Flash flaw puts most sites, users at risk........

    Flash flaw puts most sites, users at risk........


    Posted: 13 Nov 2009
    Flash flaw puts most sites, users at risk, say researchers

    'Frighteningly bad thing,' said Foreground Security, of flaw allowing hackers to hijack sites, attack users

    By Gregg Keizer
    November 12, 2009 04:17 PM ET

    Computerworld - Hackers can exploit a flaw in Adobe's Flash to compromise nearly every Web site that allows users to upload content, including Google's Gmail, then launch silent attacks on visitors to those sites, security researchers said today.

    Adobe did not dispute the researchers' claims, but said that Web designers and administrators have a responsibility to craft their applications and sites to prevent such attacks.

    "The magnitude of this is huge," said Mike Murray, the chief information security officer at Orlando, Fla.-based Foreground Security. "Any site that allows user-uploadable content is vulnerable, and most are not configured to prevent this."

    The problem lies in the Flash ActionScript same-origin policy, which is designed to limit a Flash object's access to other content only from the domain it originated from, added Mike Bailey, a senior security researcher at Foreground. Unfortunately, said Bailey, if an attacker can deposit a malicious Flash object on a Web site -- through its user-generated content capabilities, which typically allow people to upload files to the site or service -- they can execute malicious scripts in the context of that domain.

    "This is a frighteningly bad thing," Bailey said. "How many Web sites allow users to upload files of some sort? How many of those sites serve files back to users from the same domain as the rest of the application? Nearly every one of them is vulnerable."
    More at: Flash flaw puts most sites, users at risk, say researchers
    Night Hawk's Avatar Posted By: Night Hawk
    13 Nov 2009



  1. Posts : 5,807
    Windows 7 Home Premium x64 - Mac OS X 10.6.4 x64
       #1

    Uh oh...in typical Adobe fashion...they are too lazy to fix their own product...

    Maybe by the time we get flash for x64 the issue will be fixed
      My Computer


  2. Posts : 75
    Windows 7 Home Premium 64-Bit
       #2

    Zidane24 said:
    Maybe by the time we get flash for x64 the issue will be fixed
    Been waiting for x64 Flash for ages It's like waiting for Duke Nukem Forever.
      My Computer


  3. Posts : 8,375
    W7 Ultimate x64/W10 Pro x64/W11 Pro Triple Boot - Main PC W7 Remote PC Micro ATX W7 Pro x64/W11 Pro
    Thread Starter
       #3

    AntiSilence said:
    Zidane24 said:
    Maybe by the time we get flash for x64 the issue will be fixed
    Been waiting for x64 Flash for ages It's like waiting for Duke Nukem Forever.
    You too? Waiting "forever" for DN: Forever!

    You never know however since they recently came out with a sequel for another oldie Return to CastleWolfenstein.

    The Adobe problem however is serious for IE users namely since looking at a pdf file while online like those for specifications on something will entail the Adobe reader there unless you can download it to a folder to use another reader like Sumatra.
      My Computers


  4. Posts : 685
    Windows 7 32bit RTM
       #4

    you might as well wait for silver light to be popular lol...
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 02:55.
Find Us