what is "Flash Player shared object"

Chat about Linux in general
Forum rules
Do not post support questions here. Before you post read the forum rules. Topics in this forum are automatically closed 6 months after creation.
Locked
mike acker
Level 7
Level 7
Posts: 1517
Joined: Wed Jul 31, 2013 6:29 pm
Location: Kalamazoo, MI

what is "Flash Player shared object"

Post by mike acker »

in a recent discussion on ZD Net I noted that when Flash is updated as a result of a CVE we get an update through the update manager.

I know that the Update Manager requires the ADMIN password to operate and this led me to ask: If Flash is a "plug in" why does it have to install via the Update Manager ?

I got this response:
Mike~Acker The admin password is required because the Flash Player shared object file is added to a directory, the web browser plug-in directory to be more specific, that is not writable by non-root users.
right now I'm suspecting that what they call a "shared object" is the executable code for Flash. And they are putting it into /Root

why?

hopefully if it is in fact the executable they (1) load it into user space, and (2) mark the pages it is loaded onto as {READ,EXEC} ( no write access). the program has to be RE-ENTRANT to do this (on MVS/370: PARM.LKED=(RENT, ... ) )

I'm trying to figure out why flash is such a horrible security problem and I think it's because, "in their need for speed", they are feeding raw, external internet data directly into a privileged process --

comments?
Last edited by LockBot on Wed Dec 28, 2022 7:16 am, edited 1 time in total.
Reason: Topic automatically closed 6 months after creation. New replies are no longer allowed.
¡Viva la Resistencia!
User avatar
karlchen
Level 23
Level 23
Posts: 18179
Joined: Sat Dec 31, 2011 7:21 am
Location: Germany

Re: what is "Flash Player shared object"

Post by karlchen »

Hello, Mike.

The Flash Player Plugin is a shared library. On Windows such libraries are called DLLs. So nothing fancy in itself. But yes, like any shared library the flash player plugin will hold executable code.

The reason why upgrading the Flash Player Plugin requires root privileges is pretty trivial:
All software products which are installed and maintained through the Linux Mint software management system (Software Manager, Synaptic, Update-Manager etc) are installed/upgraded/removed with root privileges, because the application files (executable files, shared libraries) are stored in folders where only root has got write privileges.
That's all. Again nothing fancy.

When you launch Firefox you do so under your own account. So Firefox is running with your privileges. When Firefox loads the Flash Player Plugin it does so under your account, too. No root privileges involved.

Why the Adobe Flash Player Plugin is a conglomeration of security vulnerabilities? Only Adobe will be able to tell. But I doubt they will. I tend to assume that the fundamental design of the flash player plugin is inherently insecure. This is why "after the latest security fix" is "before the next zero day exploit".

Cheers,
Karl
Image
The people of Alderaan have been bravely fighting back the clone warriors sent out by the unscrupulous Sith Lord Palpatine for 762 days now.
Lifeline
mike acker
Level 7
Level 7
Posts: 1517
Joined: Wed Jul 31, 2013 6:29 pm
Location: Kalamazoo, MI

Re: what is "Flash Player shared object"

Post by mike acker »

karlchen wrote:Hello, Mike.

{snip}

Why the Adobe Flash Player Plugin is a conglomeration of security vulnerabilities? Only Adobe will be able to tell. But I doubt they will. I tend to assume that the fundamental design of the flash player plugin is inherently insecure. This is why "after the latest security fix" is "before the next zero day exploit".

Cheers,
Karl
thanks Karl, for a well thought out and helpful reply. I've been trying to figure out for some time why flash is such a nasty problem. I had suspected they installed a driver into the kernel but I've found no notes that would indicate this. "Privilege escalation" remains a serious problem in some other operating systems but from what I've learned thus far I've seen no indication of this issue in Linux.

there would be a concern naturally that raw network data, feeding into this Flash "shared object" could cause the shared object to do something it shouldn't,-- and this could be deadly -- without violating the integrity of the o/s itself: In this week's issues we are wondering if hackers are stealing tax files from the endpoints, or from the vendors' servers -- or from the final points, IRS, State "services".

endlich this makes the case for "named spaces". Xenopeek has been after me to start using Firejail and I plan to do that but first I have to get off my medical restrictions so I can change out one of the hard drives in my ATX tower :?
¡Viva la Resistencia!
Locked

Return to “Chat about Linux”