|13 Nov 2009||#1|
| || |
Flash flaw puts most sites, users at risk........
Flash flaw puts most sites, users at risk, say researchers
'Frighteningly bad thing,' said Foreground Security, of flaw allowing hackers to hijack sites, attack users
By Gregg Keizer
November 12, 2009 04:17 PM ET
Computerworld - Hackers can exploit a flaw in Adobe's Flash to compromise nearly every Web site that allows users to upload content, including Google's Gmail, then launch silent attacks on visitors to those sites, security researchers said today.
Adobe did not dispute the researchers' claims, but said that Web designers and administrators have a responsibility to craft their applications and sites to prevent such attacks.
"The magnitude of this is huge," said Mike Murray, the chief information security officer at Orlando, Fla.-based Foreground Security. "Any site that allows user-uploadable content is vulnerable, and most are not configured to prevent this."
The problem lies in the Flash ActionScript same-origin policy, which is designed to limit a Flash object's access to other content only from the domain it originated from, added Mike Bailey, a senior security researcher at Foreground. Unfortunately, said Bailey, if an attacker can deposit a malicious Flash object on a Web site -- through its user-generated content capabilities, which typically allow people to upload files to the site or service -- they can execute malicious scripts in the context of that domain.
"This is a frighteningly bad thing," Bailey said. "How many Web sites allow users to upload files of some sort? How many of those sites serve files back to users from the same domain as the rest of the application? Nearly every one of them is vulnerable."
|My System Specs|
|14 Nov 2009||#4|
| || |
You never know however since they recently came out with a sequel for another oldie Return to CastleWolfenstein.
The Adobe problem however is serious for IE users namely since looking at a pdf file while online like those for specifications on something will entail the Adobe reader there unless you can download it to a folder to use another reader like Sumatra.
|My System Specs|
|Similar help and support threads for2: Flash flaw puts most sites, users at risk........|
|UPnP networking flaw puts millions of PCs at risk||Security News|
|Another critical Java vulnerability puts 1 billion users at risk||Security News|
|Users turning off UAC put their PCs at risk, says Microsoft||Security News|
|VULNERABILITIES - IE users most at risk from DLL hijacking attacks||System Security|
|Windows DLL-loading security flaw puts Microsoft in a bind||News|
|Poor Flash Design Decisions Put Users at Risk||System Security|
|Satellite Collision Puts Hubble at Risk||Chillout Room|
|Our Sites ||Site Links ||About Us ||Find Us |
© Designer Media Ltd
All times are GMT -5. The time now is 01:22 AM.