Flash Player ActiveX 27.0.0.170 - Crashing Internet Explorer

[danr94390093]

Greetings;

Back in mid-October 2017 timeframe, we deployed Flash Player 27.0.0.170 to our enterprise workstation environment to address a critical finding as part of

APSB17-32. Shortly thereafter we began to receive reports of Internet Explorer crashing when visiting sites running Flash content. This occurred with all workstation operating systems we support (Windows 7, 8.1 and 10).

Around the time that the issue became apparent, version 27.0.0.183 was introduced. Hopeful that this version would resolve the issues that .170 introduced, I attempted to place .183 on an affected machine to no avail and the issue persisted. The only mitigation for the issue at this time is to make 27.0.0.130 (the previous version we had in production) available for affected users to reinstall it - I'm hesitant to roll back the entire enterprise due to the severity of the vulnerability that update addresses.

Any feedback or guidance anyone can share regarding update .170 (and beyond)? Not sure if what I'm encountering is an internal IE specific configuration issue, or if others are encountering something similar elsewhere. As is stands now, I'm stuck without the ability to move beyond .130 at this point.

[_maria_]

There are no screenshots attached.  We are aware of some crashing with IE on 27.0.0.170 & 183 (released to address a specific crash in VMWare vSphere).   Please check to see if the 27.0.0.180 beta fixes the crashes you are experiencing.  The beta is posted at Download Adobe Flash Player 27 Beta for Desktops - Adobe Labs   You'll need to uninstall 27.0.0170 (or 183) before you can install the beta.  Use the beta uninstaller posted at the bottom of the beta downloads page.

[danr94390093]

I'm hoping the attachments came through below, as they show blank place holders for the images before and I had to go back and edit my post as the placeholders cut off my text.

I did attempt the 27 beta version (27.0.0.180) on one system thus far and it did appear to resolve the issue. My question is: what are the differences between a beta and production release of Flash Player? .180 (beta version) was released on 10/17, then .183 was released on 10/25, so that tells me that .183 re-introduced whatever issue that .170 was causing us.

[_maria_]

so that tells me that .183 re-introduced whatever issue that .170 was causing us.

Nothing was re-introduced in 183.  183 contains a specific fix for one crash (the VMWare vSphere crash I mentioned).  It's 170 + the specific fix.  It doesn't contain the same features & fixes as the beta 180 build.  The next stable release, which contains all of the fixes and new features in 180, is scheduled to be released next Tuesday, 14-November, barring any unforeseen issues.

[danr94390093]

Great! Thank you for the update, I will keep my eyes peeled for the release of that update on the 14th.

[_maria_]

you're welcome.

[stevem90270853]

Just for reference, turning off Data Execution Prevention via the command line tool just causes IE to crash without prompting. We are having to force users to use Chrome because we have automatic updating.

I also can't test whether it worked on old versions because downgrading the installation does not downgrade the plugin in IE11 on Windows 7 or IE11 in Windows 10.

I used the troubleshooting from the website as well. The HTML5 video version works (Youtube). The non-HTML5 version does not work (akamai). We currently have 3 major user facing applications that are down because of this crashing.

Version 183 presents the same issues.

[_maria_]

I also can't test whether it worked on old versions because downgrading the installation does not downgrade the plugin in IE11 on Windows 7 or IE11 in Windows 10.

ActiveX Control on is downgradable.  You'll need to use the standalone uninstaller to uninstall the ActiveX and then install the previous version.  Since ActiveX is embedded in the browser on Windows 8.x and 10 the only way to downgrade is to uninstall the update that installed 27.0.0.183.

[jeromiec83223024]

Yeah, unfortunately, DEP isn't going to prevent a crash.  Data Execution Prevention exists to make sure that the crash doesn't result in crafted, malicious content leveraging a crash to then gain control over program flow.  It's more like a bumper than a collision avoidance system.

Like Maria said, you have to uninstall Flash Player in order to go backwards (and to switch to a lower stability channel like the beta).  We don't want an attacker to trick end-users into downgrading so that they can then deploy an old exploit.  If you're moving backwards, we want to make sure you're doing it on purpose, so we require you to uninstall.

You would have to actually go all the way back to 27.0.0.130 in order to avoid the crash that you're experiencing on Windows 10, which means rolling back all of those relevant KB updates.  The only way to install Flash Player for IE and Edge on Windows 10 is via Windows Update, so we have no mechanism by which we can give you a beta build or any early builds.  You're committed to exclusively getting only the Flash Player updates that Microsoft chooses to ship on that platform.