Flash Flaw Allows Attackers to Take Over Your PC
A recently uncovered flaw in Adobe’s Flash Player software allows malicious sites to run remotely executable code, granting them full control over your PC. The exploit works by first attacking susceptible websites, adding in redirection scripts and then running a .swf file which compromises your PC.
Regrettably this isn’t a theoretical issue, it’s in the wild with Symantec’s Security Focus reporting approximately 20,000 infected web pages. Most of those sites appear to have been compromised through SQL-injection attacks.
By injecting the redirection scripts into normally trusted sites the attacker can send you the malicious .swf file without you ever realizing what’s happening.
Adobe has acknowledged the issue, but so far hasn’t released a patch.
Given that the attack uses redirect scripts, it’s hard to suggest a way to avoid this one, short of disabling the Flash player entirely. Firefox users can use the No Script add-on to stop JavaScript, which should stop the redirects from working.
See Also:
