use flash, including PSI (right click tray icon and exit), are closed before running uninstall flash and update installation for IE (ActiveX). This may be why the old 10i.ocx file wasn't removed.


Thanks for your suggestions, TiMow. As it happens, I had managed to clear the problem as I described above before I returned to this forum (to report success), and so I did not see your message until then.

I did go to that folder, and only the "k" versions are there now, which accords well with your suggestion. That is, since the update went properly this time, I imagine the "i" version was removed/uninstalled.

Regarding your "EDIT," I think you might be right. I don't know how I'll remember, but the next time I have to update Flash, I will try to remember to fully exit PSI before I do.
Was this reply relevant?
+1
-0
bjkeefe RE: Latest version of Adobe Flash not detected by PSI after installation
Member 21st Sep, 2010 16:40
Score: 3
Posts: 12
User Since: 29th Aug 2010
System Score: N/A
Location: US
on 21st Sep, 2010 15:43, wrote:
Hi,

One minor addition.
It seems the issue with the Adobe Installers leaving behind old versions has not been definitively fixed.
Do you have an instance of Adobe Flash in both the Insecure and Patched tabs?
If so, have a look at Adobe's own instructions for removing older versions of Flash: http://kb2.adobe.com/cps/141/tn_14157.html

hope this helps.


Hi, EP,

As with TiMow's suggestion, I did not see this until I came back here to report that your other suggestion had worked. Therefore, there is nothing listed in the Insecure tab.

As you would expect, there are (now?) two version of Flash listed in the Patched tab: NPAPI and ActiveX, both 10.1.85.3.

Thanks again for your suggestions, and especially, for the rapid response.
Was this reply relevant?
+0
-0
TiMow RE: Latest version of Adobe Flash not detected by PSI after installation
Dedicated Contributor 21st Sep, 2010 16:50
Score: 737
Posts: 728
User Since: 26th Jun 2009
System Score: N/A
Location: CH
PSI 2.0 beta is no longer reliant on, or uses flash, only if you still use 1.5.0.2 (as I do) do you need to close PSI - having said that I always close everything, anyway.

Another recommendation for next time - I (like many other forum contributors) use filehippo download site for flash updates. It lists both versions (IE and non IE) separately, and doesn't include Adobes un-needed download manager (DLM).
Each download can be run from the relevant browser - IE and Ff. respectively.

http://www.filehippo.com/latest/

I always tend to do a full PSI (re-) scan (8-10 mins for me) after such updates, as I too have had mis-/non- reporting issues after using re-scan program, only.

TiMow

--
Computing is not yet a perfect science - it still requires humans.
Was this reply relevant?
+2
-0
bjkeefe RE: Latest version of Adobe Flash not detected by PSI after installation
Member 21st Sep, 2010 17:00
Score: 3
Posts: 12
User Since: 29th Aug 2010
System Score: N/A
Location: US
Last edited on 21st Sep, 2010 17:02
on 21st Sep, 2010 16:50, TiMow wrote:
PSI 2.0 beta is no longer reliant on, or uses flash, only if you still use 1.5.0.2 (as I do) do you need to close PSI - having said that I always close everything, anyway.

I still use the old version of PSI, too. I tried the beta briefly -- I forget why I didn't like it, but I didn't so I reinstalled the older version. Thanks for confirming that it uses Flash.

on 21st Sep, 2010 16:50, TiMow wrote:
Another recommendation for next time - I (like many other forum contributors) use filehippo download site for flash updates. It lists both versions (IE and non IE) separately, and doesn't include Adobes un-needed download manager (DLM).
Each download can be run from the relevant browser - IE and Ff. respectively.

http://www.filehippo.com/latest/

That's an excellent suggestion, and I will keep it in mind. It does irritate me that the Adobe DLM hangs around. Further, it's such a clunky app that I hesitate to tell less computer-savvy people to use it.

Actually, IIRC, the Adobe DLM uninstalls itself at the next reboot of the machine, so I suppose this isn't quite as big an issue as I've made it out to be. But still, your suggestion sounds more straightforward.

It seems to me that Adobe should just offer one unified installer that handles all browsers in one run. Rather than trying to be all fancy with browser-based installations, it should just be a downloadable EXE installer that bundles the NPAPI and ActiveX versions. But the list of things Adobe does right is a short one indeed.

on 21st Sep, 2010 16:50, TiMow wrote:
I always tend to do a full PSI (re-) scan (8-10 mins for me) after such updates, as I too have had mis-/non- reporting issues after using re-scan program, only.

TiMow

I will keep that in mind, too. Thanks again.
Was this reply relevant?
+1
-0
derelict RE: Latest version of Adobe Flash not detected by PSI after installation
Member 21st Sep, 2010 17:20
Score: 0
Posts: 6
User Since: 27th Nov 2009
System Score: 100%
Location: US
I had done uninstall first from a flashdrive and then put in the newer version of Adobe Flashplayer. It was detected. but still considered insecure. There is a Beta version of Flashplayer. It can be found at: http://www.filehippo.com/

I had made an error when I tried to d/l CSI 4.1 - had misread it thinking it was PSI 2.0 (non-beta). "To err is human, to forgive divine."

--
derelict
Was this reply relevant?
+0
-0
bjkeefe RE: Latest version of Adobe Flash not detected by PSI after installation
Member 21st Sep, 2010 17:27
Score: 3
Posts: 12
User Since: 29th Aug 2010
System Score: N/A
Location: US
on 21st Sep, 2010 17:20, derelict wrote:
I had done uninstall first from a flashdrive and then put in the newer version of Adobe Flashplayer. It was detected. but still considered insecure. There is a Beta version of Flashplayer. It can be found at: http://www.filehippo.com/


Thanks for the input, derelict, but my own sense about Flash is that it's got enough problems in the stable versions that I prefer to run only the latest version they offer through their normal updates path.

Also, I think it's possible that beta version might be something they rushed out as a stopgap measure before they released the current update. I'm going on vague memories here, and I may be confusing this latest security hole with an earlier one, but I am sure they have done this before. So, you may want to check the dates on the beta compared to today's patch.
Was this reply relevant?
+0
-0
This user no longer exists RE: Latest version of Adobe Flash not detected by PSI after installation
Member 22nd Sep, 2010 10:07
Hi,

If anybody needs a direct download link for Adobe Flash 10.x, where you can fetch the files without installing the "download manager", you can just use these links, that will always point to the newes version:

The ActiveX Version
http://fpdownload.adobe.com/get/flashplayer/curren...

NPAPI (Every browser except IE...)
http://fpdownload.adobe.com/get/flashplayer/curren...

These are the links the PSI provides.

hope this helps.
Was this reply relevant?
+0
-0
bjkeefe RE: Latest version of Adobe Flash not detected by PSI after installation
Member 22nd Sep, 2010 12:22
Score: 3
Posts: 12
User Since: 29th Aug 2010
System Score: N/A
Location: US
on 22nd Sep, 2010 10:07, wrote:
Hi,

If anybody needs a direct download link for Adobe Flash 10.x, where you can fetch the files without installing the "download manager", you can just use these links, that will always point to the newes version:

The ActiveX Version
http://fpdownload.adobe.com/get/flashplayer/curren...

NPAPI (Every browser except IE...)
http://fpdownload.adobe.com/get/flashplayer/curren...

These are the links the PSI provides.

hope this helps.


Thanks for these, EP.
Was this reply relevant?
+0
-0
mike57904 RE: Latest version of Adobe Flash not detected by PSI after installation
Member 22nd Sep, 2010 14:54
Score: -5
Posts: 7
User Since: 11th May 2010
System Score: N/A
Location: N/A
Uninstal Adobe using Revo Freeware. Then reinstal latest version. It worked for me on Vista this morning.
Was this reply relevant?
+1
-0

This thread has been marked as locked.


 Products Solutions Customers Partner Resources Company
 
 Corporate
Vulnerability Intelligence Manager (VIM)
Corporate Software Inspector (CSI)
Consumer
Personal Software Inspector (PSI)
Online Software Inspector (OSI)
 Industry
Compliance
Technology
Integration
 Customers
Testimonials
 MSSP
Technology Partners
References
 Reports
Webinars
Events
 About us
Careers
Memberships
Newsroom


Secunia is a member of FIRST Secunia is a member of EDUcause Secunia is a member of The Open Group Secunia is a member of FS-ISAC
 
Secunia © 2002-2014 Secunia ApS - Rued Langgaards Vej 8, 4th floor, DK-2300 Copenhagen, Denmark - +45 7020 5144
Terms & Conditions and Copyright - Privacy - Report Vulnerability - Disclaimer
follow Secunia on Facebook follow Secunia on Twitter follow Secunia on LinkedIn follow Secunia on YouTube follow Secunia Xing follow Secunias RSS feed follow Secunia on Google+