Serious Adobe Flash vulnerability

Foreground Security discovered a critical vulnerability in Adobe Flash.

This vulnerability allows the same-origin policy of Adobe Flash to be exploited to allow nearly any site that allows user generated content to be attacked.

No fix for this vulnerability currently exists.

According to Foreground Security Senior Security Researcher Mike Bailey, who discovered the vulnerability: “Whether you use Flash or not, you may still be vulnerable because this issue affects users directly and not the servers themselves. Websites that are at risk of being vulnerable include social media sites, major career portals, and Fortune 1000 and government agencies websites. Basically, if you have a website, you could be vulnerable.”

Following the discovery, the vulnerability was reported to both Adobe and Google, whose Google Applications, including Gmail, are vulnerable to exploit.

Bailey also noted: “This is insidious because Flash content can be crafted to look like many different file types, such as Microsoft Word or Excel documents, image files or zip files. This variability allows malicious content to appear in many different and normally non-threatening guises. Nobody expects pictures to attack them.”

Here’s a video demonstration of the (now fixed) Gmail exploit that uses Mike Bailey’s Flash exploit as its basis: