Internet users are being urged to patch their web browsers as soon as possible after the discovery of a new “weaponised exploit” in Adobe’s Flash player.
The issue should not affect users of Google’s Chrome or Microsoft Internet Explorer (10 and 11), but users of the older versions of IE, Mozilla Firefox, Apple Safari and Opera should immediately download the latest patch from Adobe.
The vulnerability was discovered by Google security engineer Michele Spagnuolo, who is based in Switzerland.
Spagnuolo apparently informed Adobe of the vulnerability, and they rapidly issued an updated version of Adobe Flash Player. He also informed Google, YouTube, Twitter, Instagram, Tumblr and eBay, as their domains are thought to be vulnerable to this exploit.
“High profile Google domains (accounts.google.com, www.books., maps., etc.) and YouTube were vulnerable and have been recently fixed,” wrote Spagnuolo. “Twitter, Instagram, Tumblr, Olark and eBay still have vulnerable JSONP endpoints at the time of writing this blog post.
Adobe, Google and Twitter have apparently responded and issued fixes. Spagnuolo will present his Rosetta Flash research in October at the Hack In The Box conference in Malaysia.
“Rosetta Flash leverages zlib, Huffman encoding and ADLER32 checksum bruteforcing to convert any SWF file to another one composed of only alphanumeric characters, so that it can be passed as a JSONP callback and then reflected by the endpoint, effectively hosting the Flash file on the vulnerable domain,” wrote Spagnuolo.
Adobe has released a new version of Flash Player, and it’s important that everyone with a vulnerable computer applies the update at the earliest opportunity,” wrote security pundit Graham Cluley.
Cluley also warned people to be aware that Adobe is trying to “foist on users” the McAfee Security Suite, when they download the updated Flash player.
“It’s the kind of dirty trick that you would expect from a scam site, and it’s always disappointing to see the likes of Adobe and McAfee attempting it too,” he wrote.
Are you a security expert? Try our quiz!
Tesla retreats from pioneering gigacasting manufacturing process, amid cost cutting and challenges at EV giant
No skynet please. After the US, UK and France pledge human only control of nuclear…
Microsoft's AI investments continue in south east Asia, after investments in Japan, Malaysia, Indonesia, as…
New chapter for LastPass as it becomes an independent company to focus on cybersecurity, after…
US FCC seeks to ban Chinese telecom firms at centre of national security concerns from…
Two updates to Anthropic's AI chatbot Claude sees arrival of a new business-focused plan, as…