ActiveX flaw exposes Flash users to hackers

By Matt Loney, ZDNet.co.uk, 3 May, 2002 15:56

NEWS

An exploit has been discovered in Macromedia's Flash player that could let hackers execute malicious code on a user's computer. According to Macromedia, more than 436 million copies of the Flash player have been downloaded from its site, accounting for 98 percent of Web users. The exploit appears to have been independently discovered by Macromedia, which has already issued a fixed version of the Flash player, and by security software firm eEye Digital Security, which was credited last year with discovering and naming the Code Red virus. Marc Maiffret, chief hacking officer at eEye, attributed the Macromedia Flash flaw to a buffer overflow vulnerability connected to an ActiveX control called Flash.ocx. "This attack can be performed via some HTML email clients, as well as when visitors visit malicious Web sites," he said. EEye said it had confirmed the vulnerability in Flash Version 6, revision 23 which, it said, would "include most installations on Windows". Older versions of Flash could be affected, said eEye, and while the company admitted it had not tested them, it said that people who have an older version of Flash that is not affected may be forced to "upgrade" to the affected version because the OCX is signed by Macromedia. EEye said it alerted Macromedia on Wednesday, and was told that Macromedia had just released a new revision. "We tried the link they gave us and it did indeed fix the problem," said eEye. Flash Version 6, revision 29 can be downloaded from here. EEye said it decided to make the vulnerability public because the signed OCX control has been downloaded "by an untold number of people, and potentially could still be used in an exploit scenario against those without the latest OCX." Furthermore, said eEye, this issue was found in the wild, "and it is not safe to assume it could not be found by others with malicious intent. Nor do we believe it is safe to assume this has not been found by users with malicious intent." Troy Evans, product manager for Flash player, said the vulnerability only exists in Flash 6, revision 23, and does not affect previous versions of Flash. Revision 23 of the player is the first publicly available version of Flash 6, and was posted for download on Macromedia's site a month ago amid a flurry of publicity. "The latest studies show we have a 3.3 percent penetration with this player," said Evans. "We have updated the deployment, and people are being redirected to revision 29," he said. Evans said he had not heard of any reports of the exploit affecting users. "We have been working with eEye, but we did discover this ourselves." Macromedia had no issue with eEye publicising the vulnerability, said Evans. "The general public should be aware of issues that could affect them." This is not the first security scare with Macromedia Flash. In January, antivirus companies warned PC users that future Macromedia Flash movies could carry malicious viruses and worms after an unknown virus writer sent just such an infectious program to UK antivirus company Sophos. Dubbed SWF/LFM-926, the program did little but infect Flash files on a PC when the movie is played.

For all security-related news, including updates on the latest viruses, hacking exploits and patches, check out ZDNet UK's Viruses and Hacking News Section. Have your say instantly, and see what others have said. Go to the Security forum. Let the editors know what you think in the Mailroom.

Post your comment

In order to post a comment you need to be registered and logged in.

You can also log in with Facebook. Log in or create your ZDNet UK account below

By signing up for this service, you indicate that you agree to our Terms and Conditions and have read and understood our Privacy Policy. Questions about membership? Find the answers in the Community FAQ

ZDNet UK Live

I think WinRT is fantastic. I just wish it was an option for people that didn't want to go through Microsoft's App Store with its attendant...

33 minutes ago by 45283 on Why Windows 8 needs architectural hygiene for WOA

Nine people? £30m? Who's back pocket is that lot going in? And IF they say it is for new buildings, what about all the ones the government has...

2 hours ago by Burn-IT on Police set to launch three £30m e-crime hubs

Just to be clear, nobody knows what is in the text of ACTA, here is a photograph of the text of ACTA http://twitpic.com/8h9iju as submitted to the...

2 hours ago by ewallace on ACTA: Facts, misconceptions and questions

Unfortunately main issue is that ASUS is refusing to accept that they make some mistake on this version of asus Transformer prime. 1 - GPS sensor...

3 hours ago by fgvrg56 on Asus Eee Pad Transformer Prime Wi-Fi & GPS problems?

@Marcus A fair question. Just talked with Archos which said it was working on an announcement for next week....

4 hours ago by Ben Woods on Archos confirms G9 Ice Cream Sandwich update schedule

Any update on this, considering the claimed "first week of February"?

5 hours ago by Marcus Karlsson via Facebook on Archos confirms G9 Ice Cream Sandwich update schedule

Bill Goodrich : Just as al_langevin pointed out, with Windows Server 2008 there is no Services for Macintosh anymore. It's gone, not available....

13 hours ago by apexwm on Windows Server 2008 drops the ball for Mac compatibility

Replying to an old topic that I'm currently facing with my CEO (who is on a Mac). Our servers are primarily Windows Servers, office is about...

20 hours ago by txtrainguy on Windows Server 2008 drops the ball for Mac compatibility

Sure, that makes perfect sense. Pay wrong-doers money and thank them for breaching your security and pointing out your flaws, that would surely...

20 hours ago by k0tcs3 on US indicts Romanian over NASA climate change hack

I think he's referring specifically to Android apps, as Apple do regulate their App Store, but Google seem to let any old crap onto the Android store!

20 hours ago by Random_Error on RIM: BlackBerry will keep 'garbage' apps out of store

Keep the crap apps out?! How will they compete with Android and Apple's claim to fame of having so many life changing apps? I wonder if the media...

1 day ago by Paul Fezziwig via Facebook on RIM: BlackBerry will keep 'garbage' apps out of store

It has been shown time after time that if there is an author store that sells the songs at even 1$ per song and gives you a high-quality digital...

1 day ago by Aigars Mahinovs via Facebook on Copyright isn't working, says European Commission

""As a result of Butyka's alleged conduct, researchers were unable to use the computers for more than two months while NASA removed the malicious...

1 day ago by awbMaven on US indicts Romanian over NASA climate change hack

It simultaneously worries me and uplifts me that a self-proclaimed group of internet activists name themselves after Indian mythical figures....

2 days ago by subhorup on Anonymous activists release PCAnywhere source code

It's actually far easier to work anonymously on the internet than you think. With tools like Tor bouncing your traffic around the world before...

2 days ago by naviathan on Anonymous activists release PCAnywhere source code

1000272134 and bluedalmatian with you both there but then I'm still in 10.04 land (and happy with it)

2 days ago by Agnostic_OS on Ten factors that make Ubuntu 11.10 a hit

Interesting article and definitely see your points on the products mentioned. One of the top products for our Help Desk (approximately 20% of all...

2 days ago by apexwm on Ten flawed products that derail productivity

Absolutely - this should obviously not be handled my isp - but handled by their hosting operator. What's been suggested here is that my isp police...

2 days ago by Paul Hutchinson via Facebook on MPs urge ISPs to take down terrorist material

Looks like a great phone. I don't notice any deficiencies in WP7. used IOS before, that's pretty good. I don't spend much time in Apps, all i need...

2 days ago by Techs UK on Nokia pins US 're-entry' hopes on Lumia 900

Now with the help of these apps you are always synced with MS outlook while on the move. Just download apps like xobni or outlookreflex and get...

2 days ago by Larry Bloggy via Facebook on Outlook Social Connector beta 2 and the LinkedIn connector

Featured white papers

Latest jobs

ActiveX flaw exposes Flash users to hackers

Daily Newsletters

Topics

Related stories

Apple sues over Flash MX video technology

Macromedia makes Web services key with Studio MX

Will Macromedia's Flash plans cripple the Web?

New virus first to infect Macromedia Flash

Perens: Linux could learn from Apple

Post your comment

ZDNet UK Live

Latest in Application Development

Perens: Linux could learn from Apple

Featured white papers

Latest jobs

Test Analyst - Business Intelligence /Data Warehousing

Test Analyst - Business Intelligence /Data Warehousing

Technical MI Manager - 50-60k - Leeds

Inside ZDNet UK

A tale of two distros: Ubuntu and Linux Mint

2012 Predictions: VCE FastPath, VI SAN Probe & Hadoop

BlackBerry Bold 9790

Case study: How cloud enables growth

Ten factors that make Ubuntu 11.10 a hit

Toshiba Portégé Z830-10P Review

BT's archive: Pictures from the vault

News & Analysis

Reviews

Blogs

Resources

About Us

Member Services

Special Features

Advertising Features

ZDNet UK / News and Analysis / Application Development

ActiveX flaw exposes Flash users to hackers

Daily Newsletters

Topics

Related stories

Post your comment

Get ZDNet UK's daily newsletter

Enter your email address to sign up

ZDNet UK Live

Latest in Application Development

Featured white papers

Latest jobs

Inside ZDNet UK

Resources

About Us

Member Services

Special Features

Advertising Features