Extension Attribute to display Adobe Flash Player version with release number

[karthikeyan_mac]

#!/bin/sh
#
############################################################################
#
# Extension Attribute checks to display Adobe Flash Player Version with Release number.
# 
#
############################################################################
FlashVersion=`/bin/cat /Library/Internet Plug-Ins/Flash Player.plugin/Contents/Info.plist | grep -m 1 10. | /usr/bin/awk '{ print $4 $5 }'`
echo "<result> $FlashVersion </result>"

exit 0

[ericbenfer]

This is great. I wanted to find the longer string version number, so I went with this.

#!/bin/sh
#
############################################################################
#
# Extension Attribute checks to display Adobe Flash Player Version number.
# #
############################################################################
FlashPluginVersion=/usr/bin/defaults read /Library/Internet Plug-Ins/Flash Player.plugin/Contents/Info CFBundleVersion
echo "<result> $FlashPluginVersion </result>"

exit 0

[#3]

Eric's version worked for me - thanks!

[Yousseph_Wehbe]

Hi,

Works like a treat! Thanks Eric!

YW

[ernstcs]

Very nice. Thanks! =D

[rcuza]

Thank you for this. I added a if/then clause to help me deal with the cases where the plug-in has not been installed yet. I also changed the key to the release version string. Seems either will work.

#!/bin/sh
#
############################################################################
#
# Extension Attribute checks to display Adobe Flash Player Version with Release number.
#
# Uses CFBundleShortVersionString because this is the "release version number of the bundle"
# Ref: https://developer.apple.com/library/IOS/#documentation/General/Reference/InfoPlistKeyReference/Articles/CoreFoundationKeys.html
#
############################################################################

FLASHPLAYERINFO="/Library/Internet Plug-Ins/Flash Player.plugin/Contents/Info"

if [ -r "$FLASHPLAYERINFO".plist ] ; then

  FlashVersion=`defaults read "$FLASHPLAYERINFO" CFBundleShortVersionString`
  echo "<result> $FlashVersion </result>"

else

  echo "<result> not.found </result>"

fi 

exit 0

[franton]

That will be extremely useful! Thanks guys!

[quedayone]

How do we get this to show up under Flash Extension Attributes?
https://jamfnation.jamfsoftware.com/viewProduct.html?id=41&view=extensionAttributes
That is where I looked first.

[zskidmor]

I realize this is kind of an old thread and perhaps there are changes that have been made, but I am having trouble with the script that Eric posted. I created an extension attribute to check flash plugin version. Running the script locally works fine and it generates expected Output. When I copy it into an extension attribute, and then create a smart group to check for (or not) 12.0.0.44, it returns every machine in my JSS, and there are many machines (including my own) that are running this version. Is there something I am missing?

[jhbush]

zskidmor, this is what I use.

#!/bin/bash

if [ -d /Library/Internet Plug-Ins/Flash Player.plugin ] ; then

    flashVersion=$( defaults read /Library/Internet Plug-Ins/Flash Player.plugin/Contents/version CFBundleShortVersionString )

    echo "<result>$flashVersion</result>"

else

    echo "<result>Not Installed</result>"

fi

exit 0

returns <result>12.0.0.44</result>

[rcuza]

ZSkidmor, are you using "like" or "not like" in your SmartGroup?

[zskidmor]

So discovered two problems:
1) The Inventory Collection settings were not set to grab plug-in information (slap to the forehead)
2) I was using "Is and "Is not" but I noticed it actually works if I use "not like" and "like".

Thanks for the help!

[rcuza]

The Inventory Collection plug-in setting is not needed because you are collecting the plug-in information via a bash script independent of anything else. As long as you are running Extension Attributes you will get the Flash Plug-in version.

Now, why don't I use Inventory Collection plug-in setting instead of an Extension Attribute? My personal reason is that collecting plug-in information slows down recon noticeably.

[zskidmor]

I assume the script isn't being executed against the machine, and that its executing on data collected from the system in the JSS? So if data isn't being collected, how is there data to input into the script?

I did notice that recon is slower, but its pulling in information that may be useful to me later so I am going to leave it on for now.

[rcuza]

Extension Attributes run on the client and the "<results>" gets uploaded to the JSS.

SmartGroups are determined by data in the JSS.

What does the plug-in information look like in the JSS? If it correctly gets the flashplayer version number you may not need the extension attribute.

[zskidmor]

I see. It looks like now i Have two ways that are working for populating the data. The Extension attribute is working after I changed from "is not" to "not like".

Creating a smartgroup with Plug in title "Flash Player.plugin" and version not 12.0.0.44 also works.

Thanks for the help and the explanation

[stevewood]

@zskidmor I would imagine the Extension Attribute was always working, it was the Smart Group that was not. :-) You can verify if the EA is working by going to a computer record in the JSS, and then clicking on Extension Attributes in the inventory list. You should then see the results of any EAs that you have running on the computer.

[jescala]

You may also find this command line tool I wrote useful. It checks if the installed versions of the Flash and Java plug-ins are blocked. You can also run it with the -V (verbose) option to see what versions are installed and the minimum required version. It requires the biplist python module (https://bitbucket.org/wooster/biplist) for access to binary plists.

#!/usr/bin/python
############
# check_plugins v1.0
# Jorge Escala - http://jescala.com
############
# Script to check for blocked browser plug-ins in Mac OS X.
# Requires biplist: https://bitbucket.org/wooster/biplist
############
# Release Notes: 
# 1.0 - Jorge Escala -
#        * Initial script creation.
############

import os.path, sys, getopt
from distutils.version import LooseVersion
from biplist import *

# Variables
VERSION = "1.0"
CMDNAME = os.path.basename(sys.argv[0])
javaOK = True
flashOK = True
pldict = {}
reconEA_opt = False
verbose_opt = False

# Set PLIST Paths
XPROT_PLIST = "/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta.plist"
FLASH_PLIST = "/Library/Internet Plug-Ins/Flash Player.plugin/Contents/Info.plist"
JAVA_PLIST = "/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Info.plist"

def version():
        print CMDNAME + ", version " + VERSION
        sys.exit(1)

def usage():
    print CMDNAME + " (" + VERSION + ")"
    print "(C)2013 Jorge Escala"
    print "usage: " + CMDNAME + " [option]"
    print "options:"
    print "    -h  display this usage screen"
    print "    -r  run as a JAMF Casper Suite Recon Extended Attribute"
    print "    -v  display version"
    print "    -V  verbose output"
    sys.exit(1)

def verbose():
    print "Minimum Flash: "+minFlash
    print "Current Flash: "+currentFlash
    print "Minimum Java:  "+minJava
    print "Current Java:  "+currentJava

try:
    opts, args = getopt.getopt(sys.argv[1:], 'hvVr')
except getopt.GetoptError, err:
    print >> sys.stderr, CMDNAME + ": " + str(err)
    sys.exit(2)

for o, a in opts:
        if o == "-h":
                usage()
        elif o == "-r":
                reconEA_opt = True
        elif o == "-v":
                version()
        elif o == "-V":
                verbose_opt = True

# Get blocked versions
if os.path.isfile(XPROT_PLIST):
    try:
        plist = readPlist(XPROT_PLIST)
    except (InvalidPlistException, NotBinaryPlistException), e:
        print "Not a plist:", e
    try:
        minFlash = plist["PlugInBlacklist"]["10"]["com.macromedia.Flash Player.plugin"]["MinimumPlugInBundleVersion"]
    except KeyError:
        minFlash = ""
    try:
        minJava = plist["PlugInBlacklist"]["10"]["com.oracle.java.JavaAppletPlugin"]["MinimumPlugInBundleVersion"]
    except KeyError:
        minJava = ""
else:
    sys.stderr.write("ERROR: XProtect not found.
")
    sys.exit(3)

# Get current Flash version
if os.path.isfile(FLASH_PLIST):
    try:
        plist = readPlist(FLASH_PLIST)
    except (InvalidPlistException, NotBinaryPlistException), e:
        print "Not a plist:", e
    try:
        currentFlash = plist["CFBundleVersion"]
    except KeyError:
        currentFlash = "Problem Detected"
else:
    currentFlash = "Not Installed"

# Get current Java version
if os.path.isfile(JAVA_PLIST):
    try:
        plist = readPlist(JAVA_PLIST)
    except (InvalidPlistException, NotBinaryPlistException), e:
        print "Not a plist:", e
    try:
        currentJava = plist["CFBundleVersion"]
    except KeyError:
        currentJava = "Problem Detected"
else:
    currentJava = "Not Installed"

# Check for verbose run
if verbose_opt:
    verbose()

# Check for blocked plug-ins
if LooseVersion(minFlash) > LooseVersion(currentFlash):
    flashOK = False 
if LooseVersion(minJava) > LooseVersion(currentJava):
    javaOK = False

if reconEA_opt:
    result = ""
    if not flashOK:
        result = result+"Flash "
    if not javaOK:
        result = result+"Java "
    print "<result>"+result+"</result>"
    sys.exit(0)
else:
    if not flashOK:
        print "Adobe Flash is blocked and must be updated to "+minFlash
    if not javaOK:
        print "Oracle Java is blocked and must be updated to "+minJava
    if not flashOK or not javaOK:
        sys.exit(4)

[jhalvorson]

This is the extension attribute I have been using for several years. It's very similar to the one posted by JHBush1973.

I don't have "Collect Plug-ins" enabled on our JSS.

Display Name: App Ver- Adobe Flash Player
Date Type: String
Script:

#!/bin/sh

#Extension Attribute checks to display Adobe Flash Player Version number

if [ -d /Library/Internet Plug-Ins/Flash Player.plugin ]; then
    FlashPluginVersion=`/usr/bin/defaults read /Library/Internet Plug-Ins/Flash Player.plugin/Contents/Info CFBundleVersion`
    echo "<result>$FlashPluginVersion</result>"
else
    echo "<result>Not found</result>"
fi
exit 0

The output appears like this in the JSS:

App Ver- Adobe Flash Player:12.0.0.44

For my smart group, I only want to target devices that have Flash Player and not install it if the user uninstalled it themselves. I also want to avoid installing the current if someone has installed the beta version 13.

Smart Group Name: Adobe Flash is not currently 12.0.0.44

Criteria: App Ver- Adobe Flash Player like 10.
or App Ver- Adobe Flash Player like 11.
or App Ver- Adobe Flash Player like 12.
and App Ver- Adobe Flash Player is not 12.0.0.44
and App Ver- Adobe Flash Player not 13.
and ( Operating System like 10.9
or Operating System like 10.8
or Operating System like 10.7 or Operating System like 10.6 )

[mpittcasd]

How long does it usually take for the data in extension attributes to populate? I added the one for Java from the Extension Attributes page and used one of the Flash version scripts from this thread but both are showing up blank on any of the computers I check.

[bentoms]

@AdamBritt, Extension Attributes populate when a recon is run.

[JPDyson]

Extension Attributes are updated during Inventory, so it depends on your Inventory interval.

[mpittcasd]

I kind of thought so, thanks. Our check-in frequency is set to 15 minutes, so I wonder if they are just not getting the information.

[jescala]

You could always kick off recon from Casper Remote for all your computers...

[mm2270]

it may also be that there's an issue with your script. If you run a manual recon on any Mac - sudo jamf recon in Terminal - and check the Mac's detailed inventory, it should show up. If not, check the EA script to make sure its working and has the requisite echo "<result>some data</result>" line in it.

[bentoms]

Check in is not recon/inventory.

You can manually run a recon as per what @mm2270 has just posted.

[mpittcasd]

After running the recon command per @mm2270 it updated for my computer. What's the best way to start recon on all the computers? I'm still trying to figure a lot of this stuff out.

Thanks everyone for the help and tips so far.

[bentoms]

@AdamBritt, depends.. We run a recon at every login... But I know some people run them weekly.

[jescala]

We run recon daily. But whenever I add a new Extension Attribute I give it a jumpstart by triggering a recon on all Macs. This can be done with Casper Remote. Select all the computers, check off "Update Inventory" in the advanced tab, and click "Go."

[mm2270]

@AdamBritt - there should already be a scheduled policy to update inventory across all your Macs that runs on whatever schedule you chose when you (or someone) set up the JSS. For most people that's once per day. Some people with a lot of Macs spread that out further to once a week.
I'm not certain of the naming of this policy in the 9 series of Casper Suite, but in version 8./x it shows up as simply "Update Inventory"
But in addition to this policy, you can have Macs update inventory after any policy run, especially policies that install new software. In version 9 that's under the Maintenance section. In version 8 its under Advanced. In both cases its a checkbox called "Update Inventory"