Adobe Flash Security Alert

[dougd_engineer]

Hi,

A security scan has return ed multiple instances of:

Adobe Flash Player <= 29.0.0.113 (APSB18-08) (108958)

The solution is to Upgrade to Adobe Flash Player version 29.0.0.140 or later.All servers (2012 R2) are on a later version than 29.0.0.140 and when i look in the registry it shows the correct version.

However when i query the version via a PowerShell script it returns an old version of 28.xxxxx which is probably why the security alert is being generated.

Anyone have any ideas why the PowerShell script would be retruning false results? It has to be collecting the data from somewhere and obviously thinks it is accurate.

Thanks

[_maria_]

It's possible the different versions are for different Flash Player types (e.g. ActiveX for IE, NPAPI for Firefox, PPAPI for Chromium-based browsers).

Microsoft embeds Flash Player ActiveX in IE on Server 2012 and all updates are distributed via Windows Update.

when i look in the registry it shows the correct version

Which registry entry are you looking at?

i query the version via a PowerShell script it returns an old version of 28.xxxxx

What registry entries is the PowerShell script using to check the version?

The Flash Player Settings Manager Updates tab will display which Flash Player types are installed and the version for each type. Please post a screenshot of this.  To open the Flash Player Settings Manger, go to Control Panel\All Control Panel Items\Programs and Features > Flash Player and then click on the Updates tab

[dougd_engineer]

Flash Player and Flash Player ActiveX are both 30.0.0.113 (this months patching has just been done so Security Updates are done every month.

This is where I check in the reg:

When I run a script querying the reg using Get-ItemProperty -Path HKLM:\Software\Macromedia\FlashPlayer it returns 18.0.0.203

I have also checked all versions of flash.ocx in System32 and SysWOW64.

No Firefox, Chrome or other browsers are installed.

Thanks for your help

[dougd_engineer]

I should add the Security Scan returns the version as:

Installed version : 28.0.0.137

I have resolved the problem with the PowerShell script. It was returning the wrong version from the location i was running it.

What is the last Security Update released for windows Server 2008 R2 with IE 11 the version installed is 28.0.0.126

[_maria_]

The most recent version is Flash Player 30.0.0.113.  Note though, that Flash Player is not supported on any Server version, but installation.

<edit>

Regarding the entry you're using to check the Flash Player version (in the screenshot), while this will work for ActiveX, if you also install the NPAPI plugin for Firefox and/or the PPAPI plugin for Chromium-base browsers this entry will not be correct.  You may want to use the entry specific to the Flash Player type you are using, e.g:

• ActiveX: HKEY_LOCAL_MACHINE\SOFTWARE\Macromedia\FlashPlayerActiveX > Version
• NPAPI: HKEY_LOCAL_MACHINE\SOFTWARE\Macromedia\FlashPlayerPlugin > Version
• PPAPI: HKEY_LOCAL_MACHINE\SOFTWARE\Macromedia\FlashPlayerPepper > Version

[jeromiec83223024]

Also, the current Flash Player version is 30.0.0.113.  We'd strongly recommend that you keep Flash Player current to the extent possible.