Internet users are being urged to patch their web browsers as soon as possible after the discovery of a new “weaponised exploit” in Adobe’s Flash player.
The issue should not affect users of Google’s Chrome or Microsoft Internet Explorer (10 and 11), but users of the older versions of IE, Mozilla Firefox, Apple Safari and Opera should immediately download the latest patch from Adobe.
The vulnerability was discovered by Google security engineer Michele Spagnuolo, who is based in Switzerland.
Spagnuolo apparently informed Adobe of the vulnerability, and they rapidly issued an updated version of Adobe Flash Player. He also informed Google, YouTube, Twitter, Instagram, Tumblr and eBay, as their domains are thought to be vulnerable to this exploit.
“High profile Google domains (accounts.google.com, www.books., maps., etc.) and YouTube were vulnerable and have been recently fixed,” wrote Spagnuolo. “Twitter, Instagram, Tumblr, Olark and eBay still have vulnerable JSONP endpoints at the time of writing this blog post.
Adobe, Google and Twitter have apparently responded and issued fixes. Spagnuolo will present his Rosetta Flash research in October at the Hack In The Box conference in Malaysia.
“Rosetta Flash leverages zlib, Huffman encoding and ADLER32 checksum bruteforcing to convert any SWF file to another one composed of only alphanumeric characters, so that it can be passed as a JSONP callback and then reflected by the endpoint, effectively hosting the Flash file on the vulnerable domain,” wrote Spagnuolo.
Adobe has released a new version of Flash Player, and it’s important that everyone with a vulnerable computer applies the update at the earliest opportunity,” wrote security pundit Graham Cluley.
Cluley also warned people to be aware that Adobe is trying to “foist on users” the McAfee Security Suite, when they download the updated Flash player.
“It’s the kind of dirty trick that you would expect from a scam site, and it’s always disappointing to see the likes of Adobe and McAfee attempting it too,” he wrote.
Are you a security expert? Try our quiz!
Suspended prison sentence for Craig Wright for “flagrant breach” of court order, after his false…
Cash-strapped south American country agrees to sell or discontinue its national Bitcoin wallet after signing…
Google's change will allow advertisers to track customers' digital “fingerprints”, but UK data protection watchdog…
Welcome to Silicon In Focus Podcast: Tech in 2025! Join Steven Webb, UK Chief Technology…
European Commission publishes preliminary instructions to Apple on how to open up iOS to rivals,…
San Francisco jury finds Nima Momeni guilty of second-degree murder of Cash App founder Bob…