back to article Adobe Flash attack vector exploits insecure web design

An unpatched security risk involving Adobe Flash creates a possible mechanism for hackers to load exploits onto websites. The vulnerability was discovered by security researchers at Foreground Security and reported to both Adobe and Google, whose Google Applications, including Gmail, are potentially vulnerable to exploit. No …

COMMENTS

This topic is closed for new posts.
  1. Bilgepipe
    Gates Horns

    Deja Vu

    "The ideal fix should involve Adobe implementing a more sensible origin policy for Flash objects," Bailey added. However, the downside of making Flash more secure in this way is that it would break legitimate (though arguably badly coded) functionality on many sites.

    Hmm, where have I heard this kind of thing before..... Ah yes, Windows.

    Thanks for the warning, I'll go and uninstall Flash right now.

  2. Anonymous Coward
    FAIL

    Anyone else see the irony

    in clicking the link to the Computerworld article only to be presented with a huge Flash ad?

  3. Phil Rigby
    Grenade

    So what???

    "However, the downside of making Flash more secure in this way is that it would break legitimate (though arguably badly coded) functionality on many sites."

    So break them. Force the coders to re-implement the code the -right- way. Then maybe this crap might stop happening. I'll take security over functionality any day.

  4. Anonymous Coward
    FAIL

    The irony

    It does make me smile that to illustrate the flash vulnerability, el Reg decided to use... Flash.

  5. Blain Hamon

    For all 5 of us Mac users...

    If you haven't downloaded ClickToFlash, do so. http://rentzsch.github.com/clicktoflash/

  6. albaleo
    Alert

    Flash plugin plays Flash content

    I don't quite get why this is Adobe's problem. A web server serves Flash content and the end user's browser uses the Flash plugin to run it. Isn't that how things should work? Shouldn't the solution lie with the website serving the content? After all, if I understand the issue, the problem only affects their site and its users.

  7. Anonymous Coward
    Grenade

    More flash vunerabilities?

    Wow, <sarcasm> how shocking! </sarcasm>

  8. sleepy

    so how does this actually affect me?

    If I entrust data (such as address book , emails etc) to a web service (such as webmail) thenFlash content (within, say, an email) can do what it likes with my data if they are both served from the same domain. Web sites should host unvetted scripted content from a separate domain so its scripts are sandboxed.

    Adobe's is putting self-interest before user security in not implementing any mechanism to enforce security. Maybe users should be implementing their won Flash security. I'm with ClickToFLash, and I hope Flash never comes to iPhone.

  9. Havin_it
    Flame

    Easy-peasy, then

    Right, let's see. TFA gives us absolutely *no clue* how this works, and I include the "illustrative" YeChoob embed in that assertion (how the frig am I supposed to interpret that?), so let's go to the linked ComputerWorld article:

    "He used the example of a company that lets users upload content to a message forum to explain the process. "If the user forum lets people upload an image for their avatar, someone could upload a malicious Flash file that looks like an avatar image," Bailey said. "Anyone who then views that avatar would be vulnerable to attack.""

    Point 1: Why the ready, willing and greased-up FUCK would any site let a user upload a Flash file as an avatar in the first place? I do believe most server-side scripting languages can tell the difference.

    Point 2: <img src="/usercontent/dodgyflashfile.swf" /> does not render a Flash object in any browser I know of. I can't see why the swf-masquerading-as-gif possibility is an issue here at all. (Correct me if I'm wrong and browsers actually have become that clever/'tarded.)

    Any site that (a) lets users upload Flash, Java, JavaScript or *any* damn thing that can make the browser do tricks without *very* thorough vetting by live humans and (b) serves that same content back to *any* user (including the uploader) deserves to be rendered into gobbets by a pitchfork-wielding mob of their users (and I should think the shareholders won't be too far behind).

    I struggle to comprehend the fuckwittedness of any web-dev that could allow themselves to be vulnerable to something like this.

  10. Anonymous Coward
    Grenade

    you forget about Windows defaults

    Windows, and therefore IE, default to execute files based on their content, not on their type (.gif, .pdf, etc). And you're correct, if a website allows me to upload an .EXE file named avatar.gif, then the blame gets spread between the website developers and M$.0

  11. Norio

    Use Opera

    Or use the Opera browser, which has a "ClickToFlash"-type mechanism built into it.

This topic is closed for new posts.