Apple begins blocking old Flash plugins in Safari

Apple has updated its XProtect system, built into Mac OS X, to prevent the Safari browser from launching older versions of the Adobe Flash Player plugin. The company noted the change in a short security note which simply read: "To help protect users from a recent vulnerability, Apple has updated the web plug-in-blocking mechanism to disable older versions of the web plug-in: Adobe Flash Player", and directed users to an article on updating Flash in Safari. Apple has previously used XProtect to block older Java versions, but this is believed to be the first time it has used it to block older Flash versions.

It is somewhat difficult to identify which "recent vulnerability" Apple are responding to. The Xprotect update means only version 11.6.602.171 is able to run; this is the version released on 27 February as the last of a number of emergency patches in February. At least two of the critical vulnerabilities fixed in that update were said to be used to inject malicious code into the Firefox web browser. A third flaw, a buffer overflow (CVE-2013-0504), was also fixed in that update.

Apple's more aggressive blocking of known-to-be-flawed plugins appears to be at least part in response to recent attacks which have leveraged Java 0day holes, and most probably Flash holes, in break-ins to Microsoft, Twitter, Facebook and Apple itself.

(djwm)