Serious Adobe Flash vulnerability
Posted on 12 November 2009.
Foreground Security discovered a critical vulnerability in Adobe Flash.

This vulnerability allows the same-origin policy of Adobe Flash to be exploited to allow nearly any site that allows user generated content to be attacked.

No fix for this vulnerability currently exists.

According to Foreground Security Senior Security Researcher Mike Bailey, who discovered the vulnerability: “Whether you use Flash or not, you may still be vulnerable because this issue affects users directly and not the servers themselves. Websites that are at risk of being vulnerable include social media sites, major career portals, and Fortune 1000 and government agencies websites. Basically, if you have a website, you could be vulnerable.”

Following the discovery, the vulnerability was reported to both Adobe and Google, whose Google Applications, including Gmail, are vulnerable to exploit.

Bailey also noted: “This is insidious because Flash content can be crafted to look like many different file types, such as Microsoft Word or Excel documents, image files or zip files. This variability allows malicious content to appear in many different and normally non-threatening guises. Nobody expects pictures to attack them."

Here's a video demonstration of the (now fixed) Gmail exploit that uses Mike Bailey's Flash exploit as its basis:






Spotlight

Emerging cloud threats and how to address them

Posted on 15 September 2014.  |  Public and community clouds can be appealing targets for hackers looking to disrupt or steal information from scores of organizations with one successful strike. Here are some emerging security threats and issues cloud providers and their clients should be aware of.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Tue, Sep 16th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //