Approximately 20,000 websites have been compromised with code that could allow a user's system to be exploited remotely, Symantec security researchers have warned.
The attacks, which began on Tuesday, originally involved two Chinese sites hosting exploits for the flaw: wuqing17173.cn and woai117.cn. Further analysis by Symantec indicated another domain involved: dota11.cn.
Malicious code is being injected into third-party domains, probably through SQL-injection attacks. The code then redirects users to sites hosting malicious Flash files, according to an advisory on Symantec's SecurityFocus site.
The code exploits a flaw in Adobe Flash Player version 9.0.115.0, and may affect 9.0.124.0, said Symantec. Other versions of Flash Player may also be affected, Symantec warned. The flaw, which appears to be a buffer overflow vulnerability, occurs when Flash Player processes a malicious Shockwave Flash (SWF) file. Normally SWF files contain animations or interactive applications.
An attacker can use the Flash files to execute whatever code they like (arbitrary code) on the system remotely. Even failed exploit attempts would probably lead to denial-of-service conditions, according to Symantec.
The Sans Institute has reported a further attack, involving the play0nlnie.com domain. The attack generates URLs designed to target specific Flash version and browser combinations, including Internet Explorer and Firefox.
There are no vendor patches as yet. However, the Adobe Product Security Incident Response Team is investigating the issue, according to a blog post.
Update: Following the posting of this article, the Adobe Product Security Incident Response Team issued this statement:
"This exploit appears to be taking advantage of a known vulnerability, reported by Mark Dowd of the ISS X-Force and wushi of team509, that was resolved in Flash Player 9.0.124.0 (CVE-2007-0071). We strongly encourage everyone to download and install the latest Flash Player update, 9.0.124.0."
In order to post a comment you need to be registered and logged in
Log in or create your ZDNet UK account below
By signing up for this service, you indicate that you agree to our Terms and Conditions and have read and understood our Privacy Policy. Questions about membership? Find the answers in the Membership FAQ
love the LHC info. Keep up the good work. May God bless all in volved.
2 hours ago by georgiox on LHC to run for longest continuous period You are quite right. HDS has not been marketing their products well. USPV is miles ahead in terms of ease of use and technology on enterprise...
7 hours ago by sgardia on Will the SUN set on Hitachi Data Systems OEM relationship?
Fedora is the same way as well. The yum update system uses "presto" which shrinks the amount of data needed for download. It's a great system....
18 hours ago by apexwm on Can you believe it - 2765 kB will be freed?
Updated ID cards considered for 2012: [zdnet.co.uk] The government is considering introducing a new generation of ID... http://dlvr.it/KpBZ
18 hours ago on Twitter by cybfor Google, Viacom trade blows in YouTube copyright spat: [zdnet.co.uk] Google and the US media giant Viacom have issued... http://dlvr.it/Knht
20 hours ago on Twitter by cybfor Be sure to include an audio option - eg. a beep tone - to intensify and reiterate the action. This will greatly benefit some consumers and give...
20 hours ago by CIMITL Data disposal is really important to get right. There are standards set by UK and US federal governments to ensure that data is kept secure. If...
20 hours ago by DataSecurityUK Online Fiber Optic Certification Join a talented group of professionals, who are dedicated to Fiber Optic Networking technology. The online course...
22 hours ago by chaycon1 on BT launches 40Mbps fibre-based broadband Online Fiber Optic Certification Join a talented group of professionals, who are dedicated to Fiber Optic Networking technology. The online course...
22 hours ago by chaycon1 on Google to build gigabit broadband to the home
Hi Dava, I'm glad to hear from you, and glad that you see things from the other side. I think that is the most important point of the whole...
22 hours ago by J.A. Watson on Ubuntu 10.04 (Lucid Lynx) and the Latest Tempest
please please please please please please kill that spam bot.
23 hours ago by dava4444 on ZDNet UK: faster, smarter, still IT all the way it didn't post the link it's 'Ubuntu 10.04 Lucid Lynx Beta-1 First Look' on youtube :) Dava
1 day ago by dava4444 on Ubuntu 10.04 (Lucid Lynx) and the Latest Tempest Hi James I disagree, Ubuntu needs a GUI update and this one IMO is quite good. your pics show a low res. here's a high res. on YouTube* The...
1 day ago by dava4444 on Ubuntu 10.04 (Lucid Lynx) and the Latest Tempest Hi any news on the comment bot? knocking me back from my own blog is a bit cheeky lol *Mulder to Scully* "I think it has an agenda.." I know, I...
1 day ago by dava4444 on ZDNet UK: faster, smarter, still IT all the way if you look at the Brentwood exchange on samknows it servers 21,000 residential propertiesm, Lowestoft serves 31,000! Come on BT sort yourselves...
1 day ago by benny boy on BT fibre broadband coming to 69 more towns
[programming] H.264 - a sting in the tail http://reddit.com/bfu4q [zdnet.co.uk]
1 day ago on Twitter by pbreddit
H.264 - a sting in the tail [programming] 13 points, submitted by zigzag [zdnet.co.uk] http://reddit.com/bfu4q
1 day ago on Twitter by reddit Malware infects second Vodafone HTC phone: [zdnet.co.uk] A second Android-based HTC Magic from Vodafone has been... http://dlvr.it/KhKx
1 day ago on Twitter by cybforFor multi-store outlets, including retail, banking, grocery, gas, hospitality, convenience stores and others, reducing (or avoiding) the cost of in-store system support and maintenance while maintaining compliance with PCI and other requirements has become a strategic challenge.
Speaker: Dr. Chenxi Wang, Principal Analyst, Security and Risk Management, Forrester Research, Inc. As Enterprises are increasingly connected to the Internet and as hard organizational boundaries are fast disappearing, security professionals are facing fresh challenges in Enterprise computing.
This tutorial is for new MindManager users and teaches you how to get started, by creating maps, reading maps and organizing your information.
Talkback
Is this cross platform, or does it only affect a windoze based system?
ator1940 29 May 08 13:41 ReplyHi there ator,
Tom Espiner 29 May 08 15:46 ReplyThis issue affects all platforms:
http://www.adobe.com/support/security/bulletins/apsb08-11.html
However, please note the update: Adobe is recommending that people download Flash Player 9.0.124.0, as it apparently is not affected:
http://blogs.adobe.com/psirt/2008/05/potential_flash_player_issue.html
Best wishes,
Tom
Hi Tom;
ator1940 30 May 08 10:35 ReplyAccording to the Adobe page, it requires used interaction.
"A malicious SWF must be loaded in Flash Player by the user for an attacker to exploit these potential vulnerabilities."
My personal site is flash, and I was a little concerned, but it appears I have little to worry about.