Adobe Flash remote vulnerability (PC1-2008-0440)

A vulnerability in Flash Player 9 is being actively exploited. The latest version of Flash Player (9.0.124.0) appears to correct the vulnerability. Analysis indicates that this vulnerability is the same as or similar to the one described in Application Specific Attacks: Leveraging the ActionScript Virtual Machine by Mark Dowd. The vulnerability depends on ActionScript 3.0 which was introduced in Flash Player 9, so previous versions do not appear to be affected.

In oredr to exploit this vulnerability, an attacker could provoke a victim to open specially crafted Flash content. Public incident reports (SANS ISC, Symantec ThreatCon) specify that this and possibly other Flash vulnerabilities are to be actively exploited. Attacks likely include multiple web sites, specially crafted Flash content, and obscure JavaScript to induce a victim to browse to a site using the vulnerability in order to install malicious software. Attackers might compromise otherwise reliable web sites that use SQL injection or cross-site scripting vulnerabilities in order to inject JavaScript that sends visitors to malicious Flash content.

The vulnerability (or vulnerabilities) being used in these attacks are explained in US-CERT Vulnerability Notes VU#395473 and VU#159523. According to a post on the Adobe Product Security Incident Response Team (PSIRT) blog, the exploit "...appears to be taking advantage of a known vulnerability, reported by Mark Dowd of the ISS X-Force and wushi of team509, that was resolved in Flash Player 9.0.124.0 (CVE-2007-0071)."

With the help of this type of vulnerability, a remote, unauthenticated attacker might be allowed to execute arbitrary code. Different sources say that attackers are exploiting this vulnerability in order to install malicious software.

Upgrade to Flash Player 9.0.124.0 or later. The installation process for Flash Player differs based on web browser platform. Take care to upgrade Flash Player in all supported web browsers.

• Microsoft Windows users should upgrade the Flash ActiveX control by visiting the Adobe Flash Player Download Center using Internet Explorer (IE). This is necessary even if IE is not the primary browser, since other programs may use IE to view Flash content. Alternately, download the stand-alone installer for the Flash Player ActiveX control.
• Users with other web browsers and operating systems should visit the Adobe Flash Player Download Center using each browser that supports Flash. Alternately, download the stand-alone installer for the Flash Player Netscape-style plug-in.

To check the version of Flash Player, visit the Version test for Adobe Flash Player using each web browser that supports Flash.