Microsoft has shipped a security advisory with an urgent message for Windows XP users: Update your Flash Player immediately.
The Adobe Flash Player 6 that ships by default in Windows XP is vulnerable to multiple code execution vulnerabilities that could lead to PC takeover attacks, according to the advisory.
Here’s the warning:
Microsoft is aware of reports of vulnerabilities in Adobe Flash Player 6 provided in Windows XP. We are not aware of attacks that try to use the reported vulnerabilities or of customer impact at this time but recommend that users install the latest version of Flash Player provided by Adobe.
The Adobe Flash Player 6 was provided with Windows XP and contains multiple vulnerabilities that could allow remote code execution if a user views a specially crafted Web page. Adobe has addressed these vulnerabilities in newer versions of Adobe Flash Player. Microsoft recommends that users of Windows XP with Adobe Flash Player 6 installed update to the most current version of Flash Player available from Adobe.
This issue affects Windows XP Service Pack 2 and Windows XP Service Pack 3. The warning is also applicable to users running Windows XP Professional x64 Edition Service Pack 2.
Adobe discontinued support for Adobe Flash Player 6 in 2006. The latest version of Adobe Flash Player is 10.0.42.34.
Adobe Flash Player is among the most commonly exploited desktop applications so it’s important for all Windows XP users to heed this warning from Microsoft.
Source: ThreatPost
Filed under Hacks, Security
Tagged as exploit, flash, XSS
A security researcher has identified more than 8 million Adobe Flash files that make the websites hosting them vulnerable to attacks that target visitors with malicious code.
The Flash files are contained on a wide variety of sites operated by online casinos, news organizations, banks, and professional sports teams. They make the pages where they reside susceptible to XSS, or cross-site scripting, attacks that have the potential to inject malicious code and content into a visitor’s browser and in some cases steal credentials used to authenticate user accounts.
The researcher, who goes by the moniker MustLive, said the Flash files contain poorly written ActionScript used to count the number of times a banner has been clicked and typically contain the clickTAG or url parameters. Google searches here and here identified a total more than 8.3 million of them on sites hosted by the New York Giants football team, Praguepost.com and ParadaisPoker.com. Because Google results are often abbreviated, the actual number is probably higher.
MustLive said websites that host the buggy content aren’t automatically vulnerable to XSS exploits. Indeed, even though the pages on the official Citibank website included such content, XSS attacks that tried to exploit them failed.
Source: The Register
Filed under Patches
Tagged as adobe, flash, Patches
Adobe has shipped a critical Flash Player update to fix at least seven documented security vulnerabilities that expose nearly every computer user to dangerous hacker attacks.
The Flash Player 10.0.42.34 update is available for all platforms (Windows, Linux and Mac OS X).
Adobe recommends users of Adobe AIR version 1.5.2 and earlier versions update to Adobe AIR 1.5.3.
Source: ThreatPost
Researchers have discovered a new attack that exploits the way browsers operate with Adobe Flash — and there’s no simple patch for it.
More at Darkreading.com and The Register
